Block clients from sending server ACLs that lock the local server out. (#8708)

Fixes #4042
This commit is contained in:
Erik Johnston 2020-11-03 12:13:48 +00:00 committed by GitHub
parent 4b09b7438e
commit 243d427fbc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 80 additions and 9 deletions

View file

@ -1138,6 +1138,9 @@ class EventCreationHandler:
if original_event.room_id != event.room_id:
raise SynapseError(400, "Cannot redact event from a different room")
if original_event.type == EventTypes.ServerACL:
raise AuthError(403, "Redacting server ACL events is not permitted")
prev_state_ids = await context.get_prev_state_ids()
auth_events_ids = self.auth.compute_auth_events(
event, prev_state_ids, for_verification=True