From ba9418cd026869de7a067bac32b9b77172ec78b2 Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Tue, 7 Aug 2012 17:00:12 +0200 Subject: mod_legacyauth: Return an error if username or resource fails stringprep (thanks iron) --- plugins/mod_legacyauth.lua | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'plugins') diff --git a/plugins/mod_legacyauth.lua b/plugins/mod_legacyauth.lua index a47f0223..7a3038bc 100644 --- a/plugins/mod_legacyauth.lua +++ b/plugins/mod_legacyauth.lua @@ -58,6 +58,10 @@ module:hook("stanza/iq/jabber:iq:auth:query", function(event) username = nodeprep(username); resource = resourceprep(resource) local reply = st.reply(stanza); + if not (username and resource) then + session.send(st.error_reply(stanza, "modify", "bad-request")); + return true; + end if usermanager.test_password(username, session.host, password) then -- Authentication successful! local success, err = sessionmanager.make_authenticated(session, username); -- cgit v1.2.3