diff options
| author | Richard van der Hoff <1389908+richvdh@users.noreply.github.com> | 2020-07-16 15:17:31 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-07-16 15:17:31 +0100 |
| commit | 346476df211a36d008d23990fc53fffc34a1a0d9 (patch) | |
| tree | 347d42184f7b04ee2a120910adec38dddbdcc9ca | |
| parent | Allow moving typing off master (#7869) (diff) | |
| download | synapse-346476df211a36d008d23990fc53fffc34a1a0d9.tar.xz | |
Reject attempts to join empty rooms over federation (#7859)
We shouldn't allow others to make_join through us if we've left the room; reject such attempts with a 404. Fixes #7835. Fixes #6958.
| -rw-r--r-- | changelog.d/7859.bugfix | 1 | ||||
| -rw-r--r-- | synapse/handlers/federation.py | 15 |
2 files changed, 14 insertions, 2 deletions
diff --git a/changelog.d/7859.bugfix b/changelog.d/7859.bugfix new file mode 100644 index 0000000000..19cff4b061 --- /dev/null +++ b/changelog.d/7859.bugfix @@ -0,0 +1 @@ +Fix a bug which allowed empty rooms to be rejoined over federation. diff --git a/synapse/handlers/federation.py b/synapse/handlers/federation.py index e43bccd721..df885e45e8 100644 --- a/synapse/handlers/federation.py +++ b/synapse/handlers/federation.py @@ -44,6 +44,7 @@ from synapse.api.errors import ( FederationDeniedError, FederationError, HttpResponseException, + NotFoundError, RequestSendFailed, SynapseError, ) @@ -1439,10 +1440,20 @@ class FederationHandler(BaseHandler): ) raise SynapseError(403, "User not from origin", Codes.FORBIDDEN) - event_content = {"membership": Membership.JOIN} - + # checking the room version will check that we've actually heard of the room + # (and return a 404 otherwise) room_version = await self.store.get_room_version_id(room_id) + # now check that we are *still* in the room + is_in_room = await self.auth.check_host_in_room(room_id, self.server_name) + if not is_in_room: + logger.info( + "Got /make_join request for room %s we are no longer in", room_id, + ) + raise NotFoundError("Not an active room on this server") + + event_content = {"membership": Membership.JOIN} + builder = self.event_builder_factory.new( room_version, { |