fix: Forbid creating events sent by remote users

2026-05-26 20:49:55 +00:00 · 2026-04-05 22:18:05 +01:00
parent 3ab1f102dd
commit 688cd8f46a
1 changed files with 5 additions and 0 deletions
@@ -81,6 +81,11 @@ pub async fn create_hash_and_sign_event(
 			))
 		}
 	}
+
+	if !self.services.globals.user_is_local(sender) {
+		return Err!(Request(Forbidden("Sender must be a local user")));
+	}
+
 	let PduBuilder {
 		event_type,
 		content,