MirrorHub/synapse
0
0
Fork 1
mirror of https://mau.dev/maunium/synapse.git synced 2024-12-15 16:33:51 +01:00
Code Issues Projects Releases Wiki Activity

Prevent kicking users who aren't in the room (#4999)

Browse source 
Prevent kick events from succeeding if the user is not currently in the room.
This commit is contained in:
Andrew Morgan 2019-04-04 13:05:51 +01:00 committed by GitHub
parent 9f5d206c4a
commit db265f0642
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changelog.d/4999.bugfix Normal file
View file

@ -0,0 +1 @@
Prevent the ability to kick users from a room they aren't in.

9
synapse/handlers/room_member.py
View file

@ -421,6 +421,9 @@ class RoomMemberHandler(object):
room_id, latest_event_ids=latest_event_ids, room_id, latest_event_ids=latest_event_ids,
) )
# TODO: Refactor into dictionary of explicitly allowed transitions
# between old and new state, with specific error messages for some
# transitions and generic otherwise
old_state_id = current_state_ids.get((EventTypes.Member, target.to_string())) old_state_id = current_state_ids.get((EventTypes.Member, target.to_string()))
if old_state_id: if old_state_id:
old_state = yield self.store.get_event(old_state_id, allow_none=True) old_state = yield self.store.get_event(old_state_id, allow_none=True)
@ -446,6 +449,9 @@ class RoomMemberHandler(object):
if same_sender and same_membership and same_content: if same_sender and same_membership and same_content:
defer.returnValue(old_state) defer.returnValue(old_state)
if old_membership in ["ban", "leave"] and action == "kick":
raise AuthError(403, "The target user is not in the room")
# we don't allow people to reject invites to the server notice # we don't allow people to reject invites to the server notice
# room, but they can leave it once they are joined. # room, but they can leave it once they are joined.
if ( if (
@ -459,6 +465,9 @@ class RoomMemberHandler(object):
"You cannot reject this invite", "You cannot reject this invite",
errcode=Codes.CANNOT_LEAVE_SERVER_NOTICE_ROOM, errcode=Codes.CANNOT_LEAVE_SERVER_NOTICE_ROOM,
) )
else:
if action == "kick":
raise AuthError(403, "The target user is not in the room")
is_host_in_room = yield self._is_host_in_room(current_state_ids) is_host_in_room = yield self._is_host_in_room(current_state_ids)