77import org .buddycloud .channelserver .packetprocessor .iq .namespace .pubsub .JabberPubsub ;
88import org .buddycloud .channelserver .packetprocessor .iq .namespace .pubsub .PubSubElementProcessorAbstract ;
99import org .buddycloud .channelserver .pubsub .model .NodeMembership ;
10+ import org .buddycloud .channelserver .pubsub .subscription .Subscriptions ;
1011import org .buddycloud .channelserver .utils .XMLConstants ;
1112import org .buddycloud .channelserver .utils .node .item .payload .Buddycloud ;
1213import org .dom4j .Element ;
@@ -67,6 +68,15 @@ public void process(Element elm, JID actorJID, IQ reqIQ, Element rsm) throws Exc
6768 outQueue .put (result );
6869 }
6970
71+ /**
72+ * Don't include any subscriptions other than Subscriptions.subscriptions, unless the user is
73+ * one of owner, moderator or the user.
74+ *
75+ * @param subscriptions
76+ * @return
77+ * @throws NodeStoreException
78+ * @throws InterruptedException
79+ */
7080 private boolean getNodeMemberships (Element subscriptions ) throws NodeStoreException , InterruptedException {
7181
7282 ResultSet <NodeMembership > cur = channelManager .getNodeMemberships (node );
@@ -76,19 +86,23 @@ private boolean getNodeMemberships(Element subscriptions) throws NodeStoreExcept
7686 subscriptions .addAttribute (XMLConstants .NODE_ATTR , node );
7787
7888 for (NodeMembership ns : cur ) {
79- if (actorJid .toBareJID ().equals (ns .getUser ().toBareJID ())) {
80- Element subscription = subscriptions .addElement (XMLConstants .SUBSCRIPTION_ELEM );
81- subscription .addAttribute (XMLConstants .NODE_ATTR , ns .getNodeId ())
82- .addAttribute (XMLConstants .SUBSCRIPTION_ELEM , ns .getSubscription ().toString ())
83- .addAttribute (XMLConstants .JID_ATTR , ns .getUser ().toBareJID ());
84- if (null != ns .getInvitedBy () && isOwnerModerator ()) {
85- subscription .addAttribute (XMLConstants .INVITED_BY_ELEM , ns .getInvitedBy ().toBareJID ());
86- }
89+ if (!isUserPriviledged (ns .getUser ()) && !ns .getSubscription ().equals (Subscriptions .subscribed )) {
90+ continue ;
91+ }
92+
93+ Element subscription = subscriptions .addElement (XMLConstants .SUBSCRIPTION_ELEM );
94+ subscription .addAttribute (XMLConstants .NODE_ATTR , ns .getNodeId ())
95+ .addAttribute (XMLConstants .SUBSCRIPTION_ELEM , ns .getSubscription ().toString ())
96+ .addAttribute (XMLConstants .JID_ATTR , ns .getUser ().toBareJID ());
97+
98+ // Only add the invited by attribute if the user has the necessary priviledges
99+ if (null != ns .getInvitedBy () && isUserPriviledged (ns .getUser ())) {
100+ subscription .addAttribute (XMLConstants .INVITED_BY_ELEM , ns .getInvitedBy ().toBareJID ());
87101 }
88102
89103 }
90104 } else {
91-
105+ // TODO(garethf) this looks like makeRemoteRequest
92106 if (!channelManager .isCachedNode (node ) || (null != requestIq .getElement ().element (XMLConstants .PUBSUB_ELEM ).element (XMLConstants .SET_ELEM ))
93107 && !cur .isEmpty ()) {
94108 makeRemoteRequest (new JID (node .split ("/" )[2 ]).getDomain ());
@@ -99,6 +113,21 @@ private boolean getNodeMemberships(Element subscriptions) throws NodeStoreExcept
99113 return true ;
100114 }
101115
116+ /**
117+ * Don't include any subscriptions other than Subscriptions.subscriptions, unless the user is
118+ * one of owner, moderator or the user.
119+ *
120+ * @param ns
121+ *
122+ * @return
123+ * @throws NodeStoreException
124+ */
125+ private boolean isUserPriviledged (JID jid ) throws NodeStoreException {
126+ boolean isUser = actorJid .toBareJID ().equals (jid .toBareJID ());
127+
128+ return (isUser || isOwnerModerator ()) ? true : false ;
129+ }
130+
102131 private boolean getUserMemberships (Element subscriptions ) throws NodeStoreException , InterruptedException {
103132 // let's get all subscriptions.
104133 ResultSet <NodeMembership > cur ;
0 commit comments