From 445015e9ea33c20bf39213112d53cbd608c47609 Mon Sep 17 00:00:00 2001
From: strawberry <strawberry@puppygock.gay>
Date: Sun, 26 May 2024 16:39:10 -0400
Subject: [PATCH] check user ID server against ACLs at /send_leave
Signed-off-by: strawberry <strawberry@puppygock.gay>
---
src/api/server_server.rs | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/src/api/server_server.rs b/src/api/server_server.rs
index d87451c03..a6325d60a 100644
--- a/src/api/server_server.rs
+++ b/src/api/server_server.rs
@@ -1518,6 +1518,28 @@ async fn create_leave_event(origin: &ServerName, room_id: &RoomId, pdu: &RawJson
));
}
+ // ACL check sender server name
+ let sender: OwnedUserId = serde_json::from_value(
+ value
+ .get("sender")
+ .ok_or_else(|| Error::BadRequest(ErrorKind::InvalidParam, "PDU does not have a sender user/key"))?
+ .clone()
+ .into(),
+ )
+ .map_err(|_| Error::BadRequest(ErrorKind::BadJson, "User ID in sender is invalid"))?;
+
+ services()
+ .rooms
+ .event_handler
+ .acl_check(sender.server_name(), room_id)?;
+
+ if sender.server_name() != origin {
+ return Err(Error::BadRequest(
+ ErrorKind::InvalidParam,
+ "Not allowed to leave on behalf of another server/user",
+ ));
+ }
+
let origin: OwnedServerName = serde_json::from_value(
serde_json::to_value(
value
--
GitLab