mirror of
https://github.com/element-hq/synapse
synced 2024-08-20 03:50:20 +00:00
Ensure that non-room-members cannot ban others, even if they do have enough powerlevel (SYN-343)
This commit is contained in:
parent
4847a9534d
commit
e6e130b9ba
1 changed files with 5 additions and 0 deletions
|
@ -272,6 +272,11 @@ class Auth(object):
|
|||
403, "You cannot kick user %s." % target_user_id
|
||||
)
|
||||
elif Membership.BAN == membership:
|
||||
if not caller_in_room: # caller isn't joined
|
||||
raise AuthError(
|
||||
403,
|
||||
"%s not in room %s." % (event.user_id, event.room_id,)
|
||||
)
|
||||
if user_level < ban_level:
|
||||
raise AuthError(403, "You don't have permission to ban")
|
||||
else:
|
||||
|
|
Loading…
Reference in a new issue