summary refs log tree commit diff
path: root/synapse/rest/client/v1
diff options
context:
space:
mode:
authorKegan Dougal <kegan@matrix.org>2015-07-20 13:55:19 +0100
committerKegan Dougal <kegan@matrix.org>2015-07-20 13:55:19 +0100
commitb6ee0585bd0329e1841196b8e8a893630e1850d6 (patch)
treeff4f0d2ecb2d930e7feb1145dc70ed53f5c5e27e /synapse/rest/client/v1
parentUp default cache size for _RoomStreamChangeCache (diff)
downloadsynapse-b6ee0585bd0329e1841196b8e8a893630e1850d6.tar.xz
Parse the ID given to /invite|ban|kick to make sure it looks like a user ID.
Diffstat (limited to 'synapse/rest/client/v1')
-rw-r--r--synapse/rest/client/v1/room.py2
1 files changed, 2 insertions, 0 deletions
diff --git a/synapse/rest/client/v1/room.py b/synapse/rest/client/v1/room.py
index 0346afb1b4..639795df28 100644
--- a/synapse/rest/client/v1/room.py
+++ b/synapse/rest/client/v1/room.py
@@ -412,6 +412,8 @@ class RoomMembershipRestServlet(ClientV1RestServlet):
             if "user_id" not in content:
                 raise SynapseError(400, "Missing user_id key.")
             state_key = content["user_id"]
+            # make sure it looks like a user ID; it'll throw if it's invalid.
+            UserID.from_string(state_key);
 
             if membership_action == "kick":
                 membership_action = "leave"