MirrorHub/synapse
0
0
Fork 1
mirror of https://mau.dev/maunium/synapse.git synced 2024-11-18 16:02:15 +01:00
Code Issues Projects Releases Wiki Activity

Only users can set state events which have their own user_id

Browse source
This commit is contained in:
Erik Johnston 2014-11-19 17:21:40 +00:00
parent ca91bb2f7f
commit 512993b57f
1 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
synapse/api/auth.py
View file

@ -446,6 +446,26 @@ class Auth(object):
"user_level (%d) < send_level (%d)" % (user_level, send_level) "user_level (%d) < send_level (%d)" % (user_level, send_level)
) )
# Check state_key
if hasattr(event, "state_key"):
if not event.state_key.startswith("_"):
if event.state_key.startswith("@"):
if event.state_key != event.user_id:
raise AuthError(
403,
"You are not allowed to set others state"
)
else:
sender_domain = self.hs.parse_userid(
event.user_id
).domain
if sender_domain != event.state_key:
raise AuthError(
403,
"You are not allowed to set others state"
)
return True return True
def _check_redaction(self, event): def _check_redaction(self, event):