# HG changeset patch
# User daurnimator <quae@daurnimator.com>
# Date 1396030518 14400
# Node ID 85f7cd91dc31972cf18c4f53d3230a0eef09b664
# Parent  d4a8840e72f9871a4abca402551f2a6b23458009
plugins/muc/muc.lib: Smarter validation in set_affiliation

diff -r d4a8840e72f9 -r 85f7cd91dc31 plugins/muc/muc.lib.lua
--- a/plugins/muc/muc.lib.lua	Fri Mar 28 13:34:46 2014 -0400
+++ b/plugins/muc/muc.lib.lua	Fri Mar 28 14:15:18 2014 -0400
@@ -1311,12 +1311,24 @@
 	if not result and self._affiliations[host] == "outcast" then result = "outcast"; end -- host banned
 	return result;
 end
+
+local valid_affiliations = {
+	outcast = true;
+	none = true;
+	member = true;
+	admin = true;
+	owner = true;
+};
 function room_mt:set_affiliation(actor, jid, affiliation, reason)
+	if not actor then return nil, "modify", "not-acceptable"; end;
+
 	jid = jid_bare(jid);
-	if affiliation == "none" then affiliation = nil; end
-	if affiliation and affiliation ~= "outcast" and affiliation ~= "owner" and affiliation ~= "admin" and affiliation ~= "member" then
+
+	if valid_affiliations[affiliation or "none"] == nil then
 		return nil, "modify", "not-acceptable";
 	end
+	affiliation = affiliation ~= "none" and affiliation or nil; -- coerces `affiliation == false` to `nil`
+
 	if actor ~= true then
 		local actor_affiliation = self:get_affiliation(actor);
 		local target_affiliation = self:get_affiliation(jid);