diff --git a/xep-0060.xml b/xep-0060.xml index 41ec63b4..354252b0 100644 --- a/xep-0060.xml +++ b/xep-0060.xml @@ -2718,6 +2718,23 @@ And by opposing end them? ]]> +

If so, the service MUST also include the publisher with every other form of item retrieval.

+ + + + + [ ... ENTRY ... ] + + [ ... MORE ITEMS ... ] + + + +]]>

The value of the 'publisher' attribute MUST be generated by the service, not accepted by the service in the published item, since allowing the publisher to assert its JID would open the possibility of spoofing.

The JID stamped by the service can be either (1) the full JID &LOCALFULL; of the publisher as taken the 'from' attribute of the IQ-set used to publish the item or (2) the bare JID &LOCALBARE; of the publisher as derived from a formal affiliation in the explicit list of whitelisted publishers.