From 928513d81d3b351f5c10861daeaa59274bb439b2 Mon Sep 17 00:00:00 2001 From: Matthew Wild Date: Wed, 15 Apr 2020 15:38:02 +0100 Subject: [PATCH] XEP-0333: Clarify security note further --- xep-0333.xml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/xep-0333.xml b/xep-0333.xml index 35762045..6545d6d4 100644 --- a/xep-0333.xml +++ b/xep-0333.xml @@ -250,12 +250,13 @@ even maliciously reused by another MUC occupant.

Therefore, if a MUC announces support for &xep0359; then clients MUST always use - the MUC-assigned id for Chat Markers. The id will be contained in a <stanza-id> + the MUC-assigned id for Chat Markers. The id will be contained in a <stanza-id/> element inserted into the stanza with a 'by' attribute matching the MUC's own JID.

-

As per XEP-0359 security considerations, if XEP-0359 support is not announced then - <stanza-id/> elements with a 'by' attribute that match the MUC's own JID should - be considered spoofed and MUST be ignored.

+

As per XEP-0359 security considerations, if XEP-0359 support is not announced on the + MUC room's JID then <stanza-id/> elements with a 'by' attribute that match the + MUC's JID should be considered spoofed and MUST be ignored.

+