Add RoomExists flag to QueryMembershipForUser
Fixes
MODIFY
clientapi/routing/membership.go
clientapi/routing/membership.go
@@ -188,6 +188,12 @@ func SendUnban(
if err != nil {
return util.ErrorResponse(err)
}
+ if !queryRes.RoomExists {
+ return util.JSONResponse{
+ Code: http.StatusForbidden,
+ JSON: jsonerror.Forbidden("room does not exist"),
+ }
+ }
// unban is only valid if the user is currently banned
if queryRes.Membership != "ban" {
return util.JSONResponse{
@@ -471,6 +477,12 @@ func SendForget(
logger.WithError(err).Error("QueryMembershipForUser: could not query membership for user")
return jsonerror.InternalServerError()
}
+ if !membershipRes.RoomExists {
+ return util.JSONResponse{
+ Code: http.StatusForbidden,
+ JSON: jsonerror.Forbidden("room does not exist"),
+ }
+ }
if membershipRes.IsInRoom {
return util.JSONResponse{
Code: http.StatusBadRequest,

MODIFY
clientapi/routing/state.go
clientapi/routing/state.go
@@ -56,6 +56,12 @@ func OnIncomingStateRequest(ctx context.Context, device *userapi.Device, rsAPI a
util.GetLogger(ctx).WithError(err).Error("queryAPI.QueryLatestEventsAndState failed")
return jsonerror.InternalServerError()
}
+ if !stateRes.RoomExists {
+ return util.JSONResponse{
+ Code: http.StatusForbidden,
+ JSON: jsonerror.Forbidden("room does not exist"),
+ }
+ }
// Look at the room state and see if we have a history visibility event
// that marks the room as world-readable. If we don't then we assume that

MODIFY
roomserver/api/query.go
roomserver/api/query.go
@@ -122,6 +122,7 @@ type QueryMembershipForUserResponse struct {
Membership string `json:"membership"`
// True if the user asked to forget this room.
IsRoomForgotten bool `json:"is_room_forgotten"`
+ RoomExists bool `json:"room_exists"`
}
// QueryMembershipsForRoomRequest is a request to QueryMembershipsForRoom

MODIFY
roomserver/internal/query/query.go
roomserver/internal/query/query.go
@@ -169,8 +169,10 @@ func (r *Queryer) QueryMembershipForUser(
return err
}
if info == nil {
- return fmt.Errorf("QueryMembershipForUser: unknown room %s", request.RoomID)
+ response.RoomExists = false
+ return nil
}
+ response.RoomExists = true
membershipEventNID, stillInRoom, isRoomforgotten, err := r.DB.GetMembership(ctx, info.RoomNID, request.UserID)
if err != nil {

MODIFY
syncapi/routing/context.go
syncapi/routing/context.go
@@ -73,6 +73,12 @@ func Context(
logrus.WithError(err).Error("unable to query membership")
return jsonerror.InternalServerError()
}
+ if !membershipRes.RoomExists {
+ return util.JSONResponse{
+ Code: http.StatusForbidden,
+ JSON: jsonerror.Forbidden("room does not exist"),
+ }
+ }
stateFilter := gomatrixserverlib.StateFilter{
Limit: 100,

MODIFY
syncapi/routing/messages.go
syncapi/routing/messages.go
@@ -68,10 +68,16 @@ func OnIncomingMessagesRequest(
var err error
// check if the user has already forgotten about this room
- isForgotten, err := checkIsRoomForgotten(req.Context(), roomID, device.UserID, rsAPI)
+ isForgotten, roomExists, err := checkIsRoomForgotten(req.Context(), roomID, device.UserID, rsAPI)
if err != nil {
return jsonerror.InternalServerError()
}
+ if !roomExists {
+ return util.JSONResponse{
+ Code: http.StatusForbidden,
+ JSON: jsonerror.Forbidden("room does not exist"),
+ }
+ }
if isForgotten {
return util.JSONResponse{
@@ -244,17 +250,17 @@ func OnIncomingMessagesRequest(
}
}
-func checkIsRoomForgotten(ctx context.Context, roomID, userID string, rsAPI api.SyncRoomserverAPI) (bool, error) {
+func checkIsRoomForgotten(ctx context.Context, roomID, userID string, rsAPI api.SyncRoomserverAPI) (forgotten bool, exists bool, err error) {
req := api.QueryMembershipForUserRequest{
RoomID: roomID,
UserID: userID,
}
resp := api.QueryMembershipForUserResponse{}
if err := rsAPI.QueryMembershipForUser(ctx, &req, &resp); err != nil {
- return false, err
+ return false, false, err
}
- return resp.IsRoomForgotten, nil
+ return resp.IsRoomForgotten, resp.RoomExists, nil
}
// retrieveEvents retrieves events from the local database for a request on

Add RoomExists flag to QueryMembershipForUser (#2450)

Fixes https://github.com/matrix-org/complement/pull/369