aboutsummaryrefslogtreecommitdiffstats
path: root/plugins
Commit message (Collapse)AuthorAgeFilesLines
...
| * | | Backed out changeset 73a45ba6e3f1 in favour of 427dd01f0864Matthew Wild2022-09-291-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New behaviour (muc_room_allow_persistent = true, the default): - Parent host users are not restricted by default (prosody:user) - Users without roles (by default that is non-admins, non-parent-host users, and users on other servers) can no longer configure persistence by default. muc_room_allow_persistent = false will restrict persistence to prosody:admin. Parent-host users should not be restricted by default, and this can be configured via the new roles/permissions options.
| * | | mod_muc: Better map restrict_room_creation to role permissions (behaviour ↵Matthew Wild2022-09-291-21/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | change) With this change and 427dd01f0864, room creation is now effectively restricted to parent-host users by default. This is a better default than previous Prosody versions (where room creation was not restricted). The "local" option for restrict_room_creation is no longer used (any value other than true/false won't change the default behaviour). restrict_room_creation = true will grant prosody:admin the ability to create rooms. restrict_room_creation = false disables all permission checks. Anything between these two can be achieved using custom roles and permissions.
| * | | mod_authz_internal: Allow configuring role of local-server/parent-host usersMatthew Wild2022-09-291-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'host_user_role' is the default role of users who have JIDs on the "parent" host (i.e. jabber.org users on conference.jabber.org). Defaults to 'prosody:user'. 'server_user_roles' is the default role of users who have JIDs on any active host on the current Prosody instance. Default to nil (no role). This finally allows better permissions splitting between host and server users, which has previously been done (e.g. in MUC) with options like 'restrict_room_creation' and 'muc_room_allow_persistent'. Using roles makes these permissions a lot more flexible, and easier for developers to integrate.
| * | | muc: Re-allow non-admins to configure persistence (thanks Meaz)Matthew Wild2022-09-281-6/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Non-admins don't have a role on MUC services by default. Not even prosody:user. This meant they had no :create-persistent-room permission, even if muc_room_allow_persistent was true (the default). Now we only check the role permissions if persistent room creation is restricted, otherwise we skip any permission checks, just like previous versions.
| * | | mod_admin_shell: Fix display of session without role (thanks Link Mauve)Kim Alvefur2022-09-231-1/+1
| | | | | | | | | | | | | | | | This can happen to sessions before they are assigned a role
| * | | mod_saslauth: Put <sasl-channel-binding> in stream:features per XEP-0440 0.4.0Matthew Wild2022-09-211-4/+4
| | | |
| * | | mod_storage_sql: Strip timestamp precision in queries to fix error (thanks ↵Kim Alvefur2022-09-071-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | muppeth) Fixes Error in SQL transaction: Error executing statement parameters: ERROR: invalid input syntax for integer This was handled for INSERT in 9524bb7f3944 but not SELECT.
| * | | mod_http_file_share: Use correct variable name (thanks riau.sni)Matthew Wild2022-09-041-3/+3
| | | |
| * | | mod_saslauth: Fix incorrect variable name introduced in 27a4a7e64831Matthew Wild2022-09-031-1/+1
| | | |
| * | | mod_smacks: Set session flag during successful enableMatthew Wild2022-09-031-0/+1
| | | |
| * | | mod_smacks: Add type field to results so actions can be later distinguishedMatthew Wild2022-09-031-1/+2
| | | |
| * | | mod_saslauth: Only announce bind feature if no resource yet boundMatthew Wild2022-09-031-1/+1
| | | | | | | | | | | | | | | | It's now possible to bind during SASL2 negotiation.
| * | | mod_http_file_share: Switch to new util.jwt APIMatthew Wild2022-07-111-32/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some changes/improvements in this commit: - Default token lifetime is now 3600s (from 300s) - Tokens are only validated once per upload - "iat"/"exp" are handled automatically by util.jwt
| * | | mod_smacks: Set session.smacks after sending <enabled/> to fix tracebackMatthew Wild2022-08-291-2/+1
| | | | | | | | | | | | | | | | ...with opportunistic writes enabled.
| * | | mod_smacks: Use new :add_error() in last remaining error result constructionMatthew Wild2022-08-291-2/+1
| | | |
| * | | mod_smacks: Split enable handling to stages, to allow easier SASL2 integrationMatthew Wild2022-08-291-21/+48
| | | |
| * | | mod_component: Require 'from' attribute on stanzas by defaultMatthew Wild2022-08-281-16/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The old behaviour of falling back to the component domain when it is missing has been merged into the logic for the existing "validate_from_addresses" option (which is strict by default). ejabberd already rejects component stanzas with no 'from' (as the XEP requires), and this has led to compatibility issues for components that were seemingly working fine with Prosody.
