From 81487e3f07fcf8349a8ee0e7c0b54c3e5e860242 Mon Sep 17 00:00:00 2001 From: strawberry Date: Fri, 7 Jun 2024 01:21:01 -0400 Subject: [PATCH] fix(fed): dont reject `/get_missing_events` on world readable rooms Signed-off-by: strawberry --- src/api/server/get_missing_events.rs | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/src/api/server/get_missing_events.rs b/src/api/server/get_missing_events.rs index 1179afe7..1c9a6a38 100644 --- a/src/api/server/get_missing_events.rs +++ b/src/api/server/get_missing_events.rs @@ -13,19 +13,23 @@ pub(crate) async fn get_missing_events_route( ) -> Result { let origin = body.origin.as_ref().expect("server is authenticated"); - if !services() - .rooms - .state_cache - .server_in_room(origin, &body.room_id)? - { - return Err(Error::BadRequest(ErrorKind::forbidden(), "Server is not in room")); - } - services() .rooms .event_handler .acl_check(origin, &body.room_id)?; + if !services() + .rooms + .state_accessor + .is_world_readable(&body.room_id)? + && !services() + .rooms + .state_cache + .server_in_room(origin, &body.room_id)? + { + return Err(Error::BadRequest(ErrorKind::forbidden(), "Server is not in room")); + } + let limit = body .limit .try_into()