ソースを参照

Handles '*' as room name in jwt.

Allows '*' in jwt to allow connecting to any room.
j8
damencho 8年前
コミット
00afc32b6b

+ 1
- 1
resources/prosody-plugins/mod_token_verification.lua ファイルの表示

49
         "Will verify token for user: %s, room: %s ", user_jid, stanza.attr.to);
49
         "Will verify token for user: %s, room: %s ", user_jid, stanza.attr.to);
50
     if not token_util:verify_room(session, stanza.attr.to) then
50
     if not token_util:verify_room(session, stanza.attr.to) then
51
         log("error", "Token %s not allowed to join: %s",
51
         log("error", "Token %s not allowed to join: %s",
52
-            tostring(session.auth_token), tostring(session.jitsi_meet_room));
52
+            tostring(session.auth_token), tostring(stanza.attr.to));
53
         session.send(
53
         session.send(
54
             st.error_reply(
54
             st.error_reply(
55
                 stanza, "cancel", "not-allowed", "Room and token mismatched"));
55
                 stanza, "cancel", "not-allowed", "Room and token mismatched"));

+ 24
- 5
resources/prosody-plugins/token/util.lib.lua ファイルの表示

263
     if not self.enableDomainVerification then
263
     if not self.enableDomainVerification then
264
         -- if auth_room is missing, this means user is anonymous (no token for
264
         -- if auth_room is missing, this means user is anonymous (no token for
265
         -- its domain) we let it through, jicofo is verifying creation domain
265
         -- its domain) we let it through, jicofo is verifying creation domain
266
-        if auth_room and room ~= string.lower(auth_room) then
266
+        if auth_room and room ~= string.lower(auth_room) and auth_room ~= '*' then
267
             return false;
267
             return false;
268
         end
268
         end
269
 
269
 
271
     end
271
     end
272
 
272
 
273
     local room_address_to_verify = jid.bare(room_address);
273
     local room_address_to_verify = jid.bare(room_address);
274
+    local room_node = jid.node(room_address);
274
     -- parses bare room address, for multidomain expected format is:
275
     -- parses bare room address, for multidomain expected format is:
275
     -- [subdomain]roomName@conference.domain
276
     -- [subdomain]roomName@conference.domain
276
-    local target_subdomain, target_room
277
-            = room_address_to_verify:match("^%[([^%]]+)%](.+)$");
277
+    local target_subdomain, target_room = room_node:match("^%[([^%]]+)%](.+)$");
278
+
279
+    -- if we have '*' as room name in token, this means all rooms are allowed
280
+    -- so we will use the actual name of the room when constructing strings
281
+    -- to verify subdomains and domains to simplify checks
282
+    local room_to_check;
283
+    if auth_room == '*' then
284
+        -- authorized for accessing any room assign to room_to_check the actual
285
+        -- room name
286
+        if target_room ~= nil then
287
+            -- we are in multidomain mode and we were able to extract room name
288
+            room_to_check = target_room;
289
+        else
290
+            -- no target_room, room_address_to_verify does not contain subdomain
291
+            -- so we get just the node which is the room name
292
+            room_to_check = room_node;
293
+        end
294
+    else
295
+        room_to_check = auth_room;
296
+    end
278
 
297
 
279
     local auth_domain = session.jitsi_meet_domain;
298
     local auth_domain = session.jitsi_meet_domain;
280
     if target_subdomain then
299
     if target_subdomain then
286
         end
305
         end
287
 
306
 
288
         return room_address_to_verify == jid.join(
307
         return room_address_to_verify == jid.join(
289
-            "["..auth_domain.."]"..string.lower(auth_room), self.muc_domain);
308
+            "["..auth_domain.."]"..string.lower(room_to_check), self.muc_domain);
290
     else
309
     else
291
         -- we do not have a domain part (multidomain is not enabled)
310
         -- we do not have a domain part (multidomain is not enabled)
292
         -- verify with info from the token
311
         -- verify with info from the token
293
         return room_address_to_verify == jid.join(
312
         return room_address_to_verify == jid.join(
294
-            string.lower(auth_room), self.muc_domain_prefix.."."..auth_domain);
313
+            string.lower(room_to_check), self.muc_domain_prefix.."."..auth_domain);
295
     end
314
     end
296
 end
315
 end
297
 
316
 

読み込み中…
キャンセル
保存