From 3981e77ec6670187fab7aa31017c50f313aa3de6 Mon Sep 17 00:00:00 2001 From: strawberry Date: Sun, 26 May 2024 15:29:49 -0400 Subject: [PATCH] check user ID server against ACLs for /make_join Signed-off-by: strawberry --- src/api/server_server.rs | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/src/api/server_server.rs b/src/api/server_server.rs index 47b8f4de..07a848bb 100644 --- a/src/api/server_server.rs +++ b/src/api/server_server.rs @@ -880,7 +880,20 @@ pub(crate) async fn create_join_event_template_route( services() .rooms .event_handler - .acl_check(sender_servername, &body.room_id)?; + .acl_check(origin, &body.room_id)?; + + // ACL check invited user server name + services() + .rooms + .event_handler + .acl_check(body.user_id.server_name(), &body.room_id)?; + + if body.user_id.server_name() != origin { + return Err(Error::BadRequest( + ErrorKind::InvalidParam, + "Not allowed to join on behalf of another server/user", + )); + } if services() .globals