element-hq / element-hq/dendrite
spec: dendrite doesn't correctly implement m.room.power_levels defaults
- Dominant language
- Go
- Stars
- 965
- Forks
- 101
- PR merge metrics
- No merged PRs in 30d
Description
*This issue was originally created by [**@bones-was-here**](https://github.com/bones-was-here) at .*
### Background information
- **Dendrite version or git SHA**: 0.11.1
- **SQLite3 or Postgres?**: postgres
- **Running in Docker?**: no
- **`go version`**: 1.19.5
- **Client used (if applicable)**: element web
### Description
- **What** is the problem: defaults in https://spec.matrix.org/v1.6/client-server-api/#mroompower_levels are not respected when keys have been omitted
- **Who** is affected: room moderators and bots
- **How** is this bug manifesting: dendrite responds with 403 to power levels changes that should be allowed
- **When** did this first appear: unknown
### Steps to reproduce
- In a standard public room, give moderators access to "Change permissions" aka `"events": { "m.room.power_levels": 50 }`
- Set "Change settings" above 50, eg `"state_default": 90`
- by editing the room's m.room.power_levels event, remove the keys `"users_default": 0` and `"events_default": 0` (a bot with a json library issue did this in our rooms)
- with an account that only has power 50 in the room, try to set (eg) `"users_default": 0` or `"events_default": 1`
I get:
`Failed to send event! (M_FORBIDDEN: MatrixError: [403] eventauth: sender with level 50 is not allowed to change level from 0 to 90 because the new level is above the level of the sender (https://xonotic.org/_matrix/client/r0/rooms/!DOFMXCyGQRNdmRIH%3Axonotic.org/state/m.room.power_levels/))`
and the 90 probably comes from our `"state_default": 90`
whereas according to https://spec.matrix.org/v1.6/client-server-api/#mroompower_levels the default for these is `0` and not the value of `state_default`.
A similar error occurs if removing a user with a power level of eg 7 from the list, which _should_ return them to the default of 0 but instead is denied because the account making the change has power 50, not 90.
If I use a higher powered account to re-add these keys, it fixes the issues.
Contributor guide
Assessment
This issue has not been assessed yet.