TudbuT/conduit
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

only allow membership event types at /send_join

Browse source 
Signed-off-by: strawberry <strawberry@puppygock.gay>
This commit is contained in:
strawberry 2024-05-26 16:26:09 -04:00 • committed by June 🍓🦴
parent bfd471a863
commit a5043a38e1
1 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
src/api/server_server.rs
View file

@ -1126,6 +1126,22 @@ async fn create_join_event(
));
};
let event_type: StateEventType = serde_json::from_value(
value
.get("type")
.ok_or_else(|| Error::BadRequest(ErrorKind::InvalidParam, "Join event does not have state event type"))?
.clone()
.into(),
)
.map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "PDU has invalid event type"))?;
if event_type != StateEventType::RoomMember {
return Err(Error::BadRequest(
ErrorKind::InvalidParam,
"Not allowed to send non-membership state event at join endpoint",
));
}
// ACL check sender server name
let sender: OwnedUserId = serde_json::from_value(
value