element-hq / element-hq/element-android

Users who do not have a PL >= to state_default are unable to live share their location

Open
#8,563 0 comments 0 reactions 0 assignees View on GitHub
A-Location O-Occasional S-Minor T-Defect Z-Labs
Dominant language
Kotlin
Stars
3.7k
Forks
917
PR merge metrics
No merged PRs in 30d

Description

Matrix users can send state events into the room if the `state_key` matches their MXID (https://spec.matrix.org/v1.7/rooms/v10/#authorization-rules). Live location sharing relies upon this, as any user can share their location by using their own MXID as the state_key.

The client proactively checks to see if the user has permissions to share location, but the logic is flawed. [This part](https://github.com/vector-im/element-android/blob/2b4b5f05eb6d19778e67ace2f86d65b91ba85c85/vector/src/main/java/im/vector/app/features/location/LocationSharingViewModel.kt#L81-L93) of the code invoking the PL checker function only checks to see if the user is allowed to send arbitrary state (with the event type), but does **not check the state_key**.

This means users are unable to share locations unless they have enough PL to send any state, which is not a given.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.