mirror of
https://gitcode.com/GitHub_Trending/ji/jitsi-meet.git
synced 2026-05-09 07:22:32 +00:00
0354dbe889
When returning the error and showing to user not allowed screen we were not completely halting the prejoin operation when token verification fails on room join and the token is valid in general.
114 lines
3.9 KiB
Lua
114 lines
3.9 KiB
Lua
-- Token authentication
|
|
-- Copyright (C) 2015 Atlassian
|
|
|
|
local log = module._log;
|
|
local host = module.host;
|
|
local st = require "util.stanza";
|
|
local is_admin = require "core.usermanager".is_admin;
|
|
|
|
|
|
local parentHostName = string.gmatch(tostring(host), "%w+.(%w.+)")();
|
|
if parentHostName == nil then
|
|
log("error", "Failed to start - unable to get parent hostname");
|
|
return;
|
|
end
|
|
|
|
local parentCtx = module:context(parentHostName);
|
|
if parentCtx == nil then
|
|
log("error",
|
|
"Failed to start - unable to get parent context for host: %s",
|
|
tostring(parentHostName));
|
|
return;
|
|
end
|
|
|
|
local token_util = module:require "token/util".new(parentCtx);
|
|
|
|
-- no token configuration
|
|
if token_util == nil then
|
|
return;
|
|
end
|
|
|
|
log("debug",
|
|
"%s - starting MUC token verifier app_id: %s app_secret: %s allow empty: %s",
|
|
tostring(host), tostring(token_util.appId), tostring(token_util.appSecret),
|
|
tostring(token_util.allowEmptyToken));
|
|
|
|
-- option to disable room modification (sending muc config form) for guest that do not provide token
|
|
local require_token_for_moderation;
|
|
local function load_config()
|
|
require_token_for_moderation = module:get_option_boolean("token_verification_require_token_for_moderation");
|
|
end
|
|
load_config();
|
|
|
|
-- verify user and whether he is allowed to join a room based on the token information
|
|
local function verify_user(session, stanza)
|
|
log("debug", "Session token: %s, session room: %s",
|
|
tostring(session.auth_token),
|
|
tostring(session.jitsi_meet_room));
|
|
|
|
-- token not required for admin users
|
|
local user_jid = stanza.attr.from;
|
|
if is_admin(user_jid) then
|
|
log("debug", "Token not required from admin user: %s", user_jid);
|
|
return true;
|
|
end
|
|
|
|
log("debug",
|
|
"Will verify token for user: %s, room: %s ", user_jid, stanza.attr.to);
|
|
if not token_util:verify_room(session, stanza.attr.to) then
|
|
log("error", "Token %s not allowed to join: %s",
|
|
tostring(session.auth_token), tostring(stanza.attr.to));
|
|
session.send(
|
|
st.error_reply(
|
|
stanza, "cancel", "not-allowed", "Room and token mismatched"));
|
|
return false; -- we need to just return non nil
|
|
end
|
|
log("debug",
|
|
"allowed: %s to enter/create room: %s", user_jid, stanza.attr.to);
|
|
return true;
|
|
end
|
|
|
|
module:hook("muc-room-pre-create", function(event)
|
|
local origin, stanza = event.origin, event.stanza;
|
|
log("debug", "pre create: %s %s", tostring(origin), tostring(stanza));
|
|
if not verify_user(origin, stanza) then
|
|
return true; -- Returning any value other than nil will halt processing of the event
|
|
end
|
|
end);
|
|
|
|
module:hook("muc-occupant-pre-join", function(event)
|
|
local origin, room, stanza = event.origin, event.room, event.stanza;
|
|
log("debug", "pre join: %s %s", tostring(room), tostring(stanza));
|
|
if not verify_user(origin, stanza) then
|
|
return true; -- Returning any value other than nil will halt processing of the event
|
|
end
|
|
end);
|
|
|
|
for event_name, method in pairs {
|
|
-- Normal room interactions
|
|
["iq-set/bare/http://jabber.org/protocol/muc#owner:query"] = "handle_owner_query_set_to_room" ;
|
|
-- Host room
|
|
["iq-set/host/http://jabber.org/protocol/muc#owner:query"] = "handle_owner_query_set_to_room" ;
|
|
} do
|
|
module:hook(event_name, function (event)
|
|
local session, stanza = event.origin, event.stanza;
|
|
|
|
-- if we do not require token we pass it through(default behaviour)
|
|
-- or the request is coming from admin (focus)
|
|
if not require_token_for_moderation or is_admin(stanza.attr.from) then
|
|
return;
|
|
end
|
|
|
|
-- jitsi_meet_room is set after the token had been verified
|
|
if not session.auth_token or not session.jitsi_meet_room then
|
|
session.send(
|
|
st.error_reply(
|
|
stanza, "cancel", "not-allowed", "Room modification disabled for guests"));
|
|
return true;
|
|
end
|
|
|
|
end, -1); -- the default prosody hook is on -2
|
|
end
|
|
|
|
module:hook_global('config-reloaded', load_config);
|