Check provided user's domain matches our own.

This commit is contained in:
Andrew (anoa) 2017-11-04 22:08:16 -07:00
parent 3f4cf27b5c
commit f62285a126
No known key found for this signature in database
GPG key ID: 174BEAB009FD176D
2 changed files with 8 additions and 2 deletions

View file

@ -21,6 +21,7 @@ import (
"github.com/matrix-org/dendrite/clientapi/httputil" "github.com/matrix-org/dendrite/clientapi/httputil"
"github.com/matrix-org/dendrite/clientapi/jsonerror" "github.com/matrix-org/dendrite/clientapi/jsonerror"
"github.com/matrix-org/dendrite/common" "github.com/matrix-org/dendrite/common"
"github.com/matrix-org/dendrite/common/config"
"github.com/matrix-org/gomatrixserverlib" "github.com/matrix-org/gomatrixserverlib"
"github.com/matrix-org/util" "github.com/matrix-org/util"
) )
@ -29,6 +30,7 @@ import (
func GetProfile( func GetProfile(
httpReq *http.Request, httpReq *http.Request,
accountDB *accounts.Database, accountDB *accounts.Database,
cfg config.Dendrite,
) util.JSONResponse { ) util.JSONResponse {
userID, field := httpReq.FormValue("user_id"), httpReq.FormValue("field") userID, field := httpReq.FormValue("user_id"), httpReq.FormValue("field")
@ -40,11 +42,15 @@ func GetProfile(
} }
} }
localpart, _, err := gomatrixserverlib.SplitID('@', userID) localpart, domain, err := gomatrixserverlib.SplitID('@', userID)
if err != nil { if err != nil {
return httputil.LogThenError(httpReq, err) return httputil.LogThenError(httpReq, err)
} }
if domain != cfg.Matrix.ServerName {
return httputil.LogThenError(httpReq, err)
}
profile, err := accountDB.GetProfileByLocalpart(httpReq.Context(), localpart) profile, err := accountDB.GetProfileByLocalpart(httpReq.Context(), localpart)
if err != nil { if err != nil {
return httputil.LogThenError(httpReq, err) return httputil.LogThenError(httpReq, err)

View file

@ -109,7 +109,7 @@ func Setup(
"federation_query_profile", cfg.Matrix.ServerName, keys, "federation_query_profile", cfg.Matrix.ServerName, keys,
func(httpReq *http.Request, request *gomatrixserverlib.FederationRequest) util.JSONResponse { func(httpReq *http.Request, request *gomatrixserverlib.FederationRequest) util.JSONResponse {
return GetProfile( return GetProfile(
httpReq, accountDB, httpReq, accountDB, cfg,
) )
}, },
)).Methods("GET") )).Methods("GET")