[JDEV] Probing presence from component

Fabrice Desré fabrice.desre at francetelecom.com
Mon Jun 2 11:49:24 CDT 2003


Joe Hildebrand wrote:
> Yep.  Since allowing access to this information from an unauthorized source
> would be a security hole, the server blocks presence probes from people not
> on the probee's roster as "both" or "from".

Ok, but I think that an external component can be considered secure 
enough to access this information. With the actual behaviour, you end up 
with rosters entries only devoted to presence probing - not really useful.

> You could add a JSM module that allowed certain JIDs to bypass this
> restriction, and place it above mod_presence.

  This is just what I wanted to avoid... A config switch (like the admin 
properties) would be better.

	Fabrice
-- 
Fabrice Desré
France Télécom R&D/DTL/TAL
Tél: +(33) (0)2 96 05 31 43
Fax: +(33) (0)2 96 05 39 45
http://www.francetelecom.com/rd




More information about the JDev mailing list