element-hq / element-hq/dendrite

spec: dendrite doesn't correctly implement m.room.power_levels defaults

Open
#2,983 3 comments 0 reactions 0 assignees View on GitHub
C-Roomserver O-Occasional S-Major spec-compliance T-Defect
Dominant language
Go
Stars
965
Forks
101
PR merge metrics
No merged PRs in 30d

Description

*This issue was originally created by [**@bones-was-here**](https://github.com/bones-was-here) at .*

### Background information

- **Dendrite version or git SHA**: 0.11.1
- **SQLite3 or Postgres?**: postgres
- **Running in Docker?**: no
- **`go version`**: 1.19.5
- **Client used (if applicable)**: element web

### Description

- **What** is the problem: defaults in https://spec.matrix.org/v1.6/client-server-api/#mroompower_levels are not respected when keys have been omitted
- **Who** is affected: room moderators and bots
- **How** is this bug manifesting: dendrite responds with 403 to power levels changes that should be allowed
- **When** did this first appear: unknown

### Steps to reproduce

- In a standard public room, give moderators access to "Change permissions" aka `"events": { "m.room.power_levels": 50 }`
- Set "Change settings" above 50, eg `"state_default": 90`
- by editing the room's m.room.power_levels event, remove the keys `"users_default": 0` and `"events_default": 0` (a bot with a json library issue did this in our rooms)

- with an account that only has power 50 in the room, try to set (eg) `"users_default": 0` or `"events_default": 1`
I get:
`Failed to send event! (M_FORBIDDEN: MatrixError: [403] eventauth: sender with level 50 is not allowed to change level from 0 to 90 because the new level is above the level of the sender (https://xonotic.org/_matrix/client/r0/rooms/!DOFMXCyGQRNdmRIH%3Axonotic.org/state/m.room.power_levels/))`
and the 90 probably comes from our `"state_default": 90`
whereas according to https://spec.matrix.org/v1.6/client-server-api/#mroompower_levels the default for these is `0` and not the value of `state_default`.

A similar error occurs if removing a user with a power level of eg 7 from the list, which _should_ return them to the default of 0 but instead is denied because the account making the change has power 50, not 90.

If I use a higher powered account to re-add these keys, it fixes the issues.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.