diff options
| -rw-r--r-- | synapse/api/auth.py | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/synapse/api/auth.py b/synapse/api/auth.py index 29b4ac456c..e05defd7d8 100644 --- a/synapse/api/auth.py +++ b/synapse/api/auth.py @@ -115,6 +115,17 @@ class Auth(object): # FIXME: Temp hack if event.type == EventTypes.Aliases: + if not event.state_key: + raise AuthError( + 403, + "Alias event must have non-empty state_key" + ) + sender_domain = get_domain_from_id(event.sender) + if event.state_key != sender_domain: + raise AuthError( + 403, + "Alias event's state_key does not match sender's domain" + ) return True logger.debug( |