Merge pull request #596 from Rugvip/create

handlers/_base: don't allow room create event to be changed

1 files changed, 6 insertions, 0 deletions

diff --git a/synapse/handlers/_base.py b/synapse/handlers/_base.py

index c6a74b0e3d..4d9787c1a8 100644
--- a/synapse/handlers/_base.py
+++ b/synapse/handlers/_base.py
@@ -374,6 +374,12 @@ class BaseHandler(object):
                         "You don't have permission to redact events"
                     )
 
+        if event.type == EventTypes.Create and context.current_state:
+            raise AuthError(
+                403,
+                "Changing the room create event is forbidden",
+            )
+
         action_generator = ActionGenerator(self.hs)
         yield action_generator.handle_push_actions_for_event(
             event, context, self