summary refs log tree commit diff
path: root/synapse/rest/client
diff options
context:
space:
mode:
authorreivilibre <oliverw@matrix.org>2023-02-14 15:50:59 +0000
committerGitHub <noreply@github.com>2023-02-14 15:50:59 +0000
commite9b1ff9f31f8ff093e7eaf9c54fa8f40a3b66aa8 (patch)
tree5fcff311aee38825d5a4eabf94bbc64f5efde7cf /synapse/rest/client
parentMerge branch 'master' into develop (diff)
downloadsynapse-e9b1ff9f31f8ff093e7eaf9c54fa8f40a3b66aa8.tar.xz
Prevent clients from reporting nonexistent events. (#13779)
Diffstat (limited to 'synapse/rest/client')
-rw-r--r--synapse/rest/client/report_event.py11
1 files changed, 10 insertions, 1 deletions
diff --git a/synapse/rest/client/report_event.py b/synapse/rest/client/report_event.py
index e2b410cf32..9be5860221 100644
--- a/synapse/rest/client/report_event.py
+++ b/synapse/rest/client/report_event.py
@@ -16,7 +16,7 @@ import logging
 from http import HTTPStatus
 from typing import TYPE_CHECKING, Tuple
 
-from synapse.api.errors import Codes, SynapseError
+from synapse.api.errors import Codes, NotFoundError, SynapseError
 from synapse.http.server import HttpServer
 from synapse.http.servlet import RestServlet, parse_json_object_from_request
 from synapse.http.site import SynapseRequest
@@ -39,6 +39,7 @@ class ReportEventRestServlet(RestServlet):
         self.auth = hs.get_auth()
         self.clock = hs.get_clock()
         self.store = hs.get_datastores().main
+        self._event_handler = self.hs.get_event_handler()
 
     async def on_POST(
         self, request: SynapseRequest, room_id: str, event_id: str
@@ -61,6 +62,14 @@ class ReportEventRestServlet(RestServlet):
                 Codes.BAD_JSON,
             )
 
+        event = await self._event_handler.get_event(
+            requester.user, room_id, event_id, show_redacted=False
+        )
+        if event is None:
+            raise NotFoundError(
+                "Unable to report event: it does not exist or you aren't able to see it."
+            )
+
         await self.store.add_event_report(
             room_id=room_id,
             event_id=event_id,