Also check the domains for membership state_keys

1 files changed, 9 insertions, 0 deletions

diff --git a/synapse/api/auth.py b/synapse/api/auth.py
index 90f11fdc94..944fbbf532 100644
--- a/synapse/api/auth.py
+++ b/synapse/api/auth.py
@@ -190,6 +190,15 @@ class Auth(object):
 
         target_user_id = event.state_key
 
+        creating_domain = RoomID.from_string(event.room_id).domain
+        target_domain = UserID.from_string(target_user_id).domain
+        if creating_domain != target_domain:
+            if not self.can_federate(event, auth_events):
+                raise AuthError(
+                    403,
+                    "This room has been marked as unfederatable."
+                )
+
         # get info about the caller
         key = (EventTypes.Member, event.user_id, )
         caller = auth_events.get(key)