matrix.org/static/blog/wp-content/uploads/2016/07/sec-0.14.patch_.txt

49 lines
1.9 KiB
Plaintext

diff --git a/synapse/api/auth.py b/synapse/api/auth.py
index 4f9c3c9..2d38240 100644
--- a/synapse/api/auth.py
+++ b/synapse/api/auth.py
@@ -617,17 +617,22 @@ class Auth(object):
def get_user_from_macaroon(self, macaroon_str):
try:
macaroon = pymacaroons.Macaroon.deserialize(macaroon_str)
- self.validate_macaroon(macaroon, "access", False)
user_prefix = "user_id = "
user = None
+ user_id = None
guest = False
for caveat in macaroon.caveats:
if caveat.caveat_id.startswith(user_prefix):
- user = UserID.from_string(caveat.caveat_id[len(user_prefix):])
+ user_id = caveat.caveat_id[len(user_prefix):]
+ user = UserID.from_string(user_id)
elif caveat.caveat_id == "guest = true":
guest = True
+ self.validate_macaroon(
+ macaroon, "access", False, user_id=user_id,
+ )
+
if user is None:
raise AuthError(
self.TOKEN_NOT_FOUND_HTTP_STATUS, "No user caveat in macaroon",
@@ -665,7 +670,7 @@ class Auth(object):
errcode=Codes.UNKNOWN_TOKEN
)
- def validate_macaroon(self, macaroon, type_string, verify_expiry):
+ def validate_macaroon(self, macaroon, type_string, verify_expiry, user_id):
"""
validate that a Macaroon is understood by and was signed by this server.
@@ -679,7 +684,7 @@ class Auth(object):
v = pymacaroons.Verifier()
v.satisfy_exact("gen = 1")
v.satisfy_exact("type = " + type_string)
- v.satisfy_general(lambda c: c.startswith("user_id = "))
+ v.satisfy_exact("user_id = %s" % user_id)
v.satisfy_exact("guest = true")
if verify_expiry:
v.satisfy_general(self._verify_expiry)