MUC: Stricter validation of deserialized data

[prosody.git] / plugins / muc / muc.lib.lua

diff --git a/plugins/muc/muc.lib.lua b/plugins/muc/muc.lib.lua
index 337d2ae41f364a48f291f6cac4c54f47e5fddaf0..9a7b1f859bcd915aa76fd4dfc1508c42aaf19256 100644 (file)
--- a/plugins/muc/muc.lib.lua
+++ b/plugins/muc/muc.lib.lua
@@ -1322,6 +1322,11 @@ function room_mt:freeze(live)
                                frozen[jid] = st.preserialize(presence);
                        end
                end
+               local history = self._history;
+               if history then
+                       frozen._last_message = st.preserialize(history[#history].stanza);
+                       frozen._last_message_at = history[#history].timestamp;
+               end
        end
        return frozen;
 end
@@ -1337,6 +1342,13 @@ function _M.restore_room(frozen)
        local room_jid = frozen._jid;
        local room = _M.new_room(room_jid, frozen._data);
 
+       if frozen._last_message and frozen._last_message_at then
+               room._history = {
+                       { stanza = st.deserialize(frozen._last_message),
+                         timestamp = frozen._last_message_at, },
+               };
+       end
+
        local occupants = {};
        local occupant_sessions = {};
        local room_name, room_host = jid_split(room_jid);
@@ -1346,7 +1358,7 @@ function _M.restore_room(frozen)
                        if not resource and type(data) == "string" then
                                -- bare jid: affiliation
                                room._affiliations[jid] = data;
-                       elseif host == room_host and node == room_name and resource then
+                       elseif host == room_host and node == room_name and resource and type(data) == "table" then
                                -- full room jid: bare real jid and role
                                local bare_jid = data.bare_jid;
                                local   occupant = occupant_lib.new(bare_jid, jid);
@@ -1360,7 +1372,7 @@ function _M.restore_room(frozen)
                                        end
                                end
                                occupant_sessions[bare_jid] = nil;
-                       else
+                       elseif type(data) == "table" and data.name then
                                -- full user jid: presence
                                local presence = st.deserialize(data);
                                local bare_jid = jid_bare(jid);