Check room exists when authenticating an event, by asserting they reference a creation event

1 files changed, 8 insertions, 0 deletions

diff --git a/synapse/api/auth.py b/synapse/api/auth.py
index 65ee1452ce..410f4c11e7 100644
--- a/synapse/api/auth.py
+++ b/synapse/api/auth.py
@@ -65,6 +65,14 @@ class Auth(object):
                 # FIXME
                 return True
 
+            creation_event = auth_events.get((EventTypes.Create, ""), None)
+
+            if not creation_event:
+                raise SynapseError(
+                    400,
+                    "Room %r does not exist" % (event.room_id,)
+                )
+
             # FIXME: Temp hack
             if event.type == EventTypes.Aliases:
                 return True