Mercurial > prosody-modules
view mod_invites_groups/mod_invites_groups.lua @ 5404:1087f697c3f3
mod_http_oauth2: Strip unknown extra fields from client registration
We shouldn't sign things we don't understand!
RFC 7591 section-2 states:
> The authorization server MUST ignore any client metadata sent by the
> client that it does not understand (for instance, by silently removing
> unknown metadata from the client's registration record during
> processing).
Prevents grandfathering in of unvalidated data that might become used
later, especially since the 'additionalProperties' schema keyword was
removed in 698fef74ce53
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Tue, 02 May 2023 16:23:40 +0200 |
parents | 869df5a6b0c5 |
children |
line wrap: on
line source
local mod_groups = module:depends("groups_internal"); module:hook("user-registered", function(event) local validated_invite = event.validated_invite or (event.session and event.session.validated_invite); if not validated_invite then -- not registered via invite, nothing to do return end local groups = validated_invite and validated_invite.additional_data and validated_invite.additional_data.groups; if not groups then -- invite has no groups, nothing to do return end local new_username = event.username; module:log("debug", "adding %s to groups from invite", new_username); for _, group in ipairs(groups) do mod_groups.add_member(group, new_username); end end);