From 7ddfb31d5d797b2256deaca0b0dbe19b884c9e91 Mon Sep 17 00:00:00 2001
From: Adrien Dorsaz <adrien@adorsaz.ch>
Date: Wed, 28 Mar 2018 19:57:08 +0200
Subject: [PATCH] client don't give password to other structures with the
 configuration

---
 src/xmpp/client.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/xmpp/client.js b/src/xmpp/client.js
index 9502382..b56d40e 100644
--- a/src/xmpp/client.js
+++ b/src/xmpp/client.js
@@ -20,6 +20,9 @@ class Client {
     constructor(_config) {
         // XMPP configuration
         this.config = _config;
+        // Only the client needs to handle password (via SASL)
+        this.password = _config.password;
+        delete this.config.password;
 
         // DOM toolbox
         this.dom = document.implementation.createDocument(null, null);
@@ -315,7 +318,7 @@ class Client {
 
                     let auth = this.dom.createElementNS(Constants.NS_XMPP_SASL, 'auth');
                     auth.setAttribute('mechanism', clientMechanism);
-                    factory.getMessage(this.config.localpart, this.config.password, null)
+                    factory.getMessage(this.config.localpart, this.password, null)
                         .then((_saslMessage) => {
                             console.log('saslMessage: ' + _saslMessage);
                             auth.innerHTML = _saslMessage;
-- 
GitLab