# HG changeset patch
# User Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
# Date 1629879757 -7200
# Node ID 2b6e8ce5fb301f3949c0fce54541a8cbdc91318c
# Parent  e524a97730ebd950b10b0ed37e0563d3170bc7bd
mod_http_upload: Don’t send http: URIs to clients, this is forbidden by the XEP

diff -r e524a97730eb -r 2b6e8ce5fb30 mod_http_upload/mod_http_upload.lua
--- a/mod_http_upload/mod_http_upload.lua	Mon Aug 23 14:28:40 2021 +0200
+++ b/mod_http_upload/mod_http_upload.lua	Wed Aug 25 10:22:37 2021 +0200
@@ -198,6 +198,11 @@
 		module:log("debug", "Upload of %dB by %s would exceed quota", filesize, user_bare);
 		return nil, st.error_reply(stanza, "wait", "resource-constraint", "Quota reached");
 	end
+	local base_url = module:http_url();
+	if base_url:match("^http://") then
+		module:log("error", "File upload MUST happen with TLS but it isn’t enabled, see https://prosody.im/doc/http for how to fix this issue");
+		return nil, st.error_reply(stanza, "wait", "internal-server-error", "HTTPS is not configured properly on the server");
+	end
 
 	local random_dir = uuid();
 	local created, err = lfs.mkdir(join_path(storage_path, random_dir));
@@ -225,7 +230,6 @@
 
 	origin.log("debug", "Given upload slot %q", slot);
 
-	local base_url = module:http_url();
 	local slot_url = url.parse(base_url);
 	slot_url.path = url.parse_path(slot_url.path or "/");
 	t_insert(slot_url.path, random_dir);