ports@,
eJabberd 25.04 was releases in a few weeks after previous release with, as
they had said in announce, an important security fix.
Here a diff to backport it to ejabberd 24.12 in 7.7
Ok?
Index: net/ejabberd/Makefile
===================================================================
RCS file: /home/cvs/ports/net/ejabberd/Makefile,v
diff -u -p -r1.57 Makefile
--- net/ejabberd/Makefile 21 Dec 2024 20:49:43 -0000 1.57
+++ net/ejabberd/Makefile 23 Apr 2025 18:28:03 -0000
@@ -1,6 +1,7 @@
COMMENT = robust, ubiquitous and massively scalable messaging
platform
V = 24.12
+REVISION = 0
DIST_TUPLE += github processone ejabberd ${V} .
CATEGORIES = net
Index: net/ejabberd/patches/patch-src_mod_muc_occupantid_erl
===================================================================
RCS file: net/ejabberd/patches/patch-src_mod_muc_occupantid_erl
diff -N net/ejabberd/patches/patch-src_mod_muc_occupantid_erl
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ net/ejabberd/patches/patch-src_mod_muc_occupantid_erl 23 Apr 2025
18:31:05 -0000
@@ -0,0 +1,15 @@
+Backport a security fix from 25.04
+https://github.com/processone/ejabberd/commit/c98739d5b5721d036b5bb9682890ed4c398cc516
+
+Index: src/mod_muc_occupantid.erl
+--- src/mod_muc_occupantid.erl.orig
++++ src/mod_muc_occupantid.erl
+@@ -71,7 +71,7 @@ add_occupantid_packet(Packet, RoomJid) ->
+ From = xmpp:get_from(Packet),
+ OccupantId = calculate_occupantid(From, RoomJid),
+ OccupantElement = #occupant_id{id = OccupantId},
+- xmpp:set_subtag(Packet, OccupantElement).
++ xmpp:append_subtags(xmpp:remove_subtag(Packet, OccupantElement),
[OccupantElement]).
+
+ calculate_occupantid(From, RoomJid) ->
+ Term = {jid:remove_resource(From), get_salt(RoomJid)},