| * | | mod_external_services: Update tools.ietf.org URLKim Alvefur2022-08-271-1/+1
| | | | | | | | | | | | | | | | See bd9e006a7a74
| * | | mod_smacks: Split resumption into multiple stages, to simplify ISR integrationMatthew Wild2022-08-261-63/+82
| | | | | | | | | | | | | | | | | | | | This will allow us to return the success/failed as part of the SASL2 response, and *then* perform the stanza sync as a second step.
| * | | mod_s2s: Simplify conditionals since all sessions should have .host nowKim Alvefur2022-08-261-1/+1
| | | |
| * | | Merge 0.12->trunkKim Alvefur2022-08-261-2/+2
| |\ \ \
| * | | | mod_smacks: Don't close resuming session when failed due to overflowMatthew Wild2022-08-261-7/+8
| | | | |
| * | | | mod_smacks: Long overdue cleanup of resumption code, fixes some old TODOsMatthew Wild2022-08-262-51/+21
| | | | |
| * | | | mod_admin_shell: Rename variable to avoid confusion with global functionKim Alvefur2022-08-251-7/+7
| | | | | | | | | | | | | | | | | | | | For luacheck, but it doesn't actually complain about this right now
| * | | | mod_admin_shell: Fix output from user:roles()Kim Alvefur2022-08-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | It used _G.print instead of the shell session print, which would silently write to stdout
| * | | | mod_admin_shell: Ensure account has role before it is usableKim Alvefur2022-08-181-8/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By creating the account first without a password it can't be used until the role has set. This is most important for restricted accounts, as a failure to set the role would lead to the account having more privileges than indented.
| * | | | mod_auth_insecure: Store creation and update timestamps on accountKim Alvefur2022-08-181-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | This ensures that the store is not empty in case no password is provided, so the underlying data storage won't consider the store empty.
| * | | | mod_admin_shell: Update help for user:create to reflect singular role argumentKim Alvefur2022-08-181-1/+1
| | | | |
| * | | | mod_auth_internal_hashed: Allow creating disabled account without passwordKim Alvefur2022-08-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Otherwise, create_user(username, nil) leads to the account being deleted.
| * | | | mod_admin_shell: Update with new role management commands and help textMatthew Wild2022-08-181-39/+52
| | | | |
| * | | | mod_authz_internal: Expose convenience method to test if user can assume roleMatthew Wild2022-08-181-0/+12
| | | | |
| * | | | mod_authz_internal, and more: New iteration of role APIMatthew Wild2022-08-173-38/+132
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These changes to the API (hopefully the last) introduce a cleaner separation between the user's primary (default) role, and their secondary (optional) roles. To keep the code sane and reduce complexity, a data migration is needed for people using stored roles in 0.12. This can be performed with prosodyctl mod_authz_internal migrate <host>
| * | | | mod_admin_shell: Show session role in c2s:showKim Alvefur2022-08-151-1/+10
| | | | |
| * | | | mod_tokenauth: New API that better fits how modules are using token authMatthew Wild2022-07-201-12/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This also updates the module to the new role API, and improves support for scope/role selection (currently treated as the same thing, which they almost are).
| * | | | mod_authz_internal: Use util.roles, some API changes and config supportMatthew Wild2022-07-191-63/+96
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit was too awkward to split (hg record didn't like it), so: - Switch to the new util.roles lib to provide a consistent representation of a role object. - Change API method from get_role_info() to get_role_by_name() (touches sessionmanager and usermanager) - Change get_roles() to get_user_roles(), take a username instead of a JID This is more consistent with all other usermanager API methods. - Support configuration of custom roles and permissions via the config file (to be documented).
| * | | | usermanager, mod_auth_*: Add get_account_info() returning creation/update timeMatthew Wild2022-07-122-2/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is useful for a number of things. For example, listing users that need to rotate their passwords after some event. It also provides a safer way for code to determine that a user password has changed without needing to set a handler for the password change event (which is a more fragile approach).
