Check third party rules before persisting knocks over federation (#10212)

anoadragon453 · web-flow · commit 182147195b70 · 2021-06-21T11:57:09.000+01:00
An accidental mis-ordering of operations during #6739 technically allowed an incoming knock event over federation in before checking it against any configured Third Party Access Rules modules. This PR corrects that by performing the TPAR check *before* persisting the event.
diff --git a/changelog.d/10212.feature b/changelog.d/10212.feature
@@ -0,0 +1 @@
+Implement "room knocking" as per [MSC2403](https://github.com/matrix-org/matrix-doc/pull/2403). Contributed by Sorunome and anoa.
diff --git a/synapse/handlers/federation.py b/synapse/handlers/federation.py
@@ -2086,8 +2086,6 @@ async def on_send_knock_request(
 
         context = await self.state_handler.compute_event_context(event)
 
-        await self._auth_and_persist_event(origin, event, context)
-
         event_allowed = await self.third_party_event_rules.check_event_allowed(
             event, context
         )
@@ -2097,6 +2095,8 @@ async def on_send_knock_request(
                 403, "This event is not allowed in this context", Codes.FORBIDDEN
             )
 
+        await self._auth_and_persist_event(origin, event, context)
+
         return context
 
     async def get_state_for_pdu(self, room_id: str, event_id: str) -> List[EventBase]:

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+Implement "room knocking" as per [MSC2403](https://github.com/matrix-org/matrix-doc/pull/2403). Contributed by Sorunome and anoa.`
Original file line number	Diff line number	Diff line change
`@@ -2086,8 +2086,6 @@ async def on_send_knock_request(`
`2086`	`2086`
`2087`	`2087`	`context = await self.state_handler.compute_event_context(event)`
`2088`	`2088`
`2089`		`- await self._auth_and_persist_event(origin, event, context)`
`2090`		`-`
`2091`	`2089`	`event_allowed = await self.third_party_event_rules.check_event_allowed(`
`2092`	`2090`	`event, context`
`2093`	`2091`	`)`
`@@ -2097,6 +2095,8 @@ async def on_send_knock_request(`
`2097`	`2095`	`403, "This event is not allowed in this context", Codes.FORBIDDEN`
`2098`	`2096`	`)`
`2099`	`2097`
	`2098`	`+ await self._auth_and_persist_event(origin, event, context)`
	`2099`	`+`
`2100`	`2100`	`return context`
`2101`	`2101`
`2102`	`2102`	`async def get_state_for_pdu(self, room_id: str, event_id: str) -> List[EventBase]:`