User adds ALL registered users!

Openfire Openfire Support
1

hey guys been awhile since I have been here, but quick question. I am still running an old Wildfire server 3.0.x. I had a user that created a melt-down today by adding the contact server.domain.com (this would be my server name) where they should have added jgarner@server.domain.com. the result of this user doing the former and not the latter was an attempt by the client to add all known users to the user’s roster. Is there anyway to stop a user from adding the server name as a roster item?

Anyhelp would be great.

jeff

2

I am still running an old Wildfire server 3.0.x.

Simply update to an new version of Openfire…

3

Sorry that isn’t an option in a 50K+ user Enterprise without weeks of planning, testing, etc…

Anyone else have a way to stop this from happening?

4

Hey Jeff,

Welcome back! So are you seeing that adding the server domain to your roster ended up in subscribing to the presence of all users? Are you using any plugin? The server shouldn’t be doing that.

Thanks,

– Gato

5

Gato,

I am currently using Broadcast (with an admin only list), Presence, Content, Search, Subscription, user import.

I looked at these and didn;t see where that should be able to happen either. The user went into her add contact menu, and put in server.domain,com in as the contact name, and then the client sent packets to all logged in users +2500, ofcourse that set off pandimonium as this user is not known to most people… heh… I killed it by going into the DB and manually deleting the contact info, and had to restart the server service. I just have to know how to stop it if someone were to do it again. We are about to upgrade to Openfire 3.3x, but need to limp this one along for a month or two more.

Jeff

6

Hey Jeff,

I see that the issue JM-810 was fixed for the 3.1.0 version. If you cannot upgrade to a newest version then you can add a new plugin that will reject presence packets sent to the server itself.

Regards,

– Gato

7

is that plugin available for 3.0.0? That is where I am at currently.

8

Whoops! I meant to say that a plugin can be used to filter out those packets but such plugin does not exist (afaik). Anyway, if you know Java it may take an hour or two to have it running.

Regards,

– Gato

9

Hahaha! All I know about Java is that it is a 4 letter word…

Naw, I can’t program java. will look at if I can do something with the existing presence plugin.

Thanks for the reply though.

jeff