From 556e78214a1fd70ebd65a3905cae580e0760c202 Mon Sep 17 00:00:00 2001 From: Matthias Ahouansou Date: Wed, 12 Jun 2024 02:13:27 -0400 Subject: [PATCH] fix: only allow the server user to set the admin alias Should make it safer to move the alias if the admin room broke on a public server. Signed-off-by: strawberry --- src/service/rooms/alias/mod.rs | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/service/rooms/alias/mod.rs b/src/service/rooms/alias/mod.rs index 18d513a9..80f125dc 100644 --- a/src/service/rooms/alias/mod.rs +++ b/src/service/rooms/alias/mod.rs @@ -21,7 +21,14 @@ pub struct Service { impl Service { #[tracing::instrument(skip(self))] pub fn set_alias(&self, alias: &RoomAliasId, room_id: &RoomId, user_id: &UserId) -> Result<()> { - self.db.set_alias(alias, room_id, user_id) + if alias == services().globals.admin_alias && user_id != services().globals.server_user { + Err(Error::BadRequest( + ErrorKind::forbidden(), + "Only the server user can set this alias", + )) + } else { + self.db.set_alias(alias, room_id, user_id) + } } #[tracing::instrument(skip(self))]