Merge branch 'stable'

1 files changed, 33 insertions, 9 deletions

diff --git a/src/client/QXmppCarbonManager.cpp b/src/client/QXmppCarbonManager.cpp
index d403e6de..45dd96da 100644
--- a/src/client/QXmppCarbonManager.cpp
+++ b/src/client/QXmppCarbonManager.cpp
@@ -40,21 +40,24 @@ QXmppCarbonManager::~QXmppCarbonManager()
 {
 }
 
+///
 /// Returns whether message carbons are currently enabled
-
+///
 bool QXmppCarbonManager::carbonsEnabled() const
 {
     return m_carbonsEnabled;
 }
 
-/// Enable or disable message carbons.
+///
+/// Enables or disables message carbons for this connection.
+///
 /// This function does not check whether the server supports
 /// message carbons, but just sends the corresponding stanza
 /// to the server, so one must check in advance by using the
 /// discovery manager.
 ///
 /// By default, carbon copies are disabled.
-
+///
 void QXmppCarbonManager::setCarbonsEnabled(bool enabled)
 {
     if (m_carbonsEnabled == enabled)
@@ -73,6 +76,7 @@ void QXmppCarbonManager::setCarbonsEnabled(bool enabled)
     }
 }
 
+/// \cond
 QStringList QXmppCarbonManager::discoveryFeatures() const
 {
     return QStringList() << ns_carbons;
@@ -91,18 +95,21 @@ bool QXmppCarbonManager::handleStanza(const QDomElement &element)
     }
 
     if (carbon.isNull() || carbon.namespaceURI() != ns_carbons)
-        return false;  // Neither sent nor received -> no carbon message
+        return false;
 
-    QDomElement forwarded = carbon.firstChildElement("forwarded");
-    if (forwarded.isNull())
+    // carbon copies must always come from our bare JID
+    if (element.attribute("from") != client()->configuration().jidBare()) {
+        info("Received carbon copy from possible attacker trying to use CVE-2017-5603.");
         return false;
+    }
 
-    QDomElement messageelement = forwarded.firstChildElement("message");
-    if (messageelement.isNull())
+    auto forwarded = carbon.firstChildElement("forwarded");
+    auto messageElement = forwarded.firstChildElement("message");
+    if (messageElement.isNull())
         return false;
 
     QXmppMessage message;
-    message.parse(messageelement);
+    message.parse(messageElement);
 
     if (sent)
         emit messageSent(message);
@@ -111,3 +118,20 @@ bool QXmppCarbonManager::handleStanza(const QDomElement &element)
 
     return true;
 }
+/// \endcond
+
+///
+/// \fn QXmppCarbonManager::messageReceived()
+///
+/// Emitted when a message was received from someone else and directed to
+/// another resource.
+///
+/// If you connect this signal to the QXmppClient::messageReceived signal, they
+/// will appear as normal messages.
+///
+
+///
+/// \fn QXmppCarbonManager::messageSent()
+///
+/// Emitted when another resource sent a message to someone else.
+///