Matrix-Mirrors/synapse-product
1
0
Fork 0
mirror of https://git.anonymousland.org/anonymousland/synapse-product.git synced 2024-12-24 08:39:26 -05:00
Code Issues Packages Projects Releases Wiki Activity

Only users can set state events which have their own user_id

Browse Source
This commit is contained in:
Erik Johnston 2014-11-19 17:21:40 +00:00
parent ca91bb2f7f
commit 512993b57f
1 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
synapse/api/auth.py
View File

@ -446,6 +446,26 @@ class Auth(object):
"user_level (%d) < send_level (%d)" % (user_level, send_level) "user_level (%d) < send_level (%d)" % (user_level, send_level)
) )
# Check state_key
if hasattr(event, "state_key"):
if not event.state_key.startswith("_"):
if event.state_key.startswith("@"):
if event.state_key != event.user_id:
raise AuthError(
403,
"You are not allowed to set others state"
)
else:
sender_domain = self.hs.parse_userid(
event.user_id
).domain
if sender_domain != event.state_key:
raise AuthError(
403,
"You are not allowed to set others state"
)
return True return True
def _check_redaction(self, event): def _check_redaction(self, event):