serv/conduit
1
0
Fork 0
mirror of https://gitlab.com/famedly/conduit.git synced 2024-12-27 21:13:47 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(redaction): use content.redacts when checking v11 events

Browse source
This commit is contained in:
Matthias Ahouansou 2024-04-24 09:28:16 +01:00
parent 89c1c2109c
commit 1c4ae8d268
No known key found for this signature in database
2 changed files with 102 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

44
src/service/rooms/event_handler/mod.rs
View file

@ -23,7 +23,10 @@ use ruma::{
}, },
}, },
events::{ events::{
room::{create::RoomCreateEventContent, server_acl::RoomServerAclEventContent}, room::{
create::RoomCreateEventContent, redaction::RoomRedactionEventContent,
server_acl::RoomServerAclEventContent,
},
StateEventType, TimelineEventType, StateEventType, TimelineEventType,
}, },
int, int,
@ -797,9 +800,20 @@ impl Service {
|k, s| auth_events.get(&(k.clone(), s.to_owned())), |k, s| auth_events.get(&(k.clone(), s.to_owned())),
) )
.map_err(|_e| Error::BadRequest(ErrorKind::InvalidParam, "Auth check failed."))? .map_err(|_e| Error::BadRequest(ErrorKind::InvalidParam, "Auth check failed."))?
|| if let Some(redact_id) = &incoming_pdu.redacts { || incoming_pdu.kind == TimelineEventType::RoomRedaction
incoming_pdu.kind == TimelineEventType::RoomRedaction && match room_version_id {
&& !services().rooms.state_accessor.user_can_redact( RoomVersionId::V1
| RoomVersionId::V2
| RoomVersionId::V3
| RoomVersionId::V4
| RoomVersionId::V5
| RoomVersionId::V6
| RoomVersionId::V7
| RoomVersionId::V8
| RoomVersionId::V9
| RoomVersionId::V10 => {
if let Some(redact_id) = &incoming_pdu.redacts {
!services().rooms.state_accessor.user_can_redact(
redact_id, redact_id,
&incoming_pdu.sender, &incoming_pdu.sender,
&incoming_pdu.room_id, &incoming_pdu.room_id,
@ -807,6 +821,28 @@ impl Service {
)? )?
} else { } else {
false false
}
}
RoomVersionId::V11 => {
let content = serde_json::from_str::<RoomRedactionEventContent>(
incoming_pdu.content.get(),
)
.map_err(|_| Error::bad_database("Invalid content in redaction pdu."))?;
if let Some(redact_id) = &content.redacts {
!services().rooms.state_accessor.user_can_redact(
redact_id,
&incoming_pdu.sender,
&incoming_pdu.room_id,
true,
)?
} else {
false
}
}
_ => {
unreachable!("Validity of room version already checked")
}
}; };
// 13. Use state resolution to find new room state // 13. Use state resolution to find new room state

48
src/service/rooms/timeline/mod.rs
View file

@ -900,21 +900,61 @@ impl Service {
} }
// If redaction event is not authorized, do not append it to the timeline // If redaction event is not authorized, do not append it to the timeline
if pdu.kind == TimelineEventType::RoomRedaction {
match services().rooms.state.get_room_version(&pdu.room_id)? {
RoomVersionId::V1
| RoomVersionId::V2
| RoomVersionId::V3
| RoomVersionId::V4
| RoomVersionId::V5
| RoomVersionId::V6
| RoomVersionId::V7
| RoomVersionId::V8
| RoomVersionId::V9
| RoomVersionId::V10 => {
if let Some(redact_id) = &pdu.redacts { if let Some(redact_id) = &pdu.redacts {
if pdu.kind == TimelineEventType::RoomRedaction if !services().rooms.state_accessor.user_can_redact(
&& !services().rooms.state_accessor.user_can_redact(
redact_id, redact_id,
&pdu.sender, &pdu.sender,
&pdu.room_id, &pdu.room_id,
false, false,
)? )? {
{
return Err(Error::BadRequest( return Err(Error::BadRequest(
ErrorKind::Forbidden, ErrorKind::Forbidden,
"User cannot redact this event.", "User cannot redact this event.",
)); ));
} }
}; };
}
RoomVersionId::V11 => {
let content =
serde_json::from_str::<RoomRedactionEventContent>(pdu.content.get())
.map_err(|_| {
Error::bad_database("Invalid content in redaction pdu.")
})?;
if let Some(redact_id) = &content.redacts {
if !services().rooms.state_accessor.user_can_redact(
redact_id,
&pdu.sender,
&pdu.room_id,
false,
)? {
return Err(Error::BadRequest(
ErrorKind::Forbidden,
"User cannot redact this event.",
));
}
}
}
_ => {
return Err(Error::BadRequest(
ErrorKind::UnsupportedRoomVersion,
"Unsupported room version",
));
}
}
}
// We append to state before appending the pdu, so we don't have a moment in time with the // We append to state before appending the pdu, so we don't have a moment in time with the
// pdu without it's state. This is okay because append_pdu can't fail. // pdu without it's state. This is okay because append_pdu can't fail.