# HG changeset patch
# User Tobias Markmann <tm@ayena.de>
# Date 1226772725 -3600
# Node ID 8e1fd8ff66ee17d85b8fe6ed0a9a98b70e24a956
# Parent  80e7de32b61883949e982cce10d18ed3a858bcf3
Adding some TODO for some security issue.

diff -r 80e7de32b618 -r 8e1fd8ff66ee plugins/mod_saslauth.lua
--- a/plugins/mod_saslauth.lua	Sat Nov 15 13:47:17 2008 +0100
+++ b/plugins/mod_saslauth.lua	Sat Nov 15 19:12:05 2008 +0100
@@ -115,6 +115,7 @@
 					function (session, features)												
 						if not session.username then
 							t_insert(features, "<mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>");
+							-- TODO: Provide PLAIN only if TLS is active, this is a SHOULD from the introduction of RFC 4616. This behavior could be overridden via configuration but will issuing a warning or so.
 								t_insert(features, "<mechanism>PLAIN</mechanism>");
 								t_insert(features, "<mechanism>DIGEST-MD5</mechanism>");
 							t_insert(features, "</mechanisms>");