magmaus3/continuwuity
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: reject /register requests when there is no token and the type is appservice

Browse source 
Signed-off-by: strawberry <strawberry@puppygock.gay>
This commit is contained in:
Matthias Ahouansou 2024-03-31 10:16:29 -04:00 • committed by June
parent 7a1a271518
commit c61aee4f1c
2 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/api/client_server/account.rs
View file

@ -2,7 +2,8 @@ use register::RegistrationKind;
use ruma::{ use ruma::{
api::client::{ api::client::{
account::{ account::{
change_password, deactivate, get_3pids, get_username_availability, register, change_password, deactivate, get_3pids, get_username_availability,
register::{self, LoginType},
request_3pid_management_token_via_email, request_3pid_management_token_via_msisdn, whoami, request_3pid_management_token_via_email, request_3pid_management_token_via_msisdn, whoami,
ThirdPartyIdRemovalStatus, ThirdPartyIdRemovalStatus,
}, },
@ -91,6 +92,10 @@ pub async fn register_route(body: Ruma<register::v3::Request>) -> Result<registe
return Err(Error::BadRequest(ErrorKind::Forbidden, "Registration has been disabled.")); return Err(Error::BadRequest(ErrorKind::Forbidden, "Registration has been disabled."));
} }
if body.body.login_type == Some(LoginType::ApplicationService) && !body.from_appservice {
return Err(Error::BadRequest(ErrorKind::MissingToken, "Missing Appservice token."));
}
let is_guest = body.kind == RegistrationKind::Guest; let is_guest = body.kind == RegistrationKind::Guest;
if is_guest if is_guest

6
src/api/client_server/session.rs
View file

@ -145,11 +145,7 @@ pub async fn login_route(body: Ruma<login::v3::Request>) -> Result<login::v3::Re
}) => { }) => {
debug!("Got appservice login type"); debug!("Got appservice login type");
if !body.from_appservice { if !body.from_appservice {
info!( return Err(Error::BadRequest(ErrorKind::MissingToken, "Missing Appservice token."));
"User tried logging in as an appservice, but request body is not from a known/registered \
appservice"
);
return Err(Error::BadRequest(ErrorKind::Forbidden, "Forbidden login type."));
}; };
let username = if let Some(UserIdentifier::UserIdOrLocalpart(user_id)) = identifier { let username = if let Some(UserIdentifier::UserIdOrLocalpart(user_id)) = identifier {
user_id.to_lowercase() user_id.to_lowercase()