In default config, only local accounts can create rooms and pubsub nodes.

SVN Revision: 2683

diff --git a/doc/guide.html b/doc/guide.html
index 8346c80b30c501ef67d4fcf812e373036eff4b8a..08f8bb14a4ff291292069392c9e7fcc0cd9169d8 100644 (file)
--- a/doc/guide.html
+++ b/doc/guide.html
@@ -2306,11 +2306,11 @@ is replaced at start time with the real virtual host name.
 </DD><DT CLASS="dt-description"><B><TT>{access, AccessName}</TT></B></DT><DD CLASS="dd-description"> You can specify who is allowed to use
 the Multi-User Chat service. By default everyone is allowed to use it.
 </DD><DT CLASS="dt-description"><B><TT>{access_create, AccessName}</TT></B></DT><DD CLASS="dd-description"> To configure who is
-allowed to create new rooms at the Multi-User Chat service, this option
-can be used. By default everybody is allowed to create rooms.
+allowed to create new rooms at the Multi-User Chat service, this option can be used.
+By default any account in the local ejabberd server is allowed to create rooms.
 </DD><DT CLASS="dt-description"><B><TT>{access_persistent, AccessName}</TT></B></DT><DD CLASS="dd-description"> To configure who is
 allowed to modify the &#X2019;persistent&#X2019; room option.
-By default everybody is allowed to modify that option.
+By default any account in the local ejabberd server is allowed to modify that option.
 </DD><DT CLASS="dt-description"><B><TT>{access_admin, AccessName}</TT></B></DT><DD CLASS="dd-description"> This option specifies
 who is allowed to administrate the Multi-User Chat service. The default
 value is <TT>none</TT>, which means that only the room creator can
@@ -2791,7 +2791,9 @@ is replaced at start time with the real virtual host name.
 
 </DD><DT CLASS="dt-description"><B><TT>{access_createnode, AccessName}</TT></B></DT><DD CLASS="dd-description"> 
 This option restricts which users are allowed to create pubsub nodes using
-ACL and ACCESS. The default value is <TT>pubsub_createnode</TT>. </DD><DT CLASS="dt-description"><B><TT>{max_items_node, MaxItems}</TT></B></DT><DD CLASS="dd-description"> 
+ACL and ACCESS.
+By default any account in the local ejabberd server is allowed to create pubsub nodes.
+</DD><DT CLASS="dt-description"><B><TT>{max_items_node, MaxItems}</TT></B></DT><DD CLASS="dd-description"> 
 Define the maximum number of items that can be stored in a node.
 Default value is 10.
 </DD><DT CLASS="dt-description"><B><TT>{plugins, [ Plugin, ...]}</TT></B></DT><DD CLASS="dd-description"> 

diff --git a/doc/guide.tex b/doc/guide.tex
index e8f8fad2f6bb71dec736c819d319f637e96245d1..57a754548f4ce40b61aee861d3987cdbd501bcca 100644 (file)
--- a/doc/guide.tex
+++ b/doc/guide.tex
@@ -3028,11 +3028,11 @@ Module options:
 \titem{\{access, AccessName\}} \ind{options!access}You can specify who is allowed to use
   the Multi-User Chat service. By default everyone is allowed to use it.
 \titem{\{access\_create, AccessName\}} \ind{options!access\_create}To configure who is
-  allowed to create new rooms at the Multi-User Chat service, this option
-  can be used. By default everybody is allowed to create rooms.
+  allowed to create new rooms at the Multi-User Chat service, this option can be used.
+  By default any account in the local ejabberd server is allowed to create rooms.
 \titem{\{access\_persistent, AccessName\}} \ind{options!access\_persistent}To configure who is
   allowed to modify the 'persistent' room option.
-  By default everybody is allowed to modify that option.
+  By default any account in the local ejabberd server is allowed to modify that option.
 \titem{\{access\_admin, AccessName\}} \ind{options!access\_admin}This option specifies
   who is allowed to administrate the Multi-User Chat service. The default
   value is \term{none}, which means that only the room creator can
@@ -3572,7 +3572,8 @@ Options:
 \hostitem{pubsub}
 \titem{\{access\_createnode, AccessName\}} \ind{options!access\_createnode}
   This option restricts which users are allowed to create pubsub nodes using
-  ACL and ACCESS. The default value is \term{pubsub\_createnode}. % Not clear enough + do not use abbreviations.
+  ACL and ACCESS.
+  By default any account in the local ejabberd server is allowed to create pubsub nodes.
 \titem{\{max\_items\_node, MaxItems\}} \ind{options!max\_items\_node}
   Define the maximum number of items that can be stored in a node.
   Default value is 10.

diff --git a/doc/release_notes_2.1.0.txt b/doc/release_notes_2.1.0.txt
index 1a68682e049b0a4512d6b7dfe36c9a32a08aee99..9d93b249581490f166bf223ec1e8ccdc0d239e96 100644 (file)
--- a/doc/release_notes_2.1.0.txt
+++ b/doc/release_notes_2.1.0.txt
@@ -65,6 +65,7 @@
 - New syntax to specify the network protocol: tcp or udp
 - Report error at startup if a listener module isn't available
 - Only listen in a port when actually ready to serve requests
+- In default config, only local accounts can create rooms and PubSub nodes
 
 * Core architecture
 - More verbose error reporting for xml:element_to_string

diff --git a/src/ejabberd.cfg.example b/src/ejabberd.cfg.example
index f9c522b311733935f9f41f3b0e2fe42379c41195..a69261f08f01a9447745a28534f261e0b182d22f 100644 (file)
--- a/src/ejabberd.cfg.example
+++ b/src/ejabberd.cfg.example
@@ -415,11 +415,14 @@
 %% Admins of this server are also admins of MUC service:
 {access, muc_admin, [{allow, admin}]}.
 
+%% Only accounts of the local ejabberd server can create rooms:
+{access, muc_create, [{allow, local}]}.
+
 %% All users are allowed to use MUC service:
 {access, muc, [{allow, all}]}.
 
-%% Everybody can create pubsub nodes
-{access, pubsub_createnode, [{allow, all}]}.
+%% Only accounts in the local ejabberd server can create Pubsub nodes:
+{access, pubsub_createnode, [{allow, local}]}.
 
 %% In-band registration allows registration of any possible username.
 %% To disable in-band registration, replace 'allow' with 'deny'.
@@ -494,8 +497,8 @@
   {mod_muc,      [
                  %%{host, "conference.@HOST@"},
                  {access, muc},
-                 {access_create, muc},
-                 {access_persistent, muc},
+                 {access_create, muc_create},
+                 {access_persistent, muc_create},
                  {access_admin, muc_admin}
                 ]},
   %%{mod_muc_log,[]},