Ar 11/06/2007 am 14:48, ysgrifennodd Mikael Hallendal:
> 29 maj 2007 kl. 15.46 skrev Dafydd Harries:
>
> Hi,
>
> I've added this to the issue tracker as LM-106 [1].
>
> Thanks,
> Mikael Hallendal
>
> [1] htt
p://developer.imendio.com/issues/browse/LM-106
>
> >
> >Currently, when Loudmouth receives a message that
has an ID, it
> >looks up the
> >ID in LmConnection->id_handlers. It does this
regardless of the
> >message type:
> >the handler will get called even if the message is
an e.g. <iq
> >type="get">.
> >
> >Patch attached; also available from git here:
> >
> >h
ttp://projects.collabora.co.uk/~daf/loudmouth.git/
Thinking about it, this patch is inadequate.
If you only check the ID, then you are susceptible to
spoofing attacks. The
code should also check that the result/error message was
sent by the JID that
the get/set was sent to.
My understanding is that messages with no to address should
receive replies
with no from address, or perhaps with a from address that's
the server we're
connected to.
--
Dafydd
_______________________________________________
Loudmouth mailing list
Loudmouth lists.imendio.com
h
ttp://lists.imendio.com/mailman/listinfo/loudmouth
|