handlers/_base: don't allow room create event to be changed

Signed-off-by: Patrik Oldsberg <patrik.oldsberg@ericsson.com>

synapse/handlers/_base.py

@@ -342,6 +342,12 @@ class BaseHandler(object):
                         "You don't have permission to redact events"
                     )
 
+        if event.type == EventTypes.Create and context.current_state:
+            raise AuthError(
+                403,
+                "Changing the room create event is forbidden",
+            )
+
         action_generator = ActionGenerator(self.hs)
         yield action_generator.handle_push_actions_for_event(
             event, context, self