diff --git a/synapse/api/auth.py b/synapse/api/auth.py
index b4eda3df01..5d7c607702 100644
--- a/synapse/api/auth.py
+++ b/synapse/api/auth.py
@@ -19,7 +19,7 @@ from twisted.internet import defer
from synapse.api.constants import Membership, JoinRules
from synapse.api.errors import AuthError, StoreError, Codes
-from synapse.api.events.room import RoomMemberEvent
+from synapse.api.events.room import RoomMemberEvent, RoomPowerLevelsEvent
from synapse.util.logutils import log_function
import logging
@@ -67,6 +67,9 @@ class Auth(object):
else:
yield self._can_send_event(event)
+ if event.type == RoomPowerLevelsEvent.TYPE:
+ yield self._check_power_levels(event)
+
defer.returnValue(True)
else:
raise AuthError(500, "Unknown event: %s" % event)
@@ -172,7 +175,7 @@ class Auth(object):
if kick_level:
kick_level = int(kick_level)
else:
- kick_level = 5
+ kick_level = 50
if user_level < kick_level:
raise AuthError(
@@ -189,7 +192,7 @@ class Auth(object):
if ban_level:
ban_level = int(ban_level)
else:
- ban_level = 5 # FIXME (erikj): What should we do here?
+ ban_level = 50 # FIXME (erikj): What should we do here?
if user_level < ban_level:
raise AuthError(403, "You don't have permission to ban")
@@ -315,3 +318,71 @@ class Auth(object):
403,
"You don't have permission to change that state"
)
+
+ @defer.inlineCallbacks
+ def _check_power_levels(self, event):
+ current_state = yield self.store.get_current_state(
+ event.room_id,
+ event.type,
+ event.state_key,
+ )
+
+ user_level = yield self.store.get_power_level(
+ event.room_id,
+ event.user_id,
+ )
+
+ if user_level:
+ user_level = int(user_level)
+ else:
+ user_level = 0
+
+ old_list = current_state.content
+
+ # FIXME (erikj)
+ old_people = {k: v for k, v in old_list.items() if k.startswith("@")}
+ new_people = {k: v for k, v in event.content if k.startswith("@")}
+
+ removed = set(old_people.keys()) - set(new_people.keys())
+ added = set(old_people.keys()) - set(new_people.keys())
+ same = set(old_people.keys()) & set(new_people.keys())
+
+ for r in removed:
+ if int(old_list.content[r]) > user_level:
+ raise AuthError(
+ 403,
+ "You don't have permission to change that state"
+ )
+
+ for n in new_people:
+ if int(event.content[n]) > user_level:
+ raise AuthError(
+ 403,
+ "You don't have permission to change that state"
+ )
+
+ for s in same:
+ if int(event.content[s]) != int(old_list[s]):
+ if int(old_list[s]) > user_level:
+ raise AuthError(
+ 403,
+ "You don't have permission to change that state"
+ )
+
+ if "default" in old_list:
+ old_default = int(old_list["default"])
+
+ if old_default > user_level:
+ raise AuthError(
+ 403,
+ "You don't have permission to change that state"
+ )
+
+ if "default" in event.content:
+ new_default = int(event.content["default"])
+
+ if new_default > user_level:
+ raise AuthError(
+ 403,
+ "You don't have permission to change that state"
+ )
diff --git a/synapse/handlers/room.py b/synapse/handlers/room.py
index 8171e9eb45..171ca3d797 100644
--- a/synapse/handlers/room.py
+++ b/synapse/handlers/room.py
@@ -132,7 +132,7 @@ class RoomCreationHandler(BaseRoomHandler):
etype=RoomNameEvent.TYPE,
room_id=room_id,
user_id=user_id,
- required_power_level=5,
+ required_power_level=50,
content={"name": name},
)
@@ -143,7 +143,7 @@ class RoomCreationHandler(BaseRoomHandler):
etype=RoomNameEvent.TYPE,
room_id=room_id,
user_id=user_id,
- required_power_level=5,
+ required_power_level=50,
