From fdd2b59433e0b3cd05959804c917107182a26e0c Mon Sep 17 00:00:00 2001
From: Brendan Abolivier <contact@brendanabolivier.com>
Date: Wed, 13 Sep 2017 13:12:38 +0100
Subject: [PATCH] Add check on invited server

---
 .../federationapi/writers/threepid.go         | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/src/github.com/matrix-org/dendrite/federationapi/writers/threepid.go b/src/github.com/matrix-org/dendrite/federationapi/writers/threepid.go
index 22c61d911..8215e1df9 100644
--- a/src/github.com/matrix-org/dendrite/federationapi/writers/threepid.go
+++ b/src/github.com/matrix-org/dendrite/federationapi/writers/threepid.go
@@ -51,7 +51,10 @@ type invites struct {
 	Invites []invite `json:"invites"`
 }
 
-var errNotInRoom = errors.New("the server isn't currently in the room")
+var (
+	errNotLocalUser = errors.New("the user is not from this server")
+	errNotInRoom    = errors.New("the server isn't currently in the room")
+)
 
 // CreateInvitesFrom3PIDInvites implements POST /_matrix/federation/v1/3pid/onbind
 func CreateInvitesFrom3PIDInvites(
@@ -169,6 +172,15 @@ func createInviteFrom3PIDInvite(
 	inv invite, federation *gomatrixserverlib.FederationClient,
 	accountDB *accounts.Database,
 ) (*gomatrixserverlib.Event, error) {
+	localpart, server, err := gomatrixserverlib.SplitID('@', inv.MXID)
+	if err != nil {
+		return nil, err
+	}
+
+	if server != cfg.Matrix.ServerName {
+		return nil, errNotLocalUser
+	}
+
 	// Build the event
 	builder := &gomatrixserverlib.EventBuilder{
 		Type:     "m.room.member",
@@ -177,11 +189,6 @@ func createInviteFrom3PIDInvite(
 		StateKey: &inv.MXID,
 	}
 
-	localpart, _, err := gomatrixserverlib.SplitID('@', *builder.StateKey)
-	if err != nil {
-		return nil, err
-	}
-
 	profile, err := accountDB.GetProfileByLocalpart(localpart)
 	if err != nil {
 		return nil, err