Chapril/xmpp.chapril.org-ejabberd
25
1
Fork 0
mirror of https://github.com/processone/ejabberd.git synced 2024-11-24 16:23:40 +01:00
Code Releases Activity

prevent unauthorized entity to gain none-affiliation for given entity

Browse Source 
SVN Revision: 1802
This commit is contained in:
Christophe Romain 2009-01-11 04:08:10 +00:00
parent 8090011126
commit 1ac9246a49
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog
View File

@ -4,6 +4,9 @@
permissions (thanks to Andy Skelton)(EJAB-840) permissions (thanks to Andy Skelton)(EJAB-840)
* src/mod_pubsub/node_default.erl: Likewise * src/mod_pubsub/node_default.erl: Likewise
* src/mod_pubsub/node_default.erl: prevent unauthorized entity to gain
none-affiliation for given entity (EJAB-840)
2009-01-10 Christophe Romain <christophe.romain@process-one.net> 2009-01-10 Christophe Romain <christophe.romain@process-one.net>
* src/mod_pubsub/node_default.erl: fix unsubscription of full jid * src/mod_pubsub/node_default.erl: fix unsubscription of full jid

6
src/mod_pubsub/node_default.erl
View File

@ -356,6 +356,9 @@ unsubscribe_node(Host, Node, Sender, Subscriber, _SubId) ->
_ -> get_state(Host, Node, SubKey) _ -> get_state(Host, Node, SubKey)
end, end,
if if
%% Requesting entity is prohibited from unsubscribing entity
not Authorized ->
{error, ?ERR_FORBIDDEN};
%% Entity did not specify SubID %% Entity did not specify SubID
%%SubID == "", ?? -> %%SubID == "", ?? ->
%% {error, ?ERR_EXTENDED(?ERR_BAD_REQUEST, "subid-required")}; %% {error, ?ERR_EXTENDED(?ERR_BAD_REQUEST, "subid-required")};
@ -365,9 +368,6 @@ unsubscribe_node(Host, Node, Sender, Subscriber, _SubId) ->
%% Requesting entity is not a subscriber %% Requesting entity is not a subscriber
SubState#pubsub_state.subscription == none -> SubState#pubsub_state.subscription == none ->
{error, ?ERR_EXTENDED(?ERR_UNEXPECTED_REQUEST, "not-subscribed")}; {error, ?ERR_EXTENDED(?ERR_UNEXPECTED_REQUEST, "not-subscribed")};
%% Requesting entity is prohibited from unsubscribing entity
not Authorized ->
{error, ?ERR_FORBIDDEN};
%% Was just subscriber, remove the record %% Was just subscriber, remove the record
SubState#pubsub_state.affiliation == none -> SubState#pubsub_state.affiliation == none ->
del_state(SubState#pubsub_state.stateid), del_state(SubState#pubsub_state.stateid),