Only return state events that the AS passed in via `state_events_at_start` (MSC2716) (#10552)

* Only return state events that the AS passed in via state_events_at_start

As discovered by @Half-Shot in
https://github.com/matrix-org/matrix-doc/pull/2716#discussion_r684158448

Part of MSC2716

* Add changelog

* Fix changelog extension

1 files changed, 3 insertions, 1 deletions

diff --git a/synapse/rest/client/v1/room.py b/synapse/rest/client/v1/room.py

index b28b72bfbd..f1bc43be2d 100644
--- a/synapse/rest/client/v1/room.py
+++ b/synapse/rest/client/v1/room.py
@@ -437,6 +437,7 @@ class RoomBatchSendEventRestServlet(TransactionRestServlet):
         prev_state_ids = list(prev_state_map.values())
         auth_event_ids = prev_state_ids
 
+        state_events_at_start = []
         for state_event in body["state_events_at_start"]:
             assert_params_in_dict(
                 state_event, ["type", "origin_server_ts", "content", "sender"]
@@ -502,6 +503,7 @@ class RoomBatchSendEventRestServlet(TransactionRestServlet):
                 )
                 event_id = event.event_id
 
+            state_events_at_start.append(event_id)
             auth_event_ids.append(event_id)
 
         events_to_create = body["events"]
@@ -651,7 +653,7 @@ class RoomBatchSendEventRestServlet(TransactionRestServlet):
             event_ids.append(base_insertion_event.event_id)
 
         return 200, {
-            "state_events": auth_event_ids,
+            "state_events": state_events_at_start,
             "events": event_ids,
             "next_chunk_id": insertion_event["content"][
                 EventContentFields.MSC2716_NEXT_CHUNK_ID