Wojtek, I've found this issue during work on "XEP-0048: Bookmarks" which suggests usage of PEP as private storage for conference bookmarks. This issue is I would say quite critical as due to the issue it is possible to receive or retrieve other user bookmarks which may include full connection details for MUC rooms (include password!).

I've checked this fix and added TTS-NG tests for this issue to make sure that it is fixed and will be fixed in 8.0.0. However, I suppose that this is rather a critical bug and we should update our installations ASAP. What do you think? Will you update them or should I?

Andrzej Wójcik wrote:

What do you think? Will you update them or should I?

I'll update it.

Wojciech Kapcia wrote:

Andrzej Wójcik wrote:

What do you think? Will you update them or should I?

I'll update it.

Updated to tigase-server-8.0.0-SNAPSHOT-b10023

to-do: terminated old instance once the users switch to new ones (i-0151f479b9f5eb54f and i-0151f479b9f5eb54f)

Wojciech Kapcia wrote:

to-do: terminated old instance once the users switch to new ones (i-0151f479b9f5eb54f and i-0151f479b9f5eb54f)

terminated

It looks like this test is still failing randomly. It seems, that for some reason, quick disconnect/connect could cause it?

Wojciech, I've fixed issues related to TTS-NG TestPEP test case. It looks like Jaxmpp event bus still has some events to process after disconnect(true) returns, as adding a minor delay fixed this issue. Or at least tests are passing now without any issues.

It solved the issue.

Tigase.org will be updated in #8696