Sfoglia il codice sorgente

Adds token verification for poltergeist accepted rest calls.

master
damencho 8 anni fa
parent
commit
2c873e8c7f
1 ha cambiato i file con 68 aggiunte e 0 eliminazioni
  1. 68
    0
      resources/prosody-plugins/mod_muc_poltergeist.lua

+ 68
- 0
resources/prosody-plugins/mod_muc_poltergeist.lua Vedi File

20
     return;
20
     return;
21
 end
21
 end
22
 
22
 
23
+local parentCtx = module:context(parentHostName);
24
+if parentCtx == nil then
25
+    log("error",
26
+        "Failed to start - unable to get parent context for host: %s",
27
+        tostring(parentHostName));
28
+    return;
29
+end
30
+local token_util = module:require "token/util".new(parentCtx);
31
+
32
+-- option to enable/disable token verifications
33
+local disableTokenVerification
34
+    = module:get_option_boolean("disable_polergeist_token_verification", false);
35
+
23
 -- table to store all poltergeists we create
36
 -- table to store all poltergeists we create
24
 local poltergeists = {};
37
 local poltergeists = {};
25
 -- table to mark that outgoing unavailable presences
38
 -- table to mark that outgoing unavailable presences
91
     end
104
     end
92
 end
105
 end
93
 
106
 
107
+--- Verifies room name, domain name with the values in the token
108
+-- @param token the token we received
109
+-- @param room_name the room name
110
+-- @param group name of the group (optional)
111
+-- @return true if values are ok or false otherwise
112
+function verify_token(token, room_name, group)
113
+    if disableTokenVerification then
114
+        return true;
115
+    end
116
+
117
+    -- if not disableTokenVerification and we do not have token
118
+    -- stop here, cause the main virtual host can have guest access enabled
119
+    -- (allowEmptyToken = true) and we will allow access to rooms info without
120
+    -- a token
121
+    if token == nil then
122
+        log("warn", "no token provided");
123
+        return false;
124
+    end
125
+
126
+    local session = {};
127
+    session.auth_token = token;
128
+    local verified, reason = token_util:process_and_verify_token(session);
129
+    if not verified then
130
+        log("warn", "not a valid token %s", tostring(reason));
131
+        return false;
132
+    end
133
+
134
+    local room_address = jid.join(room_name, module:get_host());
135
+    -- if there is a group we are in multidomain mode and that group is not
136
+    -- our parent host
137
+    if group and group ~= "" and group ~= parentHostName then
138
+        room_address = "["..group.."]"..room_address;
139
+    end
140
+
141
+    if not token_util:verify_room(session, room_address) then
142
+        log("warn", "Token %s not allowed to join: %s",
143
+            tostring(token), tostring(room_address));
144
+        return false;
145
+    end
146
+
147
+    return true;
148
+end
149
+
94
 -- if we found that a session for a user with id has a poltergiest already
150
 -- if we found that a session for a user with id has a poltergiest already
95
 -- created, retrieve its jid and return it to the authentication
151
 -- created, retrieve its jid and return it to the authentication
96
 -- so we can reuse it and we that real user will replace the poltergiest
152
 -- so we can reuse it and we that real user will replace the poltergiest
253
     local avatar = params["avatar"];
309
     local avatar = params["avatar"];
254
     local status = params["status"];
310
     local status = params["status"];
255
 
311
 
312
+    if not verify_token(params["token"], room_name, group) then
313
+        return 403;
314
+    end
315
+
256
     local room = get_room(room_name, group);
316
     local room = get_room(room_name, group);
257
     if (not room) then
317
     if (not room) then
258
         log("error", "no room found %s", room_name);
318
         log("error", "no room found %s", room_name);
282
     local group = params["group"];
342
     local group = params["group"];
283
     local status = params["status"];
343
     local status = params["status"];
284
 
344
 
345
+    if not verify_token(params["token"], room_name, group) then
346
+        return 403;
347
+    end
348
+
285
     local room = get_room(room_name, group);
349
     local room = get_room(room_name, group);
286
     if (not room) then
350
     if (not room) then
287
         log("error", "no room found %s", room_name);
351
         log("error", "no room found %s", room_name);
354
     local room_name = params["room"];
418
     local room_name = params["room"];
355
     local group = params["group"];
419
     local group = params["group"];
356
 
420
 
421
+    if not verify_token(params["token"], room_name, group) then
422
+        return 403;
423
+    end
424
+
357
     local room = get_room(room_name, group);
425
     local room = get_room(room_name, group);
358
     if (not room) then
426
     if (not room) then
359
         log("error", "no room found %s", room_name);
427
         log("error", "no room found %s", room_name);

Loading…
Annulla
Salva