# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1355658694 -3600
# Node ID 4939788a47ead264867c468b33c94457cfc6a06c
# Parent  4b06d6c79b157d27545cfb45516c7122f1fa0f17
mod_vjud: Disallow searching from remote hosts by default in search-all-users mode

diff -r 4b06d6c79b15 -r 4939788a47ea mod_vjud/mod_vjud.lua
--- a/mod_vjud/mod_vjud.lua	Sun Dec 16 12:47:26 2012 +0100
+++ b/mod_vjud/mod_vjud.lua	Sun Dec 16 12:51:34 2012 +0100
@@ -31,6 +31,7 @@
 ]];
 
 local search_mode = module:get_option_string("vjud_mode", "opt-in");
+local allow_remote = module:get_option_boolean("allow_remote_searches", search_mode ~= "all");
 local base_host = module:get_option_string("vjud_search_domain",
 	module:get_host_type() == "component"
 		and module.host:gsub("^[^.]+%.","")
@@ -68,6 +69,11 @@
 module:hook("iq/host/jabber:iq:search:query", function(event)
 	local origin, stanza = event.origin, event.stanza;
 
+	if not (allow_remote or origin.type == "c2s") then
+		origin.send(st.error_reply(stanza, "cancel", "not-allowed"))
+		return true;
+	end
+
 	if stanza.attr.type == "get" then
 		origin.send(st.reply(stanza):add_child(get_reply));
 	else -- type == "set"