backups/grapevine
1
0
Fork 0
mirror of https://gitlab.computer.surgery/matrix/grapevine.git synced 2025-12-16 23:31:24 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Use destination field in X-Matrix Authorization header

Browse source 
Both validating and sending it is a MUST since Matrix v1.3.
This commit is contained in:
Lambda 2024-06-03 16:35:00 +00:00
parent 62dd097f49
commit 5c39c7c5ff
2 changed files with 14 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/api/ruma_wrapper/axum.rs
View file

@ -196,6 +196,19 @@ async fn ar_from_request_inner(
Error::BadRequest(ErrorKind::forbidden(), msg)
})?;
if let Some(destination) = x_matrix.destination {
if destination != services().globals.server_name() {
warn!(
%destination,
"Incorrect destination in X-Matrix header"
);
return Err(Error::BadRequest(
ErrorKind::Unauthorized,
"Incorrect destination in X-Matrix header",
));
}
}
let origin_signatures = BTreeMap::from_iter([(
x_matrix.key.to_string(),
CanonicalJsonValue::String(x_matrix.sig),