mirror of
https://github.com/element-hq/synapse
synced 2024-08-18 22:40:51 +00:00
Disable /register/available if registration is disabled (#6082)
Fixes #6066 This register endpoint should be disabled if registration is disabled, otherwise we're giving anyone the ability to check if a username exists on a server when we don't need to be. Error code is 403 (Forbidden) as that's the same returned by /register when registration is disabled.
This commit is contained in:
parent
1c9feadf4b
commit
1b519e0272
2 changed files with 6 additions and 0 deletions
1
changelog.d/6082.feature
Normal file
1
changelog.d/6082.feature
Normal file
|
@ -0,0 +1 @@
|
||||||
|
Return 403 on `/register/available` if registration has been disabled.
|
|
@ -328,6 +328,11 @@ class UsernameAvailabilityRestServlet(RestServlet):
|
||||||
|
|
||||||
@defer.inlineCallbacks
|
@defer.inlineCallbacks
|
||||||
def on_GET(self, request):
|
def on_GET(self, request):
|
||||||
|
if not self.hs.config.enable_registration:
|
||||||
|
raise SynapseError(
|
||||||
|
403, "Registration has been disabled", errcode=Codes.FORBIDDEN
|
||||||
|
)
|
||||||
|
|
||||||
ip = self.hs.get_ip_from_request(request)
|
ip = self.hs.get_ip_from_request(request)
|
||||||
with self.ratelimiter.ratelimit(ip) as wait_deferred:
|
with self.ratelimiter.ratelimit(ip) as wait_deferred:
|
||||||
yield wait_deferred
|
yield wait_deferred
|
||||||
|
|
Loading…
Reference in a new issue