diff options
| -rw-r--r-- | synapse/handlers/message.py | 38 | ||||
| -rw-r--r-- | tests/rest/test_rooms.py | 16 |
2 files changed, 12 insertions, 42 deletions
diff --git a/synapse/handlers/message.py b/synapse/handlers/message.py index 8394013df3..4da5c046bf 100644 --- a/synapse/handlers/message.py +++ b/synapse/handlers/message.py @@ -147,49 +147,19 @@ class MessageHandler(BaseHandler): @defer.inlineCallbacks def get_room_data(self, user_id=None, room_id=None, - event_type=None, state_key="", - public_room_rules=[], - private_room_rules=["join"]): + event_type=None, state_key=""): """ Get data from a room. Args: event : The room path event - public_room_rules : A list of membership states the user can be in, - in order to read this data IN A PUBLIC ROOM. An empty list means - 'any state'. - private_room_rules : A list of membership states the user can be - in, in order to read this data IN A PRIVATE ROOM. An empty list - means 'any state'. Returns: The path data content. Raises: SynapseError if something went wrong. """ - if event_type == RoomTopicEvent.TYPE: - # anyone invited/joined can read the topic - private_room_rules = ["invite", "join"] - - # does this room exist - room = yield self.store.get_room(room_id) - if not room: - raise RoomError(403, "Room does not exist.") - - # does this user exist in this room - member = yield self.store.get_room_member( - room_id=room_id, - user_id="" if not user_id else user_id) - - member_state = member.membership if member else None - - if room.is_public and public_room_rules: - # make sure the user meets public room rules - if member_state not in public_room_rules: - raise RoomError(403, "Member does not meet public room rules.") - elif not room.is_public and private_room_rules: - # make sure the user meets private room rules - if member_state not in private_room_rules: - raise RoomError( - 403, "Member does not meet private room rules.") + have_joined = yield self.auth.check_joined_room(room_id, user_id) + if not have_joined: + raise RoomError(403, "User not in room.") data = yield self.state_handler.get_current_state( room_id, event_type, state_key diff --git a/tests/rest/test_rooms.py b/tests/rest/test_rooms.py index 61b01d369d..e27990dace 100644 --- a/tests/rest/test_rooms.py +++ b/tests/rest/test_rooms.py @@ -230,9 +230,9 @@ class RoomPermissionsTestCase(RestTestCase): "PUT", topic_path, topic_content) self.assertEquals(403, code, msg=str(response)) - # get topic in created PRIVATE room and invited, expect 200 (or 404) + # get topic in created PRIVATE room and invited, expect 403 (code, response) = yield self.mock_resource.trigger_get(topic_path) - self.assertEquals(404, code, msg=str(response)) + self.assertEquals(403, code, msg=str(response)) # set/get topic in created PRIVATE room and joined, expect 200 yield self.join(room=self.created_rmid, user=self.user_id) @@ -256,10 +256,10 @@ class RoomPermissionsTestCase(RestTestCase): (code, response) = yield self.mock_resource.trigger_get(topic_path) self.assertEquals(403, code, msg=str(response)) - # get topic in PUBLIC room, not joined, expect 200 (or 404) + # get topic in PUBLIC room, not joined, expect 403 (code, response) = yield self.mock_resource.trigger_get( "/rooms/%s/state/m.room.topic" % self.created_public_rmid) - self.assertEquals(200, code, msg=str(response)) + self.assertEquals(403, code, msg=str(response)) # set topic in PUBLIC room, not joined, expect 403 (code, response) = yield self.mock_resource.trigger( @@ -326,12 +326,12 @@ class RoomPermissionsTestCase(RestTestCase): def test_membership_public_room_perms(self): room = self.created_public_rmid # get membership of self, get membership of other, public room + invite - # expect all 200s - public rooms, you can see who is in them. + # expect 403 yield self.invite(room=room, src=self.rmcreator_id, targ=self.user_id) yield self._test_get_membership( members=[self.user_id, self.rmcreator_id], - room=room, expect_code=200) + room=room, expect_code=403) # get membership of self, get membership of other, public room + joined # expect all 200s @@ -341,11 +341,11 @@ class RoomPermissionsTestCase(RestTestCase): room=room, expect_code=200) # get membership of self, get membership of other, public room + left - # expect all 200s - public rooms, you can always see who is in them. + # expect 403. yield self.leave(room=room, user=self.user_id) yield self._test_get_membership( members=[self.user_id, self.rmcreator_id], - room=room, expect_code=200) + room=room, expect_code=403) @defer.inlineCallbacks def test_invited_permissions(self): |