Skip to content

Commit 6e600c9

Browse files
authored
Don't allow users to ignore themselves. (element-hq#18508)
Fixes the self-ignore issues we've being seeing of reports of by ignoring bad requests from clients. Fixes element-hq#11963 Fix element-hq/element-web#29969 although this should also be fixed on the client to avoid confusing errors popping up while rejecting invites. Related to matrix-org/matrix-rust-sdk#5073
1 parent d285d76 commit 6e600c9

File tree

3 files changed

+20
-0
lines changed

3 files changed

+20
-0
lines changed

changelog.d/18508.bugfix

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Prevent users from adding themselves to their own ignore list.

synapse/storage/databases/main/account_data.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
)
3535

3636
from synapse.api.constants import AccountDataTypes
37+
from synapse.api.errors import Codes, SynapseError
3738
from synapse.replication.tcp.streams import AccountDataStream
3839
from synapse.storage._base import db_to_json
3940
from synapse.storage.database import (
@@ -780,6 +781,9 @@ def _add_account_data_for_user(
780781
else:
781782
currently_ignored_users = set()
782783

784+
if user_id in currently_ignored_users:
785+
raise SynapseError(400, "You cannot ignore yourself", Codes.INVALID_PARAM)
786+
783787
# If the data has not changed, nothing to do.
784788
if previously_ignored_users == currently_ignored_users:
785789
return

tests/storage/test_account_data.py

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
from twisted.test.proto_helpers import MemoryReactor
2525

2626
from synapse.api.constants import AccountDataTypes
27+
from synapse.api.errors import Codes, SynapseError
2728
from synapse.server import HomeServer
2829
from synapse.util import Clock
2930

@@ -93,6 +94,20 @@ def test_ignoring_users(self) -> None:
9394
# Check the removed user.
9495
self.assert_ignorers("@another:remote", {self.user})
9596

97+
def test_ignoring_self_fails(self) -> None:
98+
"""Ensure users cannot add themselves to the ignored list."""
99+
100+
f = self.get_failure(
101+
self.store.add_account_data_for_user(
102+
self.user,
103+
AccountDataTypes.IGNORED_USER_LIST,
104+
{"ignored_users": {self.user: {}}},
105+
),
106+
SynapseError,
107+
).value
108+
self.assertEqual(f.code, 400)
109+
self.assertEqual(f.errcode, Codes.INVALID_PARAM)
110+
96111
def test_caching(self) -> None:
97112
"""Ensure that caching works properly between different users."""
98113
# The first user ignores a user.

0 commit comments

Comments
 (0)