plugin group blog: security check + fixed publisher in personalEvent signal

src/plugins/plugin_misc_groupblog.py

@@ -19,7 +19,7 @@ You should have received a copy of the GNU Affero General Public License
 along with this program.  If not, see <http://www.gnu.org/licenses/>.
 """
 
-from logging import debug, info, error
+from logging import debug, info, warning, error
 from twisted.internet import defer
 from twisted.words.protocols.jabber import jid
 
@@ -151,9 +151,19 @@ class GroupBlog():
     def pubSubItemsReceivedTrigger(self, event, profile):
         """"Trigger which catch groupblogs events"""
         if event.nodeIdentifier.startswith(NS_NODE_PREFIX):
+            publisher = jid.JID(event.nodeIdentifier[len(NS_NODE_PREFIX):])
+            origin_host = publisher.host.split('.')
+            event_host = event.sender.host.split('.')
+            #FIXME: basic origin check, must be improved
+            if (not (origin_host)
+                or len(event_host) < len(origin_host)
+                or event_host[-len(origin_host):] != origin_host):
+                warning("Host incoherence between %s and %s (hack attempt ?)" % (unicode(event.sender),
+                                                                                 unicode(publisher)))
+                return
             for item in event.items:
                 microblog_data = self.host.plugins["XEP-0277"].item2mbdata(item)
-                self.host.bridge.personalEvent(event.sender.full(), "MICROBLOG", microblog_data, profile)
+                self.host.bridge.personalEvent(publisher.full(), "MICROBLOG", microblog_data, profile)
             return False
         return True