diff options
| author | Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> | 2020-01-24 14:28:40 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-01-24 14:28:40 +0000 |
| commit | 9f7aaf90b5ef76416852f35201a851d45eccc0a1 (patch) | |
| tree | 642300537a9e9ea2d61000318c5fddbb1f378785 /synapse/handlers/identity.py | |
| parent | Make 'event.redacts' never raise. (#6771) (diff) | |
| download | synapse-9f7aaf90b5ef76416852f35201a851d45eccc0a1.tar.xz | |
Validate client_secret parameter (#6767)
Diffstat (limited to 'synapse/handlers/identity.py')
| -rw-r--r-- | synapse/handlers/identity.py | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/synapse/handlers/identity.py b/synapse/handlers/identity.py index 000fbf090f..23f07832e7 100644 --- a/synapse/handlers/identity.py +++ b/synapse/handlers/identity.py @@ -38,7 +38,7 @@ from synapse.api.errors import ( from synapse.config.emailconfig import ThreepidBehaviour from synapse.http.client import SimpleHttpClient from synapse.util.hash import sha256_and_url_safe_base64 -from synapse.util.stringutils import random_string +from synapse.util.stringutils import assert_valid_client_secret, random_string from ._base import BaseHandler @@ -84,6 +84,8 @@ class IdentityHandler(BaseHandler): raise SynapseError( 400, "Missing param client_secret in creds", errcode=Codes.MISSING_PARAM ) + assert_valid_client_secret(client_secret) + session_id = creds.get("sid") if not session_id: raise SynapseError( |