ember/continuwuity
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: Return 404 when event is not accessible

Browse source
This commit is contained in:
Jade Ellis 2025-12-18 22:26:01 +00:00
parent ae4acc9568
commit 07be190507
No known key found for this signature in database
GPG key ID: 8705A2A3EBF77BD2
1 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
src/api/client/relations.rs
View file

@ -1,11 +1,11 @@
use axum::extract::State;
use conduwuit::{
Result, at, debug_warn,
Result, at, debug_warn, err,
matrix::{Event, event::RelationTypeEqual, pdu::PduCount},
utils::{IterStream, ReadyExt, result::FlatOk, stream::WidebandExt},
};
use conduwuit_service::Services;
use futures::StreamExt;
use futures::{StreamExt, TryFutureExt};
use ruma::{
EventId, RoomId, UInt, UserId,
api::{
@ -109,6 +109,15 @@ async fn paginate_relations_with_filter(
recurse: bool,
dir: Direction,
) -> Result<get_relating_events::v1::Response> {
if !services
.rooms
.state_accessor
.user_can_see_event(sender_user, room_id, target)
{
debug_warn!(req_evt = ?target, ?room_id, "Event relations requested by {sender_user} but is not allowed to see it, returning 404");
return err!(Request(NotFound("Event not found.")));
}
let start: PduCount = from
.map(str::parse)
.transpose()?