element-hq / element-hq/element-android
Users who do not have a PL >= to state_default are unable to live share their location
- Dominant language
- Kotlin
- Stars
- 3.7k
- Forks
- 917
- PR merge metrics
- No merged PRs in 30d
Description
Matrix users can send state events into the room if the `state_key` matches their MXID (https://spec.matrix.org/v1.7/rooms/v10/#authorization-rules). Live location sharing relies upon this, as any user can share their location by using their own MXID as the state_key.
The client proactively checks to see if the user has permissions to share location, but the logic is flawed. [This part](https://github.com/vector-im/element-android/blob/2b4b5f05eb6d19778e67ace2f86d65b91ba85c85/vector/src/main/java/im/vector/app/features/location/LocationSharingViewModel.kt#L81-L93) of the code invoking the PL checker function only checks to see if the user is allowed to send arbitrary state (with the event type), but does **not check the state_key**.
This means users are unable to share locations unless they have enough PL to send any state, which is not a given.
Contributor guide
Assessment
This issue has not been assessed yet.