Filip/matrix-spec
1
0
Fork 0
mirror of https://github.com/matrix-org/matrix-spec synced 2026-03-26 04:54:10 +01:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Apply m.federate check to the create event in the room state

Browse source
This commit is contained in:
Richard van der Hoff 2022-07-04 16:25:16 +01:00
parent c3adb4f4da
commit 97d373c4ec
4 changed files with 43 additions and 43 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
content/rooms/fragments/v1-auth-rules.md
View file

@ -37,14 +37,14 @@ The rules are as follows:
performed on receipt of a performed on receipt of a
PDU](server-server-api/#checks-performed-on-receipt-of-a-pdu), reject. PDU](server-server-api/#checks-performed-on-receipt-of-a-pdu), reject.
4. If there is no `m.room.create` event among the entries, reject. 4. If there is no `m.room.create` event among the entries, reject.
5. If the `m.room.create` event content has the field `m.federate` set to `false` 3. If the `content` of the `m.room.create` event in the room state has the
and the `sender` domain of the event does not match the `sender` domain of property `m.federate` set to `false`, and the `sender` domain of the event
the create event, reject. does not match the `sender` domain of the create event, reject.
3. If type is `m.room.aliases`: 4. If type is `m.room.aliases`:
1. If event has no `state_key`, reject. 1. If event has no `state_key`, reject.
2. If sender's domain doesn't matches `state_key`, reject. 2. If sender's domain doesn't matches `state_key`, reject.
3. Otherwise, allow. 3. Otherwise, allow.
4. If type is `m.room.member`: 5. If type is `m.room.member`:
1. If no `state_key` key or `membership` key in `content`, reject. 1. If no `state_key` key or `membership` key in `content`, reject.
2. If `membership` is `join`: 2. If `membership` is `join`:
1. If the only previous event is an `m.room.create` and the 1. If the only previous event is an `m.room.create` and the
@ -101,15 +101,15 @@ The rules are as follows:
than the `sender`'s power level, allow. than the `sender`'s power level, allow.
3. Otherwise, reject. 3. Otherwise, reject.
6. Otherwise, the membership is unknown. Reject. 6. Otherwise, the membership is unknown. Reject.
5. If the `sender`'s current membership state is not `join`, reject. 6. If the `sender`'s current membership state is not `join`, reject.
6. If type is `m.room.third_party_invite`: 7. If type is `m.room.third_party_invite`:
1. Allow if and only if `sender`'s current power level is greater 1. Allow if and only if `sender`'s current power level is greater
than or equal to the *invite level*. than or equal to the *invite level*.
7. If the event type's *required power level* is greater than the 8. If the event type's *required power level* is greater than the
`sender`'s power level, reject. `sender`'s power level, reject.
8. If the event has a `state_key` that starts with an `@` and does not 9. If the event has a `state_key` that starts with an `@` and does not
match the `sender`, reject. match the `sender`, reject.
9. If type is `m.room.power_levels`: 10. If type is `m.room.power_levels`:
1. If `users` key in `content` is not a dictionary with keys that 1. If `users` key in `content` is not a dictionary with keys that
are valid user IDs with values that are integers (or a string are valid user IDs with values that are integers (or a string
that is an integer), reject. that is an integer), reject.
@ -133,14 +133,14 @@ The rules are as follows:
1. If the current value is equal to the `sender`'s current 1. If the current value is equal to the `sender`'s current
power level, reject. power level, reject.
6. Otherwise, allow. 6. Otherwise, allow.
10. If type is `m.room.redaction`: 11. If type is `m.room.redaction`:
1. If the `sender`'s power level is greater than or equal to the 1. If the `sender`'s power level is greater than or equal to the
*redact level*, allow. *redact level*, allow.
2. If the domain of the `event_id` of the event being redacted is 2. If the domain of the `event_id` of the event being redacted is
the same as the domain of the `event_id` of the the same as the domain of the `event_id` of the
`m.room.redaction`, allow. `m.room.redaction`, allow.
3. Otherwise, reject. 3. Otherwise, reject.
11. Otherwise, allow. 12. Otherwise, allow.
{{% boxes/note %}} {{% boxes/note %}}
Some consequences of these rules: Some consequences of these rules:

