magmaus3/continuwuity
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add require_auth_for_profile_requests config option, check endpoint metadata instead of request string

Browse source 
Signed-off-by: strawberry <strawberry@puppygock.gay>
This commit is contained in:
strawberry 2024-10-26 12:32:47 -04:00
parent 0efe24a028
commit d6991611f0
2 changed files with 40 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

36
src/api/router/auth.rs
View file

@ -6,7 +6,15 @@ use axum_extra::{
}; };
use conduit::{debug_error, err, warn, Err, Error, Result}; use conduit::{debug_error, err, warn, Err, Error, Result};
use ruma::{ use ruma::{
api::{client::error::ErrorKind, AuthScheme, Metadata}, api::{
client::{
directory::get_public_rooms,
error::ErrorKind,
profile::{get_avatar_url, get_display_name, get_profile, get_profile_key, get_timezone_key},
voip::get_turn_server_info,
},
AuthScheme, IncomingRequest, Metadata,
},
server_util::authorization::XMatrix, server_util::authorization::XMatrix,
CanonicalJsonObject, CanonicalJsonValue, OwnedDeviceId, OwnedServerName, OwnedUserId, UserId, CanonicalJsonObject, CanonicalJsonValue, OwnedDeviceId, OwnedServerName, OwnedUserId, UserId,
}; };
@ -54,9 +62,8 @@ pub(super) async fn auth(
}; };
if metadata.authentication == AuthScheme::None { if metadata.authentication == AuthScheme::None {
match request.parts.uri.path() { match metadata {
// TODO: can we check this better? &get_public_rooms::v3::Request::METADATA => {
"/_matrix/client/v3/publicRooms" | "/_matrix/client/r0/publicRooms" => {
if !services if !services
.globals .globals
.config .config
@ -73,6 +80,23 @@ pub(super) async fn auth(
} }
} }
}, },
&get_profile::v3::Request::METADATA
| &get_profile_key::unstable::Request::METADATA
| &get_display_name::v3::Request::METADATA
| &get_avatar_url::v3::Request::METADATA
| &get_timezone_key::unstable::Request::METADATA => {
if services.globals.config.require_auth_for_profile_requests {
match token {
Token::Appservice(_) | Token::User(_) => {
// we should have validated the token above
// already
},
Token::None | Token::Invalid => {
return Err(Error::BadRequest(ErrorKind::MissingToken, "Missing or invalid access token."));
},
}
}
},
_ => {}, _ => {},
}; };
} }
@ -107,9 +131,9 @@ pub(super) async fn auth(
appservice_info: Some(*info), appservice_info: Some(*info),
}) })
}, },
(AuthScheme::AccessToken, Token::None) => match request.parts.uri.path() { (AuthScheme::AccessToken, Token::None) => match metadata {
// TODO: can we check this better? // TODO: can we check this better?
"/_matrix/client/v3/voip/turnServer" | "/_matrix/client/r0/voip/turnServer" => { &get_turn_server_info::v3::Request::METADATA => {
if services.globals.config.turn_allow_guests { if services.globals.config.turn_allow_guests {
Ok(Auth { Ok(Auth {
origin: None, origin: None,

11
src/core/config/mod.rs
View file

@ -58,7 +58,6 @@ pub struct Config {
/// YOU NEED TO EDIT THIS /// YOU NEED TO EDIT THIS
pub server_name: OwnedServerName, pub server_name: OwnedServerName,
/// Database backend: Only rocksdb is supported.
/// default address (IPv4 or IPv6) conduwuit will listen on. Generally you /// default address (IPv4 or IPv6) conduwuit will listen on. Generally you
/// want this to be localhost (127.0.0.1 / ::1). If you are using Docker or /// want this to be localhost (127.0.0.1 / ::1). If you are using Docker or
/// a container NAT networking setup, you likely need this to be 0.0.0.0. /// a container NAT networking setup, you likely need this to be 0.0.0.0.
@ -94,6 +93,8 @@ pub struct Config {
#[serde(default = "default_unix_socket_perms")] #[serde(default = "default_unix_socket_perms")]
pub unix_socket_perms: u32, pub unix_socket_perms: u32,
/// Database backend: Only rocksdb is supported.
///
/// default: rocksdb /// default: rocksdb
#[serde(default = "default_database_backend")] #[serde(default = "default_database_backend")]
pub database_backend: String, pub database_backend: String,
@ -406,6 +407,14 @@ pub struct Config {
#[serde(default)] #[serde(default)]
pub federation_loopback: bool, pub federation_loopback: bool,
/// Set this to true to require authentication on the normally
/// unauthenticated profile retrieval endpoints (GET)
/// "/_matrix/client/v3/profile/{userId}".
///
/// This can prevent profile scraping.
#[serde(default)]
pub require_auth_for_profile_requests: bool,
/// Set this to true to allow your server's public room directory to be /// Set this to true to allow your server's public room directory to be
/// federated. Set this to false to protect against /publicRooms spiders, /// federated. Set this to false to protect against /publicRooms spiders,
/// but will forbid external users from viewing your server's public room /// but will forbid external users from viewing your server's public room