Mercurial > prosody-modules
changeset 4653:2b6e8ce5fb30
mod_http_upload: Don’t send http: URIs to clients, this is forbidden by the XEP
| author | Emmanuel Gil Peyrot <linkmauve@linkmauve.fr> |
|---|---|
| date | Wed, 25 Aug 2021 10:22:37 +0200 |
| parents | e524a97730eb |
| children | ea17cfcbffab |
| files | mod_http_upload/mod_http_upload.lua |
| diffstat | 1 files changed, 5 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/mod_http_upload/mod_http_upload.lua Mon Aug 23 14:28:40 2021 +0200 +++ b/mod_http_upload/mod_http_upload.lua Wed Aug 25 10:22:37 2021 +0200 @@ -198,6 +198,11 @@ module:log("debug", "Upload of %dB by %s would exceed quota", filesize, user_bare); return nil, st.error_reply(stanza, "wait", "resource-constraint", "Quota reached"); end + local base_url = module:http_url(); + if base_url:match("^http://") then + module:log("error", "File upload MUST happen with TLS but it isn’t enabled, see https://prosody.im/doc/http for how to fix this issue"); + return nil, st.error_reply(stanza, "wait", "internal-server-error", "HTTPS is not configured properly on the server"); + end local random_dir = uuid(); local created, err = lfs.mkdir(join_path(storage_path, random_dir)); @@ -225,7 +230,6 @@ origin.log("debug", "Given upload slot %q", slot); - local base_url = module:http_url(); local slot_url = url.parse(base_url); slot_url.path = url.parse_path(slot_url.path or "/"); t_insert(slot_url.path, random_dir);