Force from on packet to be the sending user. JM-1096

git-svn-id: http://svn.igniterealtime.org/svn/repos/openfire/trunk@8698 b35dd754-fafc-0310-a699-88a17e54d16e

src/java/org/jivesoftware/openfire/SessionPacketRouter.java

@@ -35,7 +35,6 @@ public class SessionPacketRouter implements PacketRouter {
         router = XMPPServer.getInstance().getPacketRouter();
     }
 
-
     /**
      * Sets if TO addresses of Elements being routed should be validated. Doing stringprep operations
      * is very expensive and sometimes we already validated the TO address so there is no need to
@@ -82,6 +81,8 @@ public class SessionPacketRouter implements PacketRouter {
     }
 
     public void route(Packet packet) {
+        // Security: Don't allow users to send packets on behalf of other users
+        packet.setFrom(session.getAddress());
         if(packet instanceof IQ) {
             route((IQ)packet);
         }