aboutsummaryrefslogtreecommitdiffstats
path: root/plugins
Commit message (Collapse)AuthorAgeFilesLines
...
* | mod_tokenauth: Switch to new token format (invalidates existing tokens!)Matthew Wild2023-03-211-14/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The new format has the following properties: - 5 bytes longer than the previous format - The token now has separate 'id' and 'secret' parts - the token itself is no longer stored in the DB, and the secret part is hashed - The only variable length field (JID) has been moved to the end - The 'secret-token:' prefix (RFC 8959) is now included Compatibility with the old token format was not maintained, and all previously issued tokens are invalid after this commit (they will be removed from the DB if used).
* | mod_tokenauth: Log error when token validation failsMatthew Wild2023-03-211-0/+3
| |
* | mod_auth_internal_plain: Fix user creation done via mod_admin_shellVitaly Orekhov2023-03-211-1/+4
| | | | | | | | | | | | | | | | | | Following the new behavior in auth_internal_hashed (c8f59ce7d3cf), the account will be created and disabled, instead of returning an error telling password being nil when calling saslprep(). Note that mod_auth_internal_plain does not have full support for enabled/disabled accounts, but that may be fixed in subsequent commits.
* | mod_auth_internal_hashed: Shorten call pathKim Alvefur2023-03-181-3/+2
| | | | | | | | | | Why did it call a function defined in the same module through usermanager?
* | util.sasl.oauthbearer: Return username from callback instead using authzid (BC)Kim Alvefur2023-03-161-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | RFC 6120 states that > If the initiating entity does not wish to act on behalf of another > entity, it MUST NOT provide an authorization identity. Thus it seems weird to require it here. We can instead expect an username from the token data passed back from the profile. This follows the practice of util.sasl.external where the profile callback returns the selected username, making the authentication module responsible for extracting the username from the token.
* | mod_auth_internal_hashed: Record time of account disable / re-enableKim Alvefur2023-03-121-0/+2
| | | | | | | | Could be useful for e.g. #1772
* | mod_admin_shell: Limit module dependency listings to loaded on current hostKim Alvefur2023-03-101-2/+9
| | | | | | | | | | | | E.g. module:info("http") with many http modules loaded would show a lot of duplication, as each module would be listed for each host, even if not actually enabled on that host.
* | mod_authz_internal: Fix wrong role name field in user_can_assume_role()Kim Alvefur2023-03-091-1/+1
| | | | | | | | | | Made it reject the primary role since it compares against a non-existent field, i.e. nil.
* | Merge 0.12->trunkKim Alvefur2023-03-051-3/+7
|\|
| * mod_http: Unhook CORS handlers only if active (fixes #1801)Kim Alvefur2023-03-051-3/+7
| |
* | mod_admin_shell: Show reverse dependencies in module:info()Kim Alvefur2023-03-051-0/+6
| | | | | | | | Why was this module loaded? Now you can find out!
* | authz: Add method for retrieving all rolesKim Alvefur2023-03-041-0/+4
| | | | | | | | | | | | | | | | Some of the OAuth stuff highlights a small need to retrieve a list of roles somehow. Handy if you ever need a role selector in adhoc or something. Unless there's some O(n) thing we were avoiding?
* | mod_tokenauth: Fix misplaced closing parenthesisKim Alvefur2023-03-021-1/+1
| | | | | | | | `type(x ~= y)` is always a string, thus truthy
* | mod_tokenauth: Gracefully handle missing tokensMatthew Wild2023-03-011-0/+1
| |
* | mod_auth_internal_hashed: Add oauthbearer handler to our SASL profileMatthew Wild2023-03-011-1/+4
| |
* | mod_tokenauth: Add SASL handler backend that can accept and verify tokensMatthew Wild2023-03-011-0/+18
| | | | | | | | | | This is designed for use by other modules that want to accept tokens issued by mod_tokenauth, without duplicating all the necessary logic.
* | mod_tokenauth: Add some sanity checking of the new optional parametersMatthew Wild2023-03-011-0/+4
| |
* | mod_tokenauth: Add 'purpose' constraintMatthew Wild2023-03-011-1/+2
| | | | | | | | | | | | | | | | | | | | This allows tokens to be tied to specific purposes/protocols. For example, we shouldn't (without specific consideration) allow an OAuth token to be dropped into a slot expecting a FAST token. While FAST doesn't currently use mod_tokenauth, it and others may do in the future. It's better to be explicit about what kind of token code is issuing or expecting.
* | mod_saslauth: Support for SASL handlers forcing a specific resourceMatthew Wild2023-03-011-2/+4
| | | | | | | | The token layer supports tokens that are tied to a given resource.
* | mod_admin_adhoc: Add XEP-0133 commands to Disable and Re-Enable usersKim Alvefur2023-02-231-0/+66
| | | | | | | | Enables UI in clients supporting XEP-0050
* | mod_admin_shell: Add commands to disable and enable accountsKim Alvefur2023-02-231-0/+32
| | | | | | | | First proper UI to enable/disable, allowing it to be tested.
* | mod_c2s: Disconnect accounts when they are disabledKim Alvefur2023-02-231-0/+1
| | | | | | | | | | | | | | | | We decided that at the first stage, accounts that are disabled should simply be prevented from authenticating, thus they should also be prevented from having connected sessions. Since this is aimed to be a moderation action for cases of abuse, they shouldn't be allowed to continue being connected.