| * | | | Switch to a new role-based authorization framework, removing is_admin()Matthew Wild2022-06-1511-122/+191
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We began moving away from simple "is this user an admin?" permission checks before 0.12, with the introduction of mod_authz_internal and the ability to dynamically change the roles of individual users. The approach in 0.12 still had various limitations however, and apart from the introduction of roles other than "admin" and the ability to pull that info from storage, not much actually changed. This new framework shakes things up a lot, though aims to maintain the same functionality and behaviour on the surface for a default Prosody configuration. That is, if you don't take advantage of any of the new features, you shouldn't notice any change. The biggest change visible to developers is that usermanager.is_admin() (and the auth provider is_admin() method) have been removed. Gone. Completely. Permission checks should now be performed using a new module API method: module:may(action_name, context) This method accepts an action name, followed by either a JID (string) or (preferably) a table containing 'origin'/'session' and 'stanza' fields (e.g. the standard object passed to most events). It will return true if the action should be permitted, or false/nil otherwise. Modules should no longer perform permission checks based on the role name. E.g. a lot of code previously checked if the user's role was prosody:admin before permitting some action. Since many roles might now exist with similar permissions, and the permissions of prosody:admin may be redefined dynamically, it is no longer suitable to use this method for permission checks. Use module:may(). If you start an action name with ':' (recommended) then the current module's name will automatically be used as a prefix. To define a new permission, use the new module API: module:default_permission(role_name, action_name) module:default_permissions(role_name, { action_name[, action_name...] }) This grants the specified role permission to execute the named action(s) by default. This may be overridden via other mechanisms external to your module. The built-in roles that developers should use are: - prosody:user (normal user) - prosody:admin (host admin) - prosody:operator (global admin) The new prosody:operator role is intended for server-wide actions (such as shutting down Prosody). Finally, all usage of is_admin() in modules has been fixed by this commit. Some of these changes were trickier than others, but no change is expected to break existing deployments. EXCEPT: mod_auth_ldap no longer supports the ldap_admin_filter option. It's very possible nobody is using this, but if someone is then we can later update it to pull roles from LDAP somehow.
| * | | | mod_saslauth: Rename field from 'scope'->'role'Matthew Wild2022-06-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 'scope' term derives from OAuth, and represents a bundle of permissions. We're now setting on the term 'role' for a bundle of permissions. This change does not affect any public modules I'm aware of.
| * | | | Merge 0.12->trunkMatthew Wild2022-08-181-4/+8
| |\ \ \ \
| * | | | | util.stanza: Add method for extracting a single attribute valueKim Alvefur2022-08-171-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sometimes you only care about a single attribute, but the child tag itself may be optional, leading to needing `tag and tag.attr.foo` or `stanza:find("tag@foo")`. The `:find()` method is fairly complex, so avoiding it for this kind of simpler use case is a win.
| * | | | | mod_time: Remove obsolete XEP-0090 supportKim Alvefur2022-08-151-14/+0
| | | | | | | | | | | | | | | | | | | | | | | | Deprecated even before Prosody even started, obsolete for over a decade.
| * | | | | mod_time: Return sub-second precision timestampsKim Alvefur2022-08-141-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | Because why not? Who even has this module enabled?
| * | | | | mod_storage_sql: Drop archive timestamp precision pending schema updateKim Alvefur2022-08-141-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "when" column is an INTEGER which will probably be unhappy about storing higher precision timestamps, so we keep the older behavior for now.
| * | | | | mod_mam: Store archives with sub-second precision timestampsKim Alvefur2022-08-141-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes sub-second part of example timestamp to .5 in order to avoid floating point issues. Some clients use timestamps when ordering messages which can lead to messages having the same timestamp ending up in the wrong order. It would be better to preserve the order messages are sent in, which is the order they were stored in.
| * | | | | mod_admin_shell: Remove obsolete module:load() argument from 0.8 timeKim Alvefur2022-08-051-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | This 'config' argument was removed without explanation in d8dbf569766c
| * | | | | mod_tls: Record STARTTLS state so it can be shown in ShellKim Alvefur2022-08-022-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This field can be viewed using s2s:show(nil, "... starttls") even without any special support in mod_admin_shell, which can be added later to make it nicer. One can then assume that a TLS connection with an empty / nil starttls field means Direct TLS.
| * | | | | Merge 0.12->trunkKim Alvefur2022-07-292-6/+3
| |\ \ \ \ \
| * \ \ \ \ \ Merge 0.12->trunkKim Alvefur2022-07-272-2/+6
| |\ \ \ \ \ \
| * | | | | | | mod_saslauth: Implement RFC 9266 'tls-exporter' channel binding (#1760)Kim Alvefur2022-06-011-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Brings back SCRAM-SHA-*-PLUS from its hiatus brought on by the earlier channel binding method being undefined for TLS 1.3, and the increasing deployment of TLS 1.3. See 1bfd238e05ad and #1542 Requires future version of LuaSec, once support for this key material export method is merged. See https://github.com/brunoos/luasec/pull/187
| * | | | | | | compat: Remove handling of Lua 5.1 location of 'unpack' functionKim Alvefur2022-07-115-5/+5
| | | | | | | |
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-03 20:56:40 +0000