summary refs log tree commit diff
path: root/synapse/rest/client/room_batch.py
diff options
context:
space:
mode:
authorEric Eastwood <erice@element.io>2021-09-15 03:34:30 -0500
committerGitHub <noreply@github.com>2021-09-15 09:34:30 +0100
commit145c006ef76ab3955fb8294203cb8e6e61372cd1 (patch)
treebb0c5ca3922282dffca25464bd712acecbd1dbd8 /synapse/rest/client/room_batch.py
parentSplit out `/batch_send` meta events to their own fields (MSC2716) (#10777) (diff)
downloadsynapse-145c006ef76ab3955fb8294203cb8e6e61372cd1.tar.xz
Verify `?chunk_id` actually corresponds to an insertion event that exists (MSC2716) (#10776)
Diffstat (limited to 'synapse/rest/client/room_batch.py')
-rw-r--r--synapse/rest/client/room_batch.py13
1 files changed, 12 insertions, 1 deletions
diff --git a/synapse/rest/client/room_batch.py b/synapse/rest/client/room_batch.py
index 783fecf194..d466edeec2 100644
--- a/synapse/rest/client/room_batch.py
+++ b/synapse/rest/client/room_batch.py
@@ -300,7 +300,18 @@ class RoomBatchSendEventRestServlet(RestServlet):
             #  event, which causes the HS to ask for the state at the start of
             #  the chunk later.
             prev_event_ids = [fake_prev_event_id]
-            # TODO: Verify the chunk_id_from_query corresponds to an insertion event
+
+            # Verify the chunk_id_from_query corresponds to an actual insertion event
+            # and have the chunk connected.
+            corresponding_insertion_event_id = (
+                await self.store.get_insertion_event_by_chunk_id(chunk_id_from_query)
+            )
+            if corresponding_insertion_event_id is None:
+                raise SynapseError(
+                    400,
+                    "No insertion event corresponds to the given ?chunk_id",
+                    errcode=Codes.INVALID_PARAM,
+                )
             pass
         # Otherwise, create an insertion event to act as a starting point.
         #