From 76392e937727251e7a2fc59abc22320e2e832980 Mon Sep 17 00:00:00 2001
From: Goffi <goffi@goffi.org>
Date: Wed, 5 May 2021 15:41:19 +0200
Subject: [PATCH] component file sharing: forbid jingle upload by entities
 which are not in allowed hosts

---
 sat/plugins/plugin_comp_file_sharing.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sat/plugins/plugin_comp_file_sharing.py b/sat/plugins/plugin_comp_file_sharing.py
index b2cdbb3c..2309fef1 100644
--- a/sat/plugins/plugin_comp_file_sharing.py
+++ b/sat/plugins/plugin_comp_file_sharing.py
@@ -508,6 +508,9 @@ class FileSharing:
         """This trigger accept file sending request, and store file locally"""
         if not client.is_component:
             return True, None
+        # client._file_sharing_allowed_hosts is set in plugin XEP-0329
+        if peer_jid.host not in client._file_sharing_allowed_hosts:
+            raise error.StanzaError("forbidden")
         assert stream_object
         assert "stream_object" not in transfer_data
         assert C.KEY_PROGRESS_ID in file_data