core.sessionmanager: Require that client-requested resources pass strict resourceprep
--- a/core/sessionmanager.lua Sat Nov 02 15:29:13 2019 +0100
+++ b/core/sessionmanager.lua Sat Nov 02 15:39:01 2019 +0100
@@ -150,7 +150,7 @@
resource = event_payload.resource;
end
- resource = resourceprep(resource or "");
+ resource = resourceprep(resource or "", true);
resource = resource ~= "" and resource or generate_identifier();
--FIXME: Randomly-generated resources must be unique per-user, and never conflict with existing