element-hq / element-hq/synapse

HTTP 500 if you try to set membership to "join" for a federated account

Open
#11,598 0 comments 0 reactions 0 assignees View on GitHub
A-Federation A-Membership S-Minor T-Defect
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#11598](https://github.com/matrix-org/synapse/issues/11598).

---

### Description

If you try to set a custom `m.room.member` state event, a lot of things are caught and result in an HTTP 400. Membership value is invalid? HTTP 400. State key is no Matrix ID? HTTP 400.

However, if both are valid and you set membership to `"join"` for someone other than you, you get an HTTP 500.

### Steps to reproduce

- Create a room (any room where you're a moderator).
- Send an `m.room.member` state event with any Matrix-ID-looking value other than your Matrix ID. The content must be `{"membership": "join"}`.

I expect this to be an HTTP 400, telling me that I cannot join others without their interaction. I can set their membership to "invite", "leave" and "ban" but not "invite" (or "knock").

### Version information

- **Homeserver**:

If not matrix.org: vector.modular.im

- **Version**: 1.48.0, maybe?

- **Install method**: EMS

- **Platform**: EMS

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.