- SAX sends messages with duplicate IDs, breaking Discord link
- 09 Feb 2021 01:55:04 am
Since the server restart yesterday, the Discord bridge has been kinda broken. Whenever someone would send a message from SAX, the bridge would edit a random message instead of sending a new one.
The bridge seems to be interpreting duplicate message IDs as a request to edit the message with that ID since the restart, regardless of whether the sender matches. Additionally, strophejs seems to be using a really dumb ID generator - it starts at 1 each time you load SAX and increases by 1 each time you call it. So, if you refresh the page or navigate to anywhere else on the forum, your message IDs restart from 1. As a result, SAX messages almost always replace an existing message on the Discord side of the bridge.
The easiest way to fix this would probably be to replace line 734 of saxjax.js (along with other calls to groupchat with:
Code:
However, this would still leave an issue with impersonation by allowing anyone with a custom XMPP client to edit the message of anyone else on Discord. I doubt anyone would exploit it, though, as there are easier ways to impersonate SAX users.
The bridge seems to be interpreting duplicate message IDs as a request to edit the message with that ID since the restart, regardless of whether the sender matches. Additionally, strophejs seems to be using a really dumb ID generator - it starts at 1 each time you load SAX and increases by 1 each time you call it. So, if you refresh the page or navigate to anywhere else on the forum, your message IDs restart from 1. As a result, SAX messages almost always replace an existing message on the Discord side of the bridge.
The easiest way to fix this would probably be to replace line 734 of saxjax.js (along with other calls to groupchat with:
Code:
connection.muc.groupchat(sax_room, text, null, Math.random())However, this would still leave an issue with impersonation by allowing anyone with a custom XMPP client to edit the message of anyone else on Discord. I doubt anyone would exploit it, though, as there are easier ways to impersonate SAX users.
