From 8891adfba316e56931e25fc3788cc276fb2aeaec Mon Sep 17 00:00:00 2001 From: timedout Date: Fri, 18 Sep 2026 18:57:57 +0100 Subject: [PATCH] fix(stateres): Enforce state ownership checks against creators too Previously being a room creator short-circuited the `can_send_event` check, which allowed creators to send state events "owned" (state key starting with @ but not being the sender's user ID), in effect skipping auth check 9 in v12 rooms. This removes that short circuit condition, since `Infinite < Int` always returns false anyway, allowing the state key check block to execute. Fixes #2266 --- src/core/matrix/state_res/event_auth.rs | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/src/core/matrix/state_res/event_auth.rs b/src/core/matrix/state_res/event_auth.rs index 79408beb9..e5693cf78 100644 --- a/src/core/matrix/state_res/event_auth.rs +++ b/src/core/matrix/state_res/event_auth.rs @@ -1120,9 +1120,6 @@ fn can_send_event( ple: Option<&impl Event>, user_level: UserPowerLevel, ) -> bool { - if user_level == UserPowerLevel::Infinite { - return true; - } let event_type_power_level = get_send_level(event.event_type(), event.state_key(), ple); debug!( @@ -1137,8 +1134,9 @@ fn can_send_event( return false; } - if event.state_key().is_some_and(|k| k.starts_with('@')) - && event.state_key() != Some(event.sender().as_str()) + if event + .state_key() + .is_some_and(|k| k.starts_with('@') && k != event.sender().as_str()) { warn!( ?user_level,