* | mod_auth_internal_hashed: Implement methods to enable and disable usersKim Alvefur2023-02-231-4/+9
| |
* | mod_auth_internal_hashed: Implement is_enabled() methodKim Alvefur2023-02-231-3/+5
| | | | | | | | Uses 'disabled' property already introduced in aed38948791f
* | mod_auth_internal_hashed: Add stub methods for enabling and disabling usersKim Alvefur2023-02-221-0/+8
| | | | | | | | But how and where?
* | mod_auth_internal_hashed: Refactor to prepare for disabling usersKim Alvefur2023-02-221-2/+7
| | | | | | | | | | | | Moving this out will make space for a dynamic check whether a particular user is disabled or not, which is one possible response to abuse of account privileges.
* | Merge 0.12->trunkMatthew Wild2023-02-201-0/+3
|\|
| * mod_websocket: Fire pre-session-close event (fixes #1800)0.12.3Matthew Wild2023-02-201-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This event was added in a7c183bb4e64 and is required to make mod_smacks know that a session was intentionally closed and shouldn't be hibernated (see fcea4d9e7502). Because this was missing from mod_websocket's session.close(), mod_smacks would always attempt to hibernate websocket sessions even if they closed cleanly. That mod_websocket has its own copy of session.close() is something to fix another day (probably not in the stable branch). So for now this commit makes the minimal change to get things working again. Thanks to Damian and the Jitsi team for reporting.
* | Merge 0.12->trunkKim Alvefur2023-02-162-1/+7
|\|
| * mod_admin_socket: Return error on unhandled input to prevent apparent freezeKim Alvefur2023-02-162-1/+7
| | | | | | | | | | | | When mod_admin_socket is loaded without mod_admin_shell, attempt to use `prosodyctl shell` will appear to freeze after any input, since no response is returned.
* | mod_storage_sql: Remove module status on unknown 'debug' levelKim Alvefur2023-01-311-1/+0
| | | | | | | | | | Expected this to be translated to 'core', but it logs an error instead. See previous commit.
* | mod_storage_sql: Silence luacheck warningKim Alvefur2023-01-301-1/+1
| |
* | mod_storage_sql: Record connection to database as module statusKim Alvefur2023-01-301-0/+6
| | | | | | | | | | | | Allows retrieving this in e.g. a health reporting module Thanks pfak
* | mod_admin_shell: Match substring in muc:affiliations() like muc:occupants()Kim Alvefur2023-01-301-1/+1
| | | | | | | | Maybe one day we'll get consistent filtering semantics everywhere.
* | mod_admin_shell: Sort MUC users by relation and JIDKim Alvefur2023-01-291-18/+51
| | | | | | | | Suggested by MattJ, our resident UI expert :)
* | mod_admin_shell: Make Role and Affiliation columns the same width for aestheticsKim Alvefur2023-01-291-2/+2
| | | | | | | | | | The length of the title "Affiliation" made them both close enough that it looked off.
* | mod_admin_shell: Use tables to present MUC usersKim Alvefur2023-01-291-2/+18
| | | | | | | | Tables are awesome!
* | mod_admin_shell: Factor out room retrieval into common functionKim Alvefur2023-01-291-18/+18
| | | | | | | | Justification: See diffstat
* | mod_admin_shell: Add muc:affiliations(room) command to list membershipsKim Alvefur2023-01-291-0/+28
| | | | | | | | | | Easier than going trough muc:room():each_affiliation() since you have to do fiddly things to reach the print() function.
* | mod_admin_shell: Add muc:occupants(room) command to list occupantsKim Alvefur2023-01-291-1/+30
| | | | | | | | | | Easier than going trough muc:room():each_occupant() since you have to do fiddly things to reach the print() function.
* | mod_muc_mam: Use higher precision timestampsKim Alvefur2023-01-211-1/+1
| | | | | | | | See also 781772c8b6d9
* | Merge 0.12->trunkKim Alvefur2023-01-212-8/+25
|\|
| * mod_muc_mam: Copy "include total" behavior from mod_mamKim Alvefur2023-01-211-1/+5
| | | | | | | | | | Not sure why this was missing from MUC MAM, it already had some of the code for dealing with it.
| * mod_muc_mam: Add mam#extended form fields #1796 (Thanks Rain)Kim Alvefur2023-01-211-0/+10
| | | | | | | | Oversight in cabb022f31c0
| * mod_mam,mod_muc_mam: Minimize differences (reorder, copy some comments)Kim Alvefur2023-01-212-8/+11
| | | | | | | | | | Should have no functional difference, but makes it easier keeping mod_mam and mod_muc_mam in sync.
* | MUC: Add note about non-existant room methodKim Alvefur2023-01-201-1/+1
| |
* | mod_admin_socket: Fix typo in commentsKim Alvefur2023-01-201-1/+1
| | | | | | | | Introduced in 6966026262f4
* | Merge 0.12->trunkKim Alvefur2023-01-191-0/+1
|\|
| * mod_smacks: Log something when hibernation startsKim Alvefur2023-01-191-0/+1
| | | | | | | | | | Will hopefully save future confusion about sessions being destroyed when they are in fact not.
* | mod_storage_sql: Support SQLite3 without LuaDBIKim Alvefur2023-01-191-1/+8
| |
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-02 19:26:32 +0000