summary refs log tree commit diff
path: root/synapse
diff options
context:
space:
mode:
authorAndrew Morgan <1342360+anoadragon453@users.noreply.github.com>2019-09-23 16:38:38 +0200
committerRichard van der Hoff <1389908+richvdh@users.noreply.github.com>2019-09-23 15:38:38 +0100
commit1b519e0272a13649d442aad2a10c9a3b39c2d200 (patch)
tree7b3c3d5ef227e01fe67de92c0ca466747acba7c8 /synapse
parentGeneralize email sending logging (#6075) (diff)
downloadsynapse-1b519e0272a13649d442aad2a10c9a3b39c2d200.tar.xz
Disable /register/available if registration is disabled (#6082)
Fixes #6066

This register endpoint should be disabled if registration is disabled, otherwise we're giving anyone the ability to check if a username exists on a server when we don't need to be.

Error code is 403 (Forbidden) as that's the same returned by /register when registration is disabled.

Diffstat (limited to 'synapse')
-rw-r--r--synapse/rest/client/v2_alpha/register.py5
1 files changed, 5 insertions, 0 deletions
diff --git a/synapse/rest/client/v2_alpha/register.py b/synapse/rest/client/v2_alpha/register.py
index 34276ea3fa..e99b1f5c45 100644
--- a/synapse/rest/client/v2_alpha/register.py
+++ b/synapse/rest/client/v2_alpha/register.py
@@ -328,6 +328,11 @@ class UsernameAvailabilityRestServlet(RestServlet):
 
     @defer.inlineCallbacks
     def on_GET(self, request):
+        if not self.hs.config.enable_registration:
+            raise SynapseError(
+                403, "Registration has been disabled", errcode=Codes.FORBIDDEN
+            )
+
         ip = self.hs.get_ip_from_request(request)
         with self.ratelimiter.ratelimit(ip) as wait_deferred:
             yield wait_deferred