Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Add restrictions by default to open registration in Synapse #12091

Merged
merged 23 commits into from
Mar 25, 2022
Merged
Show file tree
Hide file tree
Changes from 19 commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.d/12091.misc
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Refuse to start if registration is enabled without email or captcha verification unless new config flag `enable_registration_without_verification` is set.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should add a line to https://matrix-org.github.io/synapse/latest/upgrade, as this change will require a subset of administrators to fiddle with their config before their homeserver can start up again.

1 change: 1 addition & 0 deletions demo/start.sh
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ for port in 8080 8081 8082; do
printf '\n\n# Customisation made by demo/start.sh\n'
echo "public_baseurl: http://localhost:$port/"
echo 'enable_registration: true'
echo 'enable_registration_without_verification: true'

# Warning, this heredoc depends on the interaction of tabs and spaces.
# Please don't accidentaly bork me with your fancy settings.
Expand Down
10 changes: 9 additions & 1 deletion docs/sample_config.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -1212,10 +1212,18 @@ oembed:
# Registration can be rate-limited using the parameters in the "Ratelimiting"
# section of this file.

# Enable registration for new users.
# Enable registration for new users. Defaults to 'false'. It is highly recommended that if you enable registration,
# you use either captcha, email, or token-based verification to verify that new users are not bots. In order to enable registration
# without any verification, you must also set `enable_registration_without_verification`, found below.
#
#enable_registration: false

# Enable registration without email or captcha verification. Note: this option is *not* recommended,
# as registration without verification is a known vector for spam and abuse. Defaults to false. Has no effect
# unless `enable_registration` is also enabled.
#
#enable_registration_without_verification: true

# Time that a user's session remains valid for, after they log in.
#
# Note that this is not currently compatible with guest logins.
Expand Down
17 changes: 17 additions & 0 deletions synapse/app/homeserver.py
Original file line number Diff line number Diff line change
Expand Up @@ -348,6 +348,23 @@ def setup(config_options: List[str]) -> SynapseHomeServer:
if config.server.gc_seconds:
synapse.metrics.MIN_TIME_BETWEEN_GCS = config.server.gc_seconds

if (
config.registration.enable_registration
and not config.registration.enable_registration_without_verification
):
if (
not config.captcha.enable_registration_captcha
and not config.registration.registrations_require_3pid
and not config.registration.registration_requires_token
):

raise ConfigError(
"You have enabled open registration without any verification. This is a known vector for "
"spam and abuse. If you have enabled registration, please add email, capcha, or token-based verification, or "
"use the config option `enable_registration_without_verification` in conjunction with `enable_verification."
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"spam and abuse. If you have enabled registration, please add email, capcha, or token-based verification, or "
"use the config option `enable_registration_without_verification` in conjunction with `enable_verification."
"spam and abuse. If you would like to allow public registrations, please consider adding email, captcha, or token-based verification. "
"Otherwise this check can be removed by setting the `enable_registration_without_verification` config option to `true`."

may be a bit clearer.

)
sys.exit(1)
H-Shay marked this conversation as resolved.
Show resolved Hide resolved

hs = SynapseHomeServer(
config.server.server_name,
config=config,
Expand Down
14 changes: 13 additions & 1 deletion synapse/config/registration.py
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,10 @@ def read_config(self, config, **kwargs):
str(config["disable_registration"])
)

self.enable_registration_without_verification = strtobool(
H-Shay marked this conversation as resolved.
Show resolved Hide resolved
str(config.get("enable_registration_without_verification", False))
)

self.registrations_require_3pid = config.get("registrations_require_3pid", [])
self.allowed_local_3pids = config.get("allowed_local_3pids", [])
self.enable_3pid_lookup = config.get("enable_3pid_lookup", True)
Expand Down Expand Up @@ -207,10 +211,18 @@ def generate_config_section(self, generate_secrets=False, **kwargs):
# Registration can be rate-limited using the parameters in the "Ratelimiting"
# section of this file.

# Enable registration for new users.
# Enable registration for new users. Defaults to 'false'. It is highly recommended that if you enable registration,
# you use either captcha, email, or token-based verification to verify that new users are not bots. In order to enable registration
# without any verification, you must also set `enable_registration_without_verification`, found below.
#
#enable_registration: false

# Enable registration without email or captcha verification. Note: this option is *not* recommended,
# as registration without verification is a known vector for spam and abuse. Defaults to false. Has no effect
# unless `enable_registration` is also enabled.
#
#enable_registration_without_verification: true

# Time that a user's session remains valid for, after they log in.
#
# Note that this is not currently compatible with guest logins.
Expand Down
22 changes: 20 additions & 2 deletions tests/config/test_registration_config.py
Original file line number Diff line number Diff line change
Expand Up @@ -11,14 +11,16 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

import synapse.app.homeserver
from synapse.config import ConfigError
from synapse.config.homeserver import HomeServerConfig

from tests.unittest import TestCase
from tests.config.utils import ConfigFileTestCase
from tests.utils import default_config


class RegistrationConfigTestCase(TestCase):
class RegistrationConfigTestCase(ConfigFileTestCase):
def test_session_lifetime_must_not_be_exceeded_by_smaller_lifetimes(self):
"""
session_lifetime should logically be larger than, or at least as large as,
Expand Down Expand Up @@ -76,3 +78,19 @@ def test_session_lifetime_must_not_be_exceeded_by_smaller_lifetimes(self):
HomeServerConfig().parse_config_dict(
{"session_lifetime": "31m", "refresh_token_lifetime": "31m", **config_dict}
)

def test_refuse_to_start_if_open_registration_and_no_verification(self):
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's only config and straight-forward code so it's tempting not to bother, but this is only testing the negative. You may also be tempted to test that startup is able to proceed if both enable_registration and enable_registration_without_verification are true.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm I tested this condition locally and it works. Looking at the test though it feels like it's not necessary to add permanently to the tests. If you feel strongly about it I will, though.

self.generate_config()
self.add_lines_to_config(
[
" ",
"enable_registration: true",
"registrations_require_3pid: []",
"enable_registration_captcha: false",
"registration_requires_token: false",
]
)

# Test that allowing open registration without verification raises an error
with self.assertRaises(ConfigError):
synapse.app.homeserver.setup(["-c", self.config_file])