content={"name": name},
)
@@ -155,7 +155,7 @@ class RoomCreationHandler(BaseRoomHandler):
etype=RoomTopicEvent.TYPE,
room_id=room_id,
user_id=user_id,
- required_power_level=5,
+ required_power_level=50,
content={"topic": topic},
)
@@ -186,7 +186,7 @@ class RoomCreationHandler(BaseRoomHandler):
event_keys = {
"room_id": room_id,
"user_id": creator.to_string(),
- "required_power_level": 10,
+ "required_power_level": 100,
}
def create(etype, **content):
@@ -203,7 +203,7 @@ class RoomCreationHandler(BaseRoomHandler):
power_levels_event = self.event_factory.create_event(
etype=RoomPowerLevelsEvent.TYPE,
- content={creator.to_string(): 10, "default": 0},
+ content={creator.to_string(): 100, "default": 0},
**event_keys
)
@@ -215,7 +215,7 @@ class RoomCreationHandler(BaseRoomHandler):
add_state_event = create(
etype=RoomAddStateLevelEvent.TYPE,
- level=10,
+ level=100,
)
send_event = create(
@@ -225,8 +225,8 @@ class RoomCreationHandler(BaseRoomHandler):
ops = create(
etype=RoomOpsPowerLevelsEvent.TYPE,
- ban_level=5,
- kick_level=5,
+ ban_level=50,
+ kick_level=50,
)
return [
diff --git a/synapse/rest/login.py b/synapse/rest/login.py
index c7bf901c8e..ba49afcaa7 100644
--- a/synapse/rest/login.py
+++ b/synapse/rest/login.py
@@ -70,7 +70,7 @@ class LoginFallbackRestServlet(RestServlet):
def on_GET(self, request):
# TODO(kegan): This should be returning some HTML which is capable of
# hitting LoginRestServlet
- return (200, "")
+ return (200, {})
def _parse_json(request):
diff --git a/synapse/rest/profile.py b/synapse/rest/profile.py
index 2e17f87fa1..dad5a208c7 100644
--- a/synapse/rest/profile.py
+++ b/synapse/rest/profile.py
@@ -51,7 +51,7 @@ class ProfileDisplaynameRestServlet(RestServlet):
yield self.handlers.profile_handler.set_displayname(
user, auth_user, new_name)
- defer.returnValue((200, ""))
+ defer.returnValue((200, {}))
def on_OPTIONS(self, request, user_id):
return (200, {})
@@ -86,7 +86,7 @@ class ProfileAvatarURLRestServlet(RestServlet):
yield self.handlers.profile_handler.set_avatar_url(
user, auth_user, new_name)
- defer.returnValue((200, ""))
+ defer.returnValue((200, {}))
def on_OPTIONS(self, request, user_id):
return (200, {})
diff --git a/synapse/rest/room.py b/synapse/rest/room.py
index 308b447090..cef700c81c 100644
--- a/synapse/rest/room.py
+++ b/synapse/rest/room.py
@@ -154,14 +154,14 @@ class RoomStateEventRestServlet(RestServlet):
# membership events are special
handler = self.handlers.room_member_handler
yield handler.change_membership(event)
- defer.returnValue((200, ""))
+ defer.returnValue((200, {}))
else:
# store random bits of state
msg_handler = self.handlers.message_handler
yield msg_handler.store_room_data(
event=event
)
- defer.returnValue((200, ""))
+ defer.returnValue((200, {}))
# TODO: Needs unit testing for generic events + feedback
@@ -249,7 +249,7 @@ class JoinRoomAliasServlet(RestServlet):
)
handler = self.handlers.room_member_handler
yield handler.change_membership(event)
- defer.returnValue((200, ""))
+ defer.returnValue((200, {}))
@defer.inlineCallbacks
def on_PUT(self, request, room_identifier, txn_id):
@@ -416,7 +416,7 @@ class RoomMembershipRestServlet(RestServlet):
)
handler = self.handlers.room_member_handler
yield handler.change_membership(event)
- defer.returnValue((200, ""))
+ defer.returnValue((200, {}))
@defer.inlineCallbacks
def on_PUT(self, request, room_id, membership_action, txn_id):
|
