Matrix-Mirrors/anonymousland-synapse
1
0
Fork 0
mirror of https://git.anonymousland.org/anonymousland/synapse.git synced 2024-10-01 11:49:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

Disable /register/available if registration is disabled (#6082)

Browse Source 
Fixes #6066

This register endpoint should be disabled if registration is disabled, otherwise we're giving anyone the ability to check if a username exists on a server when we don't need to be.

Error code is 403 (Forbidden) as that's the same returned by /register when registration is disabled.
This commit is contained in:
Andrew Morgan 2019-09-23 16:38:38 +02:00 committed by Richard van der Hoff
parent 1c9feadf4b
commit 1b519e0272
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
changelog.d/6082.feature Normal file
View File

@ -0,0 +1 @@
Return 403 on `/register/available` if registration has been disabled.

5
synapse/rest/client/v2_alpha/register.py
View File

@ -328,6 +328,11 @@ class UsernameAvailabilityRestServlet(RestServlet):
@defer.inlineCallbacks @defer.inlineCallbacks
def on_GET(self, request): def on_GET(self, request):
if not self.hs.config.enable_registration:
raise SynapseError(
403, "Registration has been disabled", errcode=Codes.FORBIDDEN
)
ip = self.hs.get_ip_from_request(request) ip = self.hs.get_ip_from_request(request)
with self.ratelimiter.ratelimit(ip) as wait_deferred: with self.ratelimiter.ratelimit(ip) as wait_deferred:
yield wait_deferred yield wait_deferred