# HG changeset patch
# User Goffi <goffi@goffi.org>
# Date 1732183329 -3600
# Node ID cab491b1b563b00417da7458825857c340d55c34
# Parent  fa0d2a4783fa441ba25ba80e4089962d45ee71ad
backend: check items elements on publish.

diff -r fa0d2a4783fa -r cab491b1b563 sat_pubsub/backend.py
--- a/sat_pubsub/backend.py	Fri Jan 12 23:46:24 2024 +0100
+++ b/sat_pubsub/backend.py	Thu Nov 21 11:02:09 2024 +0100
@@ -467,6 +467,8 @@
         check_overwrite = False
         ret_payload = None  # payload returned, None or domish.Element
         for item in items:
+            if item.name != "item" or item.uri != pubsub.NS_PUBSUB:
+                raise error.NotAllowedError(f"Invalid item: {item.toXml()}")
             # we enforce publisher (cf XEP-0060 §7.1.2.3)
             item['publisher'] = requestor.full()
             if persistItems or deliverPayloads: