mirrors/dendrite
1
0
Fork 0
mirror of https://github.com/matrix-org/dendrite.git synced 2025-12-26 00:03:09 -06:00
Code Issues Packages Projects Releases Wiki Activity

Reject setting powerlevel from wrong sender

Browse source
This commit is contained in:
Till Faelligen 2020-11-10 20:22:18 +01:00
parent 2caf043357
commit f28aba27b1
1 changed files with 38 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
roomserver/internal/input/input_events.go
View file

@ -77,6 +77,12 @@ func (r *Inputer) processRoomEvent(
isRejected = true
}
var isPLRejected bool
var isPLRejectedErr error
if event.Type() == gomatrixserverlib.MRoomPowerLevels {
isPLRejected, isPLRejectedErr = r.checkPowerLevels(ctx, event)
}
var softfail bool
if input.Kind == api.KindNew {
// Check that the event passes authentication checks based on the
@ -149,7 +155,10 @@ func (r *Inputer) processRoomEvent(
}
// We stop here if the event is rejected: We've stored it but won't update forward extremities or notify anyone about it.
if isRejected || softfail {
if isRejected || isPLRejected || softfail {
if rejectionErr == nil {
rejectionErr = isPLRejectedErr
}
logrus.WithFields(logrus.Fields{
"event_id": event.EventID(),
"type": event.Type(),
@ -210,6 +219,34 @@ func (r *Inputer) processRoomEvent(
return event.EventID(), nil
}
func (r *Inputer) checkPowerLevels(
ctx context.Context, event gomatrixserverlib.Event,
) (isRejected bool, err error) {
req := &api.QueryLatestEventsAndStateRequest{RoomID: event.RoomID()}
resp := &api.QueryLatestEventsAndStateResponse{}
if err := helpers.QueryLatestEventsAndState(ctx, r.DB, req, resp); err != nil {
logrus.WithError(err).Error("helpers.QueryLatestEventsAndState failed to get latest events and state")
return true, err
}
var creator string
for _, v := range resp.StateEvents {
if v.Type() == gomatrixserverlib.MRoomCreate {
creator = v.Sender()
break
}
}
if event.Sender() != creator && r.ServerName != event.Origin() {
logrus.WithFields(logrus.Fields{
"event_id": event.EventID(),
"origin": event.Origin(),
"servername": r.ServerName,
}).Error("remote server is not allowed to set powerlevels, rejecting event")
return true, &gomatrixserverlib.NotAllowed{Message: "remote server is not allowed to set powerlevels"}
}
return false, nil
}
func (r *Inputer) calculateAndSetState(
ctx context.Context,
input *api.InputRoomEvent,