Mercurial > pidgin.yaz
changeset 17611:feac55968392
Now all ad-hoc commands have to be sent through jabber_adhoc_execute to be properly executed (including the form steps). This cleans up the code a bit, and avoids DOS attacks by flooding the client with malicious ad-hoc command forms that were not requested.
| author | Andreas Monitzer <pidgin@monitzer.com> |
|---|---|
| date | Mon, 25 Jun 2007 20:07:31 +0000 |
| parents | 9a19c46adf66 |
| children | b8de63d3bf89 |
| files | libpurple/protocols/jabber/adhoccommands.c libpurple/protocols/jabber/adhoccommands.h libpurple/protocols/jabber/buddy.c libpurple/protocols/jabber/iq.c |
| diffstat | 4 files changed, 21 insertions(+), 30 deletions(-) [+] |
line wrap: on
line diff
--- a/libpurple/protocols/jabber/adhoccommands.c Mon Jun 25 19:08:16 2007 +0000 +++ b/libpurple/protocols/jabber/adhoccommands.c Mon Jun 25 20:07:31 2007 +0000 @@ -122,7 +122,7 @@ jabber_iq_send(iq); } -void jabber_adhoc_parse(JabberStream *js, xmlnode *packet) { +static void jabber_adhoc_parse(JabberStream *js, xmlnode *packet, gpointer data) { xmlnode *command = xmlnode_get_child_with_namespace(packet, "command", "http://jabber.org/protocol/commands"); const char *status = xmlnode_get_attrib(command,"status"); xmlnode *xdata = xmlnode_get_child_with_namespace(command,"x","jabber:x:data"); @@ -181,21 +181,13 @@ } } -void jabber_adhoc_execute(PurpleBlistNode *node, gpointer data) { +void jabber_adhoc_execute_action(PurpleBlistNode *node, gpointer data) { if (PURPLE_BLIST_NODE_IS_BUDDY(node)) { JabberAdHocCommands *cmd = data; PurpleBuddy *buddy = (PurpleBuddy *) node; JabberStream *js = purple_account_get_connection(buddy->account)->proto_data; - JabberIq *iq = jabber_iq_new(js, JABBER_IQ_SET); - xmlnode *command = xmlnode_new_child(iq->node,"command"); - xmlnode_set_attrib(iq->node,"to",cmd->jid); - xmlnode_set_namespace(command,"http://jabber.org/protocol/commands"); - xmlnode_set_attrib(command,"node",cmd->node); - xmlnode_set_attrib(command,"action","execute"); - /* we don't need to set a callback, since jabber_adhoc_parse is run for all replies */ - - jabber_iq_send(iq); + jabber_adhoc_execute(js, cmd); } } @@ -243,22 +235,26 @@ jabber_iq_send(iq); } +void jabber_adhoc_execute(JabberStream *js, JabberAdHocCommands *cmd) { + JabberIq *iq = jabber_iq_new(js, JABBER_IQ_SET); + xmlnode *command = xmlnode_new_child(iq->node,"command"); + xmlnode_set_attrib(iq->node,"to",cmd->jid); + xmlnode_set_namespace(command,"http://jabber.org/protocol/commands"); + xmlnode_set_attrib(command,"node",cmd->node); + xmlnode_set_attrib(command,"action","execute"); + + jabber_iq_set_callback(iq,jabber_adhoc_parse,NULL); + + jabber_iq_send(iq); +} + void jabber_adhoc_server_execute(PurplePluginAction *action) { JabberAdHocCommands *cmd = action->user_data; if(cmd) { PurpleConnection *gc = (PurpleConnection *) action->context; JabberStream *js = gc->proto_data; - JabberIq *iq = jabber_iq_new(js, JABBER_IQ_SET); - xmlnode *command = xmlnode_new_child(iq->node,"command"); - xmlnode_set_attrib(iq->node,"to",cmd->jid); - xmlnode_set_namespace(command,"http://jabber.org/protocol/commands"); - xmlnode_set_attrib(command,"node",cmd->node); - xmlnode_set_attrib(command,"action","execute"); - - /* we don't need to set a callback, since jabber_adhoc_parse is run for all replies */ - - jabber_iq_send(iq); + jabber_adhoc_execute(js, cmd); } }
--- a/libpurple/protocols/jabber/adhoccommands.h Mon Jun 25 19:08:16 2007 +0000 +++ b/libpurple/protocols/jabber/adhoccommands.h Mon Jun 25 20:07:31 2007 +0000 @@ -26,11 +26,11 @@ /* Implementation of XEP-0050 */ -void jabber_adhoc_parse(JabberStream *js, xmlnode *packet); - void jabber_adhoc_disco_result_cb(JabberStream *js, xmlnode *packet, gpointer data); -void jabber_adhoc_execute(PurpleBlistNode *node, gpointer data); +void jabber_adhoc_execute(JabberStream *js, JabberAdHocCommands *cmd); + +void jabber_adhoc_execute_action(PurpleBlistNode *node, gpointer data); void jabber_adhoc_server_get_list(JabberStream *js);
--- a/libpurple/protocols/jabber/buddy.c Mon Jun 25 19:08:16 2007 +0000 +++ b/libpurple/protocols/jabber/buddy.c Mon Jun 25 20:07:31 2007 +0000 @@ -1709,7 +1709,7 @@ continue; for(commands = jbr->commands; commands; commands = g_list_next(commands)) { JabberAdHocCommands *cmd = commands->data; - act = purple_menu_action_new(cmd->name, PURPLE_CALLBACK(jabber_adhoc_execute), cmd, NULL); + act = purple_menu_action_new(cmd->name, PURPLE_CALLBACK(jabber_adhoc_execute_action), cmd, NULL); m = g_list_append(m, act); } }
--- a/libpurple/protocols/jabber/iq.c Mon Jun 25 19:08:16 2007 +0000 +++ b/libpurple/protocols/jabber/iq.c Mon Jun 25 20:07:31 2007 +0000 @@ -292,11 +292,6 @@ return; } - if(xmlnode_get_child_with_namespace(packet, "command", "http://jabber.org/protocol/commands")) { - jabber_adhoc_parse(js, packet); - return; - } - purple_debug_info("jabber", "jabber_iq_parse\n"); if(xmlnode_get_child_with_namespace(packet, "ping", "http://www.xmpp.org/extensions/xep-0199.html#ns")) {