Adds token verification for poltergeist accepted rest calls.

resources/prosody-plugins/mod_muc_poltergeist.lua

@@ -20,6 +20,19 @@ if parentHostName == nil then
     return;
 end
 
+local parentCtx = module:context(parentHostName);
+if parentCtx == nil then
+    log("error",
+        "Failed to start - unable to get parent context for host: %s",
+        tostring(parentHostName));
+    return;
+end
+local token_util = module:require "token/util".new(parentCtx);
+
+-- option to enable/disable token verifications
+local disableTokenVerification
+    = module:get_option_boolean("disable_polergeist_token_verification", false);
+
 -- table to store all poltergeists we create
 local poltergeists = {};
 -- table to mark that outgoing unavailable presences
@@ -91,6 +104,49 @@ function remove_username(room, nick)
     end
 end
 
+--- Verifies room name, domain name with the values in the token
+-- @param token the token we received
+-- @param room_name the room name
+-- @param group name of the group (optional)
+-- @return true if values are ok or false otherwise
+function verify_token(token, room_name, group)
+    if disableTokenVerification then
+        return true;
+    end
+
+    -- if not disableTokenVerification and we do not have token
+    -- stop here, cause the main virtual host can have guest access enabled
+    -- (allowEmptyToken = true) and we will allow access to rooms info without
+    -- a token
+    if token == nil then
+        log("warn", "no token provided");
+        return false;
+    end
+
+    local session = {};
+    session.auth_token = token;
+    local verified, reason = token_util:process_and_verify_token(session);
+    if not verified then
+        log("warn", "not a valid token %s", tostring(reason));
+        return false;
+    end
+
+    local room_address = jid.join(room_name, module:get_host());
+    -- if there is a group we are in multidomain mode and that group is not
+    -- our parent host
+    if group and group ~= "" and group ~= parentHostName then
+        room_address = "["..group.."]"..room_address;
+    end
+
+    if not token_util:verify_room(session, room_address) then
+        log("warn", "Token %s not allowed to join: %s",
+            tostring(token), tostring(room_address));
+        return false;
+    end
+
+    return true;
+end
+
 -- if we found that a session for a user with id has a poltergiest already
 -- created, retrieve its jid and return it to the authentication
 -- so we can reuse it and we that real user will replace the poltergiest
@@ -253,6 +309,10 @@ function handle_create_poltergeist (event)
     local avatar = params["avatar"];
     local status = params["status"];
 
+    if not verify_token(params["token"], room_name, group) then
+        return 403;
+    end
+
     local room = get_room(room_name, group);
     if (not room) then
         log("error", "no room found %s", room_name);
@@ -282,6 +342,10 @@ function handle_update_poltergeist (event)
     local group = params["group"];
     local status = params["status"];
 
+    if not verify_token(params["token"], room_name, group) then
+        return 403;
+    end
+
     local room = get_room(room_name, group);
     if (not room) then
         log("error", "no room found %s", room_name);
@@ -354,6 +418,10 @@ function handle_remove_poltergeist (event)
     local room_name = params["room"];
     local group = params["group"];
 
+    if not verify_token(params["token"], room_name, group) then
+        return 403;
+    end
+
     local room = get_room(room_name, group);
     if (not room) then
         log("error", "no room found %s", room_name);