diff options
| author | reivilibre <oliverw@matrix.org> | 2023-11-09 20:18:25 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-11-09 20:18:25 +0000 |
| commit | dc7f068d9ce9d2be775565f5f1eb964d30a64bb3 (patch) | |
| tree | ade5121a99a81d963ee20390738d270c8fe9b64a | |
| parent | Use dbname instead of database for Postgres config. (#16618) (diff) | |
| download | synapse-dc7f068d9ce9d2be775565f5f1eb964d30a64bb3.tar.xz | |
Fix a long-standing bug where Synapse would not unbind third-party identifiers for Application Service users when deactivated and would not emit a compliant response. (#16617)
* Don't skip unbinding 3PIDs and returning success status when deactivating AS user Fixes #16608 * Newsfile Signed-off-by: Olivier Wilkinson (reivilibre) <oliverw@matrix.org> --------- Signed-off-by: Olivier Wilkinson (reivilibre) <oliverw@matrix.org>
| -rw-r--r-- | changelog.d/16617.bugfix | 1 | ||||
| -rw-r--r-- | synapse/rest/client/account.py | 19 |
2 files changed, 9 insertions, 11 deletions
diff --git a/changelog.d/16617.bugfix b/changelog.d/16617.bugfix new file mode 100644 index 0000000000..7e66799a6c --- /dev/null +++ b/changelog.d/16617.bugfix @@ -0,0 +1 @@ +Fix a long-standing bug where Synapse would not unbind third-party identifiers for Application Service users when deactivated and would not emit a compliant response. \ No newline at end of file diff --git a/synapse/rest/client/account.py b/synapse/rest/client/account.py index 641390cb30..0c0e82627d 100644 --- a/synapse/rest/client/account.py +++ b/synapse/rest/client/account.py @@ -299,19 +299,16 @@ class DeactivateAccountRestServlet(RestServlet): requester = await self.auth.get_user_by_req(request) - # allow ASes to deactivate their own users - if requester.app_service: - await self._deactivate_account_handler.deactivate_account( - requester.user.to_string(), body.erase, requester + # allow ASes to deactivate their own users: + # ASes don't need user-interactive auth + if not requester.app_service: + await self.auth_handler.validate_user_via_ui_auth( + requester, + request, + body.dict(exclude_unset=True), + "deactivate your account", ) - return 200, {} - await self.auth_handler.validate_user_via_ui_auth( - requester, - request, - body.dict(exclude_unset=True), - "deactivate your account", - ) result = await self._deactivate_account_handler.deactivate_account( requester.user.to_string(), body.erase, requester, id_server=body.id_server ) |