diff options
| author | Richard van der Hoff <richard@matrix.org> | 2018-08-02 15:03:27 +0100 |
|---|---|---|
| committer | Richard van der Hoff <richard@matrix.org> | 2018-08-02 15:03:27 +0100 |
| commit | 0bf5ec0db700f189ba36360ea8424d9761658905 (patch) | |
| tree | 19c355260737f534fcb992a1eab3a99f41825553 /synapse/rest | |
| parent | changelog (diff) | |
| download | synapse-0bf5ec0db700f189ba36360ea8424d9761658905.tar.xz | |
Check room visibility for /event/ requests
Make sure that the user has permission to view the requeseted event for
/event/{eventId} and /room/{roomId}/event/{eventId} requests.
Also check that the event is in the given room for
/room/{roomId}/event/{eventId}, for sanity.
Diffstat (limited to 'synapse/rest')
| -rw-r--r-- | synapse/rest/client/v1/events.py | 2 | ||||
| -rw-r--r-- | synapse/rest/client/v1/room.py | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/synapse/rest/client/v1/events.py b/synapse/rest/client/v1/events.py index b70c9c2806..0f3a2e8b51 100644 --- a/synapse/rest/client/v1/events.py +++ b/synapse/rest/client/v1/events.py @@ -88,7 +88,7 @@ class EventRestServlet(ClientV1RestServlet): @defer.inlineCallbacks def on_GET(self, request, event_id): requester = yield self.auth.get_user_by_req(request) - event = yield self.event_handler.get_event(requester.user, event_id) + event = yield self.event_handler.get_event(requester.user, None, event_id) time_now = self.clock.time_msec() if event: diff --git a/synapse/rest/client/v1/room.py b/synapse/rest/client/v1/room.py index 3d62447854..2a679ac830 100644 --- a/synapse/rest/client/v1/room.py +++ b/synapse/rest/client/v1/room.py @@ -508,7 +508,7 @@ class RoomEventServlet(ClientV1RestServlet): @defer.inlineCallbacks def on_GET(self, request, room_id, event_id): requester = yield self.auth.get_user_by_req(request) - event = yield self.event_handler.get_event(requester.user, event_id) + event = yield self.event_handler.get_event(requester.user, room_id, event_id) time_now = self.clock.time_msec() if event: |