mirror of
https://github.com/element-hq/synapse
synced 2024-08-19 02:10:55 +00:00
Only users can set state events which have their own user_id
This commit is contained in:
parent
ca91bb2f7f
commit
512993b57f
1 changed files with 20 additions and 0 deletions
|
@ -446,6 +446,26 @@ class Auth(object):
|
||||||
"user_level (%d) < send_level (%d)" % (user_level, send_level)
|
"user_level (%d) < send_level (%d)" % (user_level, send_level)
|
||||||
)
|
)
|
||||||
|
|
||||||
|
# Check state_key
|
||||||
|
if hasattr(event, "state_key"):
|
||||||
|
if not event.state_key.startswith("_"):
|
||||||
|
if event.state_key.startswith("@"):
|
||||||
|
if event.state_key != event.user_id:
|
||||||
|
raise AuthError(
|
||||||
|
403,
|
||||||
|
"You are not allowed to set others state"
|
||||||
|
)
|
||||||
|
else:
|
||||||
|
sender_domain = self.hs.parse_userid(
|
||||||
|
event.user_id
|
||||||
|
).domain
|
||||||
|
|
||||||
|
if sender_domain != event.state_key:
|
||||||
|
raise AuthError(
|
||||||
|
403,
|
||||||
|
"You are not allowed to set others state"
|
||||||
|
)
|
||||||
|
|
||||||
return True
|
return True
|
||||||
|
|
||||||
def _check_redaction(self, event):
|
def _check_redaction(self, event):
|
||||||
|
|
Loading…
Reference in a new issue