diff options
| author | Waqas Hussain <waqas20@gmail.com> | 2009-03-08 05:03:22 +0500 |
|---|---|---|
| committer | Waqas Hussain <waqas20@gmail.com> | 2009-03-08 05:03:22 +0500 |
| commit | 61ca31c484a4ad127d9088aaf14914c3af37a26a (patch) | |
| tree | 41e75f41c74be189909c61cde09997346c5bf88d /plugins/mod_xmlrpc.lua | |
| parent | c7333421616f6c5d32f136ad8bcb795a7c393554 (diff) | |
| download | prosody-61ca31c484a4ad127d9088aaf14914c3af37a26a.tar.gz prosody-61ca31c484a4ad127d9088aaf14914c3af37a26a.zip | |
mod_xmlrpc: Limit usage to admins
Diffstat (limited to 'plugins/mod_xmlrpc.lua')
| -rw-r--r-- | plugins/mod_xmlrpc.lua | 48 |
1 files changed, 27 insertions, 21 deletions
diff --git a/plugins/mod_xmlrpc.lua b/plugins/mod_xmlrpc.lua index 8174462a..238ee3ea 100644 --- a/plugins/mod_xmlrpc.lua +++ b/plugins/mod_xmlrpc.lua @@ -14,6 +14,11 @@ local st = require "util.stanza"; local pcall = pcall; local unpack = unpack; local tostring = tostring; +local is_admin = require "core.usermanager".is_admin; +local jid_split = require "util.jid".split; +local b64_decode = require "util.encodings".base64.decode; +local get_method = require "core.objectmanager".get_object; +local validate_credentials = require "core.usermanager".validate_credentials; local translate_request = require "util.xmlrpc".translate_request; local create_response = require "util.xmlrpc".create_response; @@ -60,13 +65,6 @@ local function parse_xml(xml) return stanza.tags[1]; end ---[[local function get_method(method) - return function(...) - return {method = method; args = {...}}; - end -end]] -local get_method = require "core.objectmanager".get_object; - local function handle_xmlrpc_request(method, args) method = get_method(method); if not method then return create_error_response(404, "method not found"); end @@ -86,29 +84,37 @@ local function handle_xmpp_request(origin, stanza) local query = stanza.tags[1]; if query.name == "query" then if #query.tags == 1 then - local success, method, args = pcall(translate_request, query.tags[1]); - if success then - local result = handle_xmlrpc_request(method, args); - origin.send(st.reply(stanza):tag('query', {xmlns='jabber:iq:rpc'}):add_child(result)); - else - origin.send(st.error_reply(stanza, "modify", "bad-request", method)); - end - else - origin.send(st.error_reply(stanza, "modify", "bad-request", "No content in XML-RPC request")); - end - else - origin.send(st.error_reply(stanza, "cancel", "service-unavailable")); - end + if is_admin(stanza.attr.from) then + local success, method, args = pcall(translate_request, query.tags[1]); + if success then + local result = handle_xmlrpc_request(method, args); + origin.send(st.reply(stanza):tag('query', {xmlns='jabber:iq:rpc'}):add_child(result)); + else + origin.send(st.error_reply(stanza, "modify", "bad-request", method)); + end + else origin.send(st.error_reply(stanza, "auth", "forbidden", "No content in XML-RPC request")); end + else origin.send(st.error_reply(stanza, "modify", "bad-request", "No content in XML-RPC request")); end + else origin.send(st.error_reply(stanza, "cancel", "service-unavailable")); end end module:add_iq_handler({"c2s", "s2sin"}, "jabber:iq:rpc", handle_xmpp_request); module:add_feature("jabber:iq:rpc"); +-- TODO add <identity category='automation' type='rpc'/> to disco replies -local default_headers = { ["Content-Type"] = "text/xml" }; +local default_headers = { ['Content-Type'] = 'text/xml' }; +local unauthorized_response = { status = '401 UNAUTHORIZED', headers = {['Content-Type']='text/html', ['WWW-Authenticate']='Basic realm="WallyWorld"'}; body = "<html><body>Authentication required</body></html>"; }; local function handle_http_request(method, body, request) + -- authenticate user + local username, password = b64_decode(request['authorization'] or ''):gmatch('([^:]*):(.*)')(); -- TODO digest auth + local node, host = jid_split(username); + if not validate_credentials(host, node, password) and is_admin(username) then + return unauthorized_response; + end + -- parse request local stanza = body and parse_xml(body); if (not stanza) or request.method ~= "POST" then return "<html><body>You really don't look like an XML-RPC client to me... what do you want?</body></html>"; end + -- execute request local success, method, args = pcall(translate_request, stanza); if success then return { headers = default_headers; body = tostring(handle_xmlrpc_request(method, args)) }; |