From a5afd011a1c4fafaa226932e717f146f7ee905b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sa=C3=BAl=20Ibarra=20Corretg=C3=A9?= <saghul@jitsi.org>
Date: Tue, 4 Mar 2025 19:27:12 +0100
Subject: [PATCH] fix(breakout-rooms) fix processing commands (#15695)

* fix(breakout-rooms) fix processing commands

* squash: fix wrong var name.

* squash: fix move to breakout room.

It can be from breakout to main or from main to breakout.

---------

Co-authored-by: damencho <damencho@jitsi.org>
---
 .../mod_muc_breakout_rooms.lua                | 40 +++++++++++++++----
 1 file changed, 32 insertions(+), 8 deletions(-)

diff --git a/resources/prosody-plugins/mod_muc_breakout_rooms.lua b/resources/prosody-plugins/mod_muc_breakout_rooms.lua
index d7783b427a..537f2cb9cd 100644
--- a/resources/prosody-plugins/mod_muc_breakout_rooms.lua
+++ b/resources/prosody-plugins/mod_muc_breakout_rooms.lua
@@ -200,8 +200,14 @@ end
 
 -- Managing breakout rooms
 
-function create_breakout_room(room_jid, subject)
-    local main_room, main_room_jid = get_main_room(room_jid);
+function create_breakout_room(orig_room, subject)
+    local main_room, main_room_jid = get_main_room(orig_room.jid);
+
+    if orig_room ~= main_room then
+        module:log('warn', 'Invalid create breakout room request for %s', orig_room.jid);
+        return;
+    end
+
     local breakout_room_jid = uuid_gen() .. '@' .. breakout_rooms_muc_component_config;
 
     if not main_room._data.breakout_rooms then
@@ -219,13 +225,18 @@ function create_breakout_room(room_jid, subject)
     broadcast_breakout_rooms(main_room_jid);
 end
 
-function destroy_breakout_room(room_jid, message)
+function destroy_breakout_room(orig_room, room_jid, message)
     local main_room, main_room_jid = get_main_room(room_jid);
 
     if room_jid == main_room_jid then
         return;
     end
 
+    if orig_room ~= main_room then
+        module:log('warn', 'Invalid destroy breakout room request for %s', orig_room.jid);
+        return;
+    end
+
     local breakout_room = breakout_rooms_muc_service.get_room_from_jid(room_jid);
 
     if breakout_room then
@@ -244,13 +255,18 @@ function destroy_breakout_room(room_jid, message)
 end
 
 
-function rename_breakout_room(room_jid, name)
+function rename_breakout_room(orig_room, room_jid, name)
     local main_room, main_room_jid = get_main_room(room_jid);
 
     if room_jid == main_room_jid then
         return;
     end
 
+    if orig_room ~= main_room then
+        module:log('warn', 'Invalid rename breakout room request for %s', orig_room.jid);
+        return;
+    end
+
     if main_room then
         if main_room._data.breakout_rooms then
             main_room._data.breakout_rooms[room_jid] = name;
@@ -322,18 +338,25 @@ function on_message(event)
     end
 
     if message.attr.type == JSON_TYPE_ADD_BREAKOUT_ROOM then
-        create_breakout_room(room.jid, message.attr.subject);
+        create_breakout_room(room, message.attr.subject);
         return true;
     elseif message.attr.type == JSON_TYPE_REMOVE_BREAKOUT_ROOM then
-        destroy_breakout_room(message.attr.breakoutRoomJid);
+        destroy_breakout_room(room, message.attr.breakoutRoomJid);
         return true;
     elseif message.attr.type == JSON_TYPE_RENAME_BREAKOUT_ROOM then
-        rename_breakout_room(message.attr.breakoutRoomJid, message.attr.subject);
+        rename_breakout_room(room, message.attr.breakoutRoomJid, message.attr.subject);
         return true;
     elseif message.attr.type == JSON_TYPE_MOVE_TO_ROOM_REQUEST then
         local participant_jid = message.attr.participantJid;
         local target_room_jid = message.attr.roomJid;
 
+        if not room._data.breakout_rooms or not (
+            room._data.breakout_rooms[target_room_jid] or target_room_jid == internal_room_jid_match_rewrite(room.jid))
+        then
+            module:log('warn', 'Invalid breakout room %s for %s', target_room_jid, room.jid);
+            return false
+        end
+
         local json_msg, error = json.encode({
             type = BREAKOUT_ROOMS_IDENTITY_TYPE,
             event = JSON_TYPE_MOVE_TO_ROOM_REQUEST,
@@ -342,6 +365,7 @@ function on_message(event)
 
         if not json_msg then
             module:log('error', 'skip sending request room:%s error:%s', room.jid, error);
+            return false
         end
 
         send_json_msg(participant_jid, json_msg)
@@ -491,7 +515,7 @@ function on_main_room_destroyed(event)
     end
 
     for breakout_room_jid in pairs(main_room._data.breakout_rooms or {}) do
-        destroy_breakout_room(breakout_room_jid, event.reason)
+        destroy_breakout_room(main_room, breakout_room_jid, event.reason)
     end
 end