element-hq / element-hq/synapse
force "Block anyone not part of demo.com from ever joining this room" (matrix ecosystem) setting in homeserver.yaml
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
In the Element-Web client, when creating a room (private or public) there's an "Advanced" setting for "Block anyone not part of [$FQDN] from ever joining this room" and it also mentions the setting cannot be changed afterwards.
I think that it would be worthwhile to have a homeserver.yaml declaration to force this setting to whatever desired state is desired. On/Off/Forced/Whatever, as there are environments where explicitly controlling this setting I think would be worthwhile.
I'm not sure if this setting is specific to Element-* or what, but this certainly seems like a possible way for data exfiltration/leaking in sensitive ecosystems.
So any chance we could get this please?
Contributor guide
Research direction
Start by tracing the Element-Web room setting and Synapse's homeserver.yaml configuration handling. Clarify whether the setting belongs to Element-Web or Synapse, and define the supported on, off, or forced behavior. Done means the chosen configuration is documented and its effect on room creation and joining is covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100