latos / wave-protocol

Automatically exported from code.google.com/p/wave-protocol
0 stars 0 forks source link

No server validation when adding new participants to Waves #202

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago
What steps will reproduce the problem?
1. Create two user accounts both will have '@your_server' suffix
2. Log in to account 'a@your_server', make a new wave, add 'b@another_server' 
to the wave
3. It is possible to add this user to the wave, even though the server/user 
does not exist

What is the expected output? What do you see instead?
One should not be able to add 'b@another_server'. A warning must be shown that 
indicates that the user does not exist. 

What changeset or version are you using? On what operating system?
826:68042742af74
I am Google Chrome on an Ubuntu Linux laptop

Please provide any additional information below.
If I were to add an unregistered user to a wave, this is effectively validated. 
If user 'a@your_server' added 'b@another_server', user 'b@your_server' cannot 
see that he was added to a wave. 

Original issue reported on code.google.com by glozan...@gmail.com on 11 Jan 2011 at 11:14

GoogleCodeExporter commented 8 years ago
What you request is pretty much infeasible, much as it is with email. It is 
beyond a wave provider's means to know what wave servers and users at those 
servers exist, or might exist in the future. Even if it tried to check, the 
server might actually exist but just be down or experiencing some communication 
failure.

Just like with email, you can add any address you like. We may in the future 
consider a best effort attempt at notifying the user later, if say the 
federated server never appears, but it could never be guaranteed. When we have 
federated profile fetching later, the failure to fetch a profile for the user 
might provide that clue.

We're still far from that at the moment so I'm going to close the issue.

Original comment by ano...@google.com on 11 Jan 2011 at 11:58