22
content/rooms/fragments/v3-auth-rules.md
View file

@ -44,14 +44,14 @@ The complete list of rules, as of room version 3, is as follows:
performed on receipt of a performed on receipt of a
PDU](server-server-api/#checks-performed-on-receipt-of-a-pdu), reject. PDU](server-server-api/#checks-performed-on-receipt-of-a-pdu), reject.
4. If there is no `m.room.create` event among the entries, reject. 4. If there is no `m.room.create` event among the entries, reject.
5. If the `m.room.create` event content has the field `m.federate` set to `false` 3. If the `content` of the `m.room.create` event in the room state has the
and the `sender` domain of the event does not match the `sender` domain of property `m.federate` set to `false`, and the `sender` domain of the event
the create event, reject. does not match the `sender` domain of the create event, reject.
3. If type is `m.room.aliases`: 4. If type is `m.room.aliases`:
1. If event has no `state_key`, reject. 1. If event has no `state_key`, reject.
2. If sender's domain doesn't matches `state_key`, reject. 2. If sender's domain doesn't matches `state_key`, reject.
3. Otherwise, allow. 3. Otherwise, allow.
4. If type is `m.room.member`: 5. If type is `m.room.member`:
1. If no `state_key` key or `membership` key in `content`, reject. 1. If no `state_key` key or `membership` key in `content`, reject.
2. If `membership` is `join`: 2. If `membership` is `join`:
1. If the only previous event is an `m.room.create` and the 1. If the only previous event is an `m.room.create` and the
@ -108,15 +108,15 @@ The complete list of rules, as of room version 3, is as follows:
than the `sender`'s power level, allow. than the `sender`'s power level, allow.
3. Otherwise, reject. 3. Otherwise, reject.
6. Otherwise, the membership is unknown. Reject. 6. Otherwise, the membership is unknown. Reject.
5. If the `sender`'s current membership state is not `join`, reject. 6. If the `sender`'s current membership state is not `join`, reject.
6. If type is `m.room.third_party_invite`: 7. If type is `m.room.third_party_invite`:
1. Allow if and only if `sender`'s current power level is greater 1. Allow if and only if `sender`'s current power level is greater
than or equal to the *invite level*. than or equal to the *invite level*.
7. If the event type's *required power level* is greater than the 8. If the event type's *required power level* is greater than the
`sender`'s power level, reject. `sender`'s power level, reject.
8. If the event has a `state_key` that starts with an `@` and does not 9. If the event has a `state_key` that starts with an `@` and does not
match the `sender`, reject. match the `sender`, reject.
9. If type is `m.room.power_levels`: 10. If type is `m.room.power_levels`:
1. If `users` key in `content` is not a dictionary with keys that 1. If `users` key in `content` is not a dictionary with keys that
are valid user IDs with values that are integers (or a string are valid user IDs with values that are integers (or a string
that is an integer), reject. that is an integer), reject.
@ -140,7 +140,7 @@ The complete list of rules, as of room version 3, is as follows:
1. If the current value is equal to the `sender`'s current 1. If the current value is equal to the `sender`'s current
power level, reject. power level, reject.
6. Otherwise, allow. 6. Otherwise, allow.
10. Otherwise, allow. 11. Otherwise, allow.
{{% boxes/note %}} {{% boxes/note %}}
Some consequences of these rules: Some consequences of these rules:

