move header rewrite higher to avoid spoofing

bbb-apps-common/src/main/scala/org/bigbluebutton/client/meeting/UserActor.scala

@@ -94,17 +94,18 @@ class UserActor(val userId: String,
     val (result, error) = Deserializer.toBbbCoreMessageFromClient(msg.json)
     result match {
       case Some(msgFromClient) =>
-        val routing = Routing.addMsgFromClientRouting(msgFromClient.header.meetingId, msgFromClient.header.userId)
-        val envelope = new BbbCoreEnvelope(msgFromClient.header.name, routing)
-
-        if (msgFromClient.header.name == "ClientToServerLatencyTracerMsg") {
-          log.info("-- trace -- " + msg.json)
-        }
-
         // Override the meetingId and userId on the message from client. This
         // will prevent spoofing of messages. (ralam oct 30, 2017)
         val newHeader = BbbClientMsgHeader(msgFromClient.header.name, meetingId, userId)
         val msgClient = msgFromClient.copy(header = newHeader)
+        
+        val routing = Routing.addMsgFromClientRouting(msgClient.header.meetingId, msgClient.header.userId)
+        val envelope = new BbbCoreEnvelope(msgClient.header.name, routing)
+
+        if (msgClient.header.name == "ClientToServerLatencyTracerMsg") {
+          log.info("-- trace -- " + msg.json)
+        }
+
         val json = JsonUtil.toJson(msgClient)
         for {
           jsonNode <- convertToJsonNode(json)