247c44be30
Implement security checks to ensure the 'archive_id' (XEP-0359) used for database deduplication originates from a trusted source. XEP-0359 Section 3.1: "The 'by' attribute MUST be the XMPP address (JID) of the entity assigning the unique and stable stanza ID." Furthermore, Section 4 (Security Considerations) specifies: "A client SHOULD only trust <stanza-id/> elements from its own server or from a MUC service it is joined to." XEP-0313 Section 4.1.2: "The 'by' attribute of the <result/> element is the JID of the archive being queried." and "If the 'by' attribute is not present, the recipient MUST assume that the results are from their own personal archive." Let _handle_chat verify <stanza-id/> 'by' attribute matches our bare JID. Let _handle_groupchat verify <stanza-id/> 'by' attribute matches the MUC s bare JID. Let _handle_mam verify the <result/> 'by' attribute matches the outer message 'from' (archive JID). If 'by' is missing then 'from' matches our own bare JID (personal archive). Signed-off-by: Michael Vetter <jubalh@iodoru.org>
Profanity
Profanity is a console based XMPP client inspired by Irssi.
If you like Profanity consider becoming a sponsor or donate some money.
See the User Guide for information on installing and using Profanity.
Project
This project is about freedom, privacy and choice. We want to enable people to chat with one another in a safe way. Thus supporting encryption (OTR, PGP, OMEMO, OX) and being decentralized, meaning everyone can run their own server. We believe XMPP is a great proven protocol with an excellent community serving this purpose well.
Feel free to follow us on twitter, join our mailing list and/or MUC.
Installation
Our user guide contains an install section and a section for building from source yourself.
Donations
We would highly appreciate if you support us via GitHub Sponsors. Especially if you make feature requests or need help using Profanity. Sponsoring enables us to spend time on Profanity.
An alternative way to support us would be to ask for our IBAN or use Bitcoin: bc1qx265eat7hfasqkqmk9qf38delydnrnuvzhzy0x.
Thank you! <3
How to contribute
We tried to sum things up on our helpout page. Additionally you can check out our blog where we have articles like: How to get a backtrace and Contributing a Patch via GitHub. For more technical details check out our CONTRIBUTING.md file.
Getting help
To get help, first read our User Guide then check out the FAQ. If you have are having a problem then first search the issue tracker. If you don't find anything there either come to our MUC or create a new issue depending on what your problem is.
Links
Website
URL: https://profanity-im.github.io
Repo: https://github.com/profanity-im/profanity-im.github.io
Blog
URL: https://profanity-im.github.io/blog
Repo: https://github.com/profanity-im/blog
Mailinglist
Mailing List: https://lists.posteo.de/listinfo/profanity
Chatroom
MUC: profanity@rooms.dismail.de
Plugins
Plugins repository: https://github.com/profanity-im/profanity-plugins