20
content/rooms/fragments/v8-auth-rules.md
View file

@ -45,10 +45,10 @@ The rules are as follows:
performed on receipt of a performed on receipt of a
PDU](server-server-api/#checks-performed-on-receipt-of-a-pdu), reject. PDU](server-server-api/#checks-performed-on-receipt-of-a-pdu), reject.
4. If there is no `m.room.create` event among the entries, reject. 4. If there is no `m.room.create` event among the entries, reject.
5. If the `m.room.create` event content has the field `m.federate` set to `false` 3. If the `content` of the `m.room.create` event in the room state has the
and the `sender` domain of the event does not match the `sender` domain of property `m.federate` set to `false`, and the `sender` domain of the event
the create event, reject. does not match the `sender` domain of the create event, reject.
3. If type is `m.room.member`: 4. If type is `m.room.member`:
1. If no `state_key` key or `membership` key in `content`, reject. 1. If no `state_key` key or `membership` key in `content`, reject.
2. If `content` has a `join_authorised_via_users_server` 2. If `content` has a `join_authorised_via_users_server`
key: key:
@ -122,15 +122,15 @@ The rules are as follows:
or `join`, allow. or `join`, allow.
4. Otherwise, reject. 4. Otherwise, reject.
8. Otherwise, the membership is unknown. Reject. 8. Otherwise, the membership is unknown. Reject.
4. If the `sender`'s current membership state is not `join`, reject. 5. If the `sender`'s current membership state is not `join`, reject.
5. If type is `m.room.third_party_invite`: 6. If type is `m.room.third_party_invite`:
1. Allow if and only if `sender`'s current power level is greater 1. Allow if and only if `sender`'s current power level is greater
than or equal to the *invite level*. than or equal to the *invite level*.
6. If the event type's *required power level* is greater than the 7. If the event type's *required power level* is greater than the
`sender`'s power level, reject. `sender`'s power level, reject.
7. If the event has a `state_key` that starts with an `@` and does not 8. If the event has a `state_key` that starts with an `@` and does not
match the `sender`, reject. match the `sender`, reject.
8. If type is `m.room.power_levels`: 9. If type is `m.room.power_levels`:
1. If `users` key in `content` is not a dictionary with keys that 1. If `users` key in `content` is not a dictionary with keys that
are valid user IDs with values that are integers (or a string are valid user IDs with values that are integers (or a string
that is an integer), reject. that is an integer), reject.
@ -154,7 +154,7 @@ The rules are as follows:
1. If the current value is equal to the `sender`'s current 1. If the current value is equal to the `sender`'s current
power level, reject. power level, reject.
6. Otherwise, allow. 6. Otherwise, allow.
9. Otherwise, allow. 10. Otherwise, allow.
{{% boxes/note %}} {{% boxes/note %}}
Some consequences of these rules: Some consequences of these rules:

20
content/rooms/v10.md
View file

@ -117,10 +117,10 @@ The rules are as follows:
performed on receipt of a performed on receipt of a
PDU](server-server-api/#checks-performed-on-receipt-of-a-pdu), reject. PDU](server-server-api/#checks-performed-on-receipt-of-a-pdu), reject.
4. If there is no `m.room.create` event among the entries, reject. 4. If there is no `m.room.create` event among the entries, reject.
5. If the `m.room.create` event content has the field `m.federate` set to `false` 3. If the `content` of the `m.room.create` event in the room state has the
and the `sender` domain of the event does not match the `sender` domain of property `m.federate` set to `false`, and the `sender` domain of the event
the create event, reject. does not match the `sender` domain of the create event, reject.
3. If type is `m.room.member`: 4. If type is `m.room.member`:
1. If no `state_key` key or `membership` key in `content`, reject. 1. If no `state_key` key or `membership` key in `content`, reject.
2. If `content` has a `join_authorised_via_users_server` 2. If `content` has a `join_authorised_via_users_server`
key: key:
@ -197,15 +197,15 @@ The rules are as follows:
or `join`, allow. or `join`, allow.
4. Otherwise, reject. 4. Otherwise, reject.
8. Otherwise, the membership is unknown. Reject. 8. Otherwise, the membership is unknown. Reject.
4. If the `sender`'s current membership state is not `join`, reject. 5. If the `sender`'s current membership state is not `join`, reject.
5. If type is `m.room.third_party_invite`: 6. If type is `m.room.third_party_invite`:
1. Allow if and only if `sender`'s current power level is greater 1. Allow if and only if `sender`'s current power level is greater
than or equal to the *invite level*. than or equal to the *invite level*.
6. If the event type's *required power level* is greater than the 7. If the event type's *required power level* is greater than the
`sender`'s power level, reject. `sender`'s power level, reject.
7. If the event has a `state_key` that starts with an `@` and does not 8. If the event has a `state_key` that starts with an `@` and does not
match the `sender`, reject. match the `sender`, reject.
8. If type is `m.room.power_levels`: 9. If type is `m.room.power_levels`:
1. {{< added-in this="true" >}} 1. {{< added-in this="true" >}}
If any of the keys `users_default`, `events_default`, `state_default`, If any of the keys `users_default`, `events_default`, `state_default`,
`ban`, `redact`, `kick`, or `invite` in `content` are present and `ban`, `redact`, `kick`, or `invite` in `content` are present and
@ -236,7 +236,7 @@ The rules are as follows:
1. If the current value is equal to the `sender`'s current 1. If the current value is equal to the `sender`'s current
power level, reject. power level, reject.
6. Otherwise, allow. 6. Otherwise, allow.
9. Otherwise, allow. 10. Otherwise, allow.
{{% boxes/note %}} {{% boxes/note %}}
Some consequences of these rules: Some consequences of these rules: