Pita/etherpad-lite — pull request #1035 by amtep (2012-10-02 21:29:59+00:00)
Title: Guard against malicious clients in USERINFO_UPDATE handling

The server was reusing the client's message when broadcasting userinfo updates. This would allow a malicious client to insert arbitrary fields into a message that the other clients would trust as coming from the server. For example, adding "disconnect" or renaming other authors.

Instead of analyzing all the ways this could be abused, I made a patch to have the server create its own message for broadcast. I realize that etherpad-lite is meant for collaboration, so presumably the users trust each other, but I still like to close this kind of hole when I find it :)