Matrix-Mirrors/anonymousland-synapse
1
0
Fork 0
mirror of https://git.anonymousland.org/anonymousland/synapse.git synced 2025-08-01 18:06:11 -04:00
Code Issues Projects Releases Packages Wiki Activity

Check room visibility for /event/ requests

Browse source 
Make sure that the user has permission to view the requeseted event for
/event/{eventId} and /room/{roomId}/event/{eventId} requests.

Also check that the event is in the given room for
/room/{roomId}/event/{eventId}, for sanity.
This commit is contained in:
Richard van der Hoff 2018-08-02 15:03:27 +01:00
parent a013404292
commit 0bf5ec0db7
3 changed files with 23 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
synapse/rest/client/v1/room.py
View file

@ -508,7 +508,7 @@ class RoomEventServlet(ClientV1RestServlet):
@defer.inlineCallbacks
def on_GET(self, request, room_id, event_id):
requester = yield self.auth.get_user_by_req(request)
event = yield self.event_handler.get_event(requester.user, event_id)
event = yield self.event_handler.get_event(requester.user, room_id, event_id)
time_now = self.clock.time_msec()
if event: