Skip to content

Do not forward encrypted messages on XEP-0146 requests

Alexander Krotov requested to merge (removed):skip_encrypted into master

When 'remote_commands' option is enabled, commands to forward unread messages are available for clients with the same bare JID.

When these commands are called, all unread messages are forwarded to requesting clients in plaintext, even if they were encrypted initially. This command has been tested to successfully forward the contents of encrypted messages to Gajim that does not even have encryption plugins enabled. Furthermore, a malicious server can send this command on behalf of the user to retrieve plaintext of otherwise encrypted messages.

This patch disables forwarding for encrypted messages.

Edited by Alexander Krotov

Merge request reports