-
-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Conversation
There are a number of instances where a server or admin may puppet a user to join/leave rooms, which we don't want to fail if the user has not consented to the privacy policy. We fix this by adding a check to test if the requester has an associated access_token, which is used as a proxy to answer the question of whether the action is being done on behalf of a real request from the user.
Codecov Report
@@ Coverage Diff @@
## develop #4904 +/- ##
===========================================
- Coverage 59.85% 59.79% -0.06%
===========================================
Files 326 326
Lines 34025 34026 +1
Branches 5613 5612 -1
===========================================
- Hits 20366 20347 -19
- Misses 12235 12254 +19
- Partials 1424 1425 +1 |
Codecov Report
@@ Coverage Diff @@
## develop #4904 +/- ##
==========================================
- Coverage 77.94% 77.6% -0.34%
==========================================
Files 326 326
Lines 34025 34278 +253
Branches 5613 5716 +103
==========================================
+ Hits 26521 26603 +82
- Misses 5878 6033 +155
- Partials 1626 1642 +16 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
the absence of a test makes me sad
synapse/handlers/message.py
Outdated
@@ -388,17 +391,6 @@ def assert_accepted_privacy_policy(self, requester): | |||
if self._block_events_without_consent_error is None: | |||
return | |||
|
|||
# exempt AS users from needing consent |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
do we not still need this? is it covered by the is_exempt clause?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
couple of nits in the tests
tests/rest/client/v1/test_admin.py
Outdated
|
||
other_user = self.register_user("user", "pass") | ||
other_user_token = self.login("user", "pass") | ||
def test_shutdown_room_conset(self): |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
conset
tests/rest/client/v1/test_admin.py
Outdated
|
||
other_user = self.register_user("user", "pass") | ||
other_user_token = self.login("user", "pass") | ||
def test_shutdown_room_conset(self): |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can you add a docstring that explains in slightly more words what you are testing for here?
No description provided.