erebion/libervia-backend
Watch
1
0
Fork
You've already forked libervia-backend
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

plugin invitations: fixed leak of uuid in jid

Browse source
This commit is contained in:
Goffi 2017-03-26 21:23:03 +02:00
commit d067b1b8be
1 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/plugins/plugin_misc_invitations.py
View file

@ -95,7 +95,8 @@ class InvitationsPlugin(object):
**kwargs: keywords arguments which can have the following keys, unset values are equivalent to None:
jid_(jid.JID, None): jid to use for invitation, the jid will be created using XEP-0077
if the jid has no user part, an anonymous account will be used (no XMPP account created in this case)
if None, automatically generate an account name (in the form "invitation-[UUID]@domain.tld")
if None, automatically generate an account name (in the form "invitation-[random UUID]@domain.tld") (note that this UUID is not the
same as the invitation one, as jid can be used publicly (leaking the UUID), and invitation UUID give access to account.
in case of conflict, a suffix number is added to the account until a free one if found (with a failure if SUFFIX_MAX is reached)
password(unicode, None): password to use (will be used for XMPP account and profile)
None to automatically generate one
@ -165,7 +166,7 @@ class InvitationsPlugin(object):
if not domain:
# TODO: fallback to profile's domain
raise ValueError(_(u"You need to specify xmpp_domain in sat.conf"))
jid_ = u"invitation-{uuid}@{domain}".format(uuid=id_, domain=domain)
jid_ = u"invitation-{uuid}@{domain}".format(uuid=shortuuid.uuid(), domain=domain)
jid_ = jid.JID(jid_)
if jid_.user:
# we don't register account if there is no user as anonymous login is then used