From 81bf4b71506822d91b3317c4de484aaabb7a5984 Mon Sep 17 00:00:00 2001
From: strawberry <strawberry@puppygock.gay>
Date: Sun, 26 May 2024 15:22:19 -0400
Subject: [PATCH] check user ID server against ACLs for /make_leave
Signed-off-by: strawberry <strawberry@puppygock.gay>
---
src/api/server_server.rs | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/src/api/server_server.rs b/src/api/server_server.rs
index ecf2f571e..47b8f4ded 100644
--- a/src/api/server_server.rs
+++ b/src/api/server_server.rs
@@ -1302,7 +1302,21 @@ pub(crate) async fn create_leave_event_template_route(
services()
.rooms
.event_handler
- .acl_check(sender_servername, &body.room_id)?;
+ .acl_check(origin, &body.room_id)?;
+
+ // ACL check invited user server name
+ services()
+ .rooms
+ .event_handler
+ .acl_check(body.user_id.server_name(), &body.room_id)?;
+
+ // check if origin server is trying to send for another server
+ if body.user_id.server_name() != origin {
+ return Err(Error::BadRequest(
+ ErrorKind::InvalidParam,
+ "Not allowed to leave on behalf of another server/user",
+ ));
+ }
let room_version_id = services().rooms.state.get_room_version(&body.room_id)?;
--
GitLab