diff options
| author | Patrick Cloke <clokep@users.noreply.github.com> | 2021-12-09 13:16:01 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-12-09 13:16:01 -0500 |
| commit | 3b8872299aac25a7e3ee5a9e00564105aa6de237 (patch) | |
| tree | 80cfc0e00093d60a421c9250fe2002c5d8268b16 /synapse/rest/client | |
| parent | Additional type hints for the config module, part 2. (#11480) (diff) | |
| download | synapse-3b8872299aac25a7e3ee5a9e00564105aa6de237.tar.xz | |
Do not allow cross-room relations, per MSC2674. (#11516)
Diffstat (limited to 'synapse/rest/client')
| -rw-r--r-- | synapse/rest/client/relations.py | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/synapse/rest/client/relations.py b/synapse/rest/client/relations.py index fc4e6921c5..ffa37ef06c 100644 --- a/synapse/rest/client/relations.py +++ b/synapse/rest/client/relations.py @@ -212,6 +212,7 @@ class RelationPaginationServlet(RestServlet): pagination_chunk = await self.store.get_relations_for_event( event_id=parent_id, + room_id=room_id, relation_type=relation_type, event_type=event_type, limit=limit, @@ -317,6 +318,7 @@ class RelationAggregationPaginationServlet(RestServlet): pagination_chunk = await self.store.get_aggregation_groups_for_event( event_id=parent_id, + room_id=room_id, event_type=event_type, limit=limit, from_token=from_token, @@ -383,7 +385,9 @@ class RelationAggregationGroupPaginationServlet(RestServlet): # This checks that a) the event exists and b) the user is allowed to # view it. - await self.event_handler.get_event(requester.user, room_id, parent_id) + event = await self.event_handler.get_event(requester.user, room_id, parent_id) + if event is None: + raise SynapseError(404, "Unknown parent event.") if relation_type != RelationTypes.ANNOTATION: raise SynapseError(400, "Relation type must be 'annotation'") @@ -402,6 +406,7 @@ class RelationAggregationGroupPaginationServlet(RestServlet): result = await self.store.get_relations_for_event( event_id=parent_id, + room_id=room_id, relation_type=relation_type, event_type=event_type, aggregation_key=key, |