element-hq / element-hq/synapse
Don't accept threaded receipts for reactions to/replies to/edits of a thread root
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 6h
- Merged PRs (30d)
- 46
Description
### Description
Previously, the spec implied that threaded receipts were acceptable when referring to thread roots, or reactions to them etc. but this was a spec bug, which is fixed in https://github.com/matrix-org/matrix-spec/pull/1677 . See https://github.com/matrix-org/matrix-spec-proposals/pull/4037 for more detail.
Synapse's code at https://github.com/element-hq/synapse/blob/930dc9e2d3efd6d82b86c2205b80d6ccb9b4bb86/synapse/rest/client/receipts.py#L124-L162 reflects the spec bug, accepting incorrect receipts. It should not accept threaded receipts for events that are not in the thread.
### Steps to reproduce
- Create some messages in a room, including a thread
- Create a reaction to the thread root
- Send a threaded receipt for the reaction, that gives the `thread_id` as the ID of the thread root event, implying that the reaction is in the thread
- Note that Synapse accepts this receipt
Synapse should reject this receipt since a reaction to a thread root is not in the thread.
### Homeserver
matrix.org
### Synapse Version
1.98.0rc1 (b=matrix-org-hotfixes,c2deef254a)
### Installation Method
I don't know
### Database
-
### Workers
Multiple workers
### Platform
-
### Configuration
-
### Relevant log output
```shell
-
```
### Anything else that would be useful to know?
-
Contributor guide
Assessment
This issue has not been assessed yet.