[JDEV] jabberd 1.4.3 release candidate

[Ralph Siemsen]

Hi Matthias,

Matthias Wimmer wrote:

> This is something that should be fixed by the transports that have these
> problems, not by the session manager.
> The session manager itself has no problems with xdb as it always
> converts the users to lowercase for xdb requests.

Thanks for the quick response!  I can see your point, although it then 
become necessary to document this requirement for transport authors.  It 
is something that would easily be overlooked.

> If one would patch the session manager to force everything to be
> lowercase, this would result in even more troubles as the users that are
> using mixed case and have registered there transports that way would not
> be able to use the transport registrations anymore.

There is still a problem though, even without transports: trying to 
access "public" data on the server.  If a user creates his/her account 
with "uSeRnAme": then under the current scheme their spool will have 
mixed-case.  Since username portion is not case-sensitive, the user can 
log out and log back in as "username".

Now they send a message to somebody else.  Somebody else sees them as 
"username", and tries to retrieve public data via an IQ (other than 
jabber:iq:private).  This call will fail, because it will try to access 
the wrong (nonexistant) xml file.

Hopefully the above is clear?  It basically comes down to: since 
usernames are treated case-insensitive for login purposes, the same 
policy should apply when retrieving xdb info.  Otherwise there is no way 
to figure out the proper capitalization, since users can log in with any 
  capitalization and send messages that way.

> And by the way the only transport I am aware of that still has this
> problem is the msn-transport. Hopefully there will be the new one soon
> that will hopefully fix this too.

I believe that is actually fixed now - the 
msn-transport.jabberstudio.org webpage currently includes a little 
shells script to convert filenames in the spool area.

-R