Mercurial > prosody-modules
view mod_admin_notify/mod_admin_notify.lua @ 5404:1087f697c3f3
mod_http_oauth2: Strip unknown extra fields from client registration
We shouldn't sign things we don't understand!
RFC 7591 section-2 states:
> The authorization server MUST ignore any client metadata sent by the
> client that it does not understand (for instance, by silently removing
> unknown metadata from the client's registration record during
> processing).
Prevents grandfathering in of unvalidated data that might become used
later, especially since the 'additionalProperties' schema keyword was
removed in 698fef74ce53
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Tue, 02 May 2023 16:23:40 +0200 |
parents | 44e18454e1e0 |
children |
line wrap: on
line source
local it = require "util.iterators"; local jid = require "util.jid"; local set = require "util.set"; local st = require "util.stanza"; local roles_store = module:open_store("roles", "map"); local config_admins = module:get_option_inherited_set("admins", {}) / jid.prep; local function append_host(username) return username.."@"..module.host; end local function get_admins() local role_admins = roles_store:get_all("prosody:admin") or {}; local admins = config_admins + (set.new(it.to_array(it.keys(role_admins))) / append_host); return admins; end function notify(text) --luacheck: ignore 131/notify local base_msg = st.message({ from = module.host }) :text_tag("body", text); for admin_jid in get_admins() do local msg = st.clone(base_msg); msg.attr.to = admin_jid; module:send(msg); end end