narayana/anotherim
narayana/anotherim
3
2
Fork 0
Code Issues 3 Pull requests Actions Packages Projects Releases 4 Wiki Activity

allow roster pushes only from bare jid or null

Browse source
This commit is contained in:
Daniel Gultsch 2014-05-03 17:07:37 +02:00
parent be2f7e047a
commit 4822d4dce7
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/eu/siacs/conversations/services/XmppConnectionService.java
View file

@ -377,12 +377,14 @@ public class XmppConnectionService extends Service {
@Override @Override
public void onIqPacketReceived(Account account, IqPacket packet) { public void onIqPacketReceived(Account account, IqPacket packet) {
if (packet.hasChild("query")) { if (packet.hasChild("query","jabber:iq:roster")) {
String from = packet.getFrom();
if ((from==null)||(from.equals(account.getJid()))) {
Element query = packet.findChild("query"); Element query = packet.findChild("query");
String xmlns = query.getAttribute("xmlns");
if ((xmlns != null) && (xmlns.equals("jabber:iq:roster"))) {
processRosterItems(account, query); processRosterItems(account, query);
mergePhoneContactsWithRoster(null); mergePhoneContactsWithRoster(null);
} else {
Log.d(LOGTAG,"unauthorized roster push from: "+from);
} }
} else if (packet } else if (packet
.hasChild("open", "http://jabber.org/protocol/ibb") .hasChild("open", "http://jabber.org/protocol/ibb")