summary refs log tree commit diff
diff options
context:
space:
mode:
authorMatthew Hodgson <matthew@arasphere.net>2016-06-02 13:47:40 +0100
committerMatthew Hodgson <matthew@arasphere.net>2016-06-02 13:47:40 +0100
commitc5af1b6b000fe538e587c88d31bb9ad49ce3a9da (patch)
tree5a427c87719876c19b9d09817fc0a28d90b7b34e
parentif an email pusher specifies a brand param, use it (diff)
parentspecial case m.room.third_party_invite event auth to match invites, otherwise... (diff)
downloadsynapse-c5af1b6b000fe538e587c88d31bb9ad49ce3a9da.tar.xz
Merge pull request #814 from matrix-org/matthew/3pid_invite_auth
special case m.room.third_party_invite event auth to match invites,
-rw-r--r--synapse/api/auth.py18
1 files changed, 18 insertions, 0 deletions
diff --git a/synapse/api/auth.py b/synapse/api/auth.py
index 2474a1453b..007a0998a7 100644
--- a/synapse/api/auth.py
+++ b/synapse/api/auth.py
@@ -120,6 +120,24 @@ class Auth(object):
                 return allowed
 
             self.check_event_sender_in_room(event, auth_events)
+
+            # Special case to allow m.room.third_party_invite events wherever
+            # a user is allowed to issue invites.  Fixes
+            # https://github.com/vector-im/vector-web/issues/1208 hopefully
+            if event.type == EventTypes.ThirdPartyInvite:
+                user_level = self._get_user_power_level(event.user_id, auth_events)
+                invite_level = self._get_named_level(auth_events, "invite", 0)
+
+                if user_level < invite_level:
+                    raise AuthError(
+                        403, (
+                            "You cannot issue a third party invite for %s." %
+                            (event.content.display_name,)
+                        )
+                    )
+                else:
+                    return True
+
             self._can_send_event(event, auth_events)
 
             if event.type == EventTypes.PowerLevels: