mirror of
https://github.com/element-hq/synapse
synced 2024-08-18 23:50:52 +00:00
Only users can set state events which have their own user_id
This commit is contained in:
parent
ca91bb2f7f
commit
512993b57f
1 changed files with 20 additions and 0 deletions
|
@ -446,6 +446,26 @@ class Auth(object):
|
|||
"user_level (%d) < send_level (%d)" % (user_level, send_level)
|
||||
)
|
||||
|
||||
# Check state_key
|
||||
if hasattr(event, "state_key"):
|
||||
if not event.state_key.startswith("_"):
|
||||
if event.state_key.startswith("@"):
|
||||
if event.state_key != event.user_id:
|
||||
raise AuthError(
|
||||
403,
|
||||
"You are not allowed to set others state"
|
||||
)
|
||||
else:
|
||||
sender_domain = self.hs.parse_userid(
|
||||
event.user_id
|
||||
).domain
|
||||
|
||||
if sender_domain != event.state_key:
|
||||
raise AuthError(
|
||||
403,
|
||||
"You are not allowed to set others state"
|
||||
)
|
||||
|
||||
return True
|
||||
|
||||
def _check_redaction(self, event):
|
||||
|
|
Loading…
Reference in a new issue