summary refs log tree commit diff
path: root/synapse/api/auth.py
diff options
context:
space:
mode:
authorMark Haines <mjark@negativecurvature.net>2016-01-04 14:02:50 +0000
committerMark Haines <mjark@negativecurvature.net>2016-01-04 14:02:50 +0000
commitf35f8d06ea58e2d0cdccd82924c7a44fd93f4c38 (patch)
treedc5312558565f8ac01264be21d388e563a5c8c58 /synapse/api/auth.py
parentAdded info abou Martin Giess' auto-deployment process with vagrant/ansible (diff)
parentBump changelog and version for v0.12.0 (diff)
downloadsynapse-f35f8d06ea58e2d0cdccd82924c7a44fd93f4c38.tar.xz
Merge remote-tracking branch 'origin/release-v0.12.0' v0.12.0
Diffstat (limited to 'synapse/api/auth.py')
-rw-r--r--synapse/api/auth.py11
1 files changed, 9 insertions, 2 deletions
diff --git a/synapse/api/auth.py b/synapse/api/auth.py
index 4a13f7e2e1..adb7d64482 100644
--- a/synapse/api/auth.py
+++ b/synapse/api/auth.py
@@ -207,6 +207,13 @@ class Auth(object):
                 user_id, room_id
             ))
 
+        if membership == Membership.LEAVE:
+            forgot = yield self.store.did_forget(user_id, room_id)
+            if forgot:
+                raise AuthError(403, "User %s not in room %s" % (
+                    user_id, room_id
+                ))
+
         defer.returnValue(member)
 
     @defer.inlineCallbacks
@@ -771,7 +778,7 @@ class Auth(object):
                 if "third_party_invite" in event.content:
                     key = (
                         EventTypes.ThirdPartyInvite,
-                        event.content["third_party_invite"]["token"]
+                        event.content["third_party_invite"]["signed"]["token"]
                     )
                     third_party_invite = current_state.get(key)
                     if third_party_invite:
@@ -853,7 +860,7 @@ class Auth(object):
 
         redact_level = self._get_named_level(auth_events, "redact", 50)
 
-        if user_level > redact_level:
+        if user_level >= redact_level:
             return False
 
         redacter_domain = EventID.from_string(event.event_id).domain