prevent affiliatio spoofing by checking namespace. Fixes #4323
This commit is contained in:
parent
330dd0e7a1
commit
3e2f9fcbec
|
@ -502,10 +502,14 @@ class Presence(Protocol):
|
||||||
|
|
||||||
def _muc_getItemAttr(self,tag,attr):
|
def _muc_getItemAttr(self,tag,attr):
|
||||||
for xtag in self.getTags('x'):
|
for xtag in self.getTags('x'):
|
||||||
|
if xtag.getNamespace() not in (NS_MUC_USER, NS_MUC_ADMIN):
|
||||||
|
continue
|
||||||
for child in xtag.getTags(tag):
|
for child in xtag.getTags(tag):
|
||||||
return child.getAttr(attr)
|
return child.getAttr(attr)
|
||||||
def _muc_getSubTagDataAttr(self,tag,attr):
|
def _muc_getSubTagDataAttr(self,tag,attr):
|
||||||
for xtag in self.getTags('x'):
|
for xtag in self.getTags('x'):
|
||||||
|
if xtag.getNamespace() not in (NS_MUC_USER, NS_MUC_ADMIN):
|
||||||
|
continue
|
||||||
for child in xtag.getTags('item'):
|
for child in xtag.getTags('item'):
|
||||||
for cchild in child.getTags(tag):
|
for cchild in child.getTags(tag):
|
||||||
return cchild.getData(),cchild.getAttr(attr)
|
return cchild.getData(),cchild.getAttr(attr)
|
||||||
|
@ -777,4 +781,4 @@ class DataForm(Node):
|
||||||
""" Simple dictionary interface for setting datafields values by their names."""
|
""" Simple dictionary interface for setting datafields values by their names."""
|
||||||
return self.setField(name).setValue(val)
|
return self.setField(name).setValue(val)
|
||||||
|
|
||||||
# vim: se ts=3:
|
# vim: se ts=3:
|
||||||
|
|
Loading…
Reference in New Issue