summary refs log tree commit diff
path: root/synapse/rest/client/relations.py
diff options
context:
space:
mode:
authorPatrick Cloke <clokep@users.noreply.github.com>2021-12-09 13:16:01 -0500
committerGitHub <noreply@github.com>2021-12-09 13:16:01 -0500
commit3b8872299aac25a7e3ee5a9e00564105aa6de237 (patch)
tree80cfc0e00093d60a421c9250fe2002c5d8268b16 /synapse/rest/client/relations.py
parentAdditional type hints for the config module, part 2. (#11480) (diff)
downloadsynapse-3b8872299aac25a7e3ee5a9e00564105aa6de237.tar.xz
Do not allow cross-room relations, per MSC2674. (#11516)
Diffstat (limited to 'synapse/rest/client/relations.py')
-rw-r--r--synapse/rest/client/relations.py7
1 files changed, 6 insertions, 1 deletions
diff --git a/synapse/rest/client/relations.py b/synapse/rest/client/relations.py
index fc4e6921c5..ffa37ef06c 100644
--- a/synapse/rest/client/relations.py
+++ b/synapse/rest/client/relations.py
@@ -212,6 +212,7 @@ class RelationPaginationServlet(RestServlet):
 
             pagination_chunk = await self.store.get_relations_for_event(
                 event_id=parent_id,
+                room_id=room_id,
                 relation_type=relation_type,
                 event_type=event_type,
                 limit=limit,
@@ -317,6 +318,7 @@ class RelationAggregationPaginationServlet(RestServlet):
 
             pagination_chunk = await self.store.get_aggregation_groups_for_event(
                 event_id=parent_id,
+                room_id=room_id,
                 event_type=event_type,
                 limit=limit,
                 from_token=from_token,
@@ -383,7 +385,9 @@ class RelationAggregationGroupPaginationServlet(RestServlet):
 
         # This checks that a) the event exists and b) the user is allowed to
         # view it.
-        await self.event_handler.get_event(requester.user, room_id, parent_id)
+        event = await self.event_handler.get_event(requester.user, room_id, parent_id)
+        if event is None:
+            raise SynapseError(404, "Unknown parent event.")
 
         if relation_type != RelationTypes.ANNOTATION:
             raise SynapseError(400, "Relation type must be 'annotation'")
@@ -402,6 +406,7 @@ class RelationAggregationGroupPaginationServlet(RestServlet):
 
         result = await self.store.get_relations_for_event(
             event_id=parent_id,
+            room_id=room_id,
             relation_type=relation_type,
             event_type=event_type,
             aggregation_key=key,