Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Add some configuration settings to make profile data more private #9203

Merged
merged 1 commit into from
Feb 19, 2021
Merged

Add some configuration settings to make profile data more private #9203

merged 1 commit into from
Feb 19, 2021

Conversation

AndrewFerr
Copy link
Member

This adds two off-by-default settings that each restrict access to profile data (displaynames and avatars):

  • include_profile_data_on_invite: If false, prevents invite events from including the invitee's profile data. Otherwise, all it takes for someone to access any user's profile data is to know/guess their mxid and invite them to a room.
  • allow_profile_lookup_over_federation: If false, causes any requests for profile data over federation to respond with M_FORBIDDEN.

I've had these tweaks on my own server for quite some time now, and felt it would be helpful to share them.

Pull Request Checklist

  • Pull request is based on the develop branch
  • Pull request includes a changelog file. The entry should:
    • Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from EventStore to EventWorkerStore.".
    • Use markdown where necessary, mostly for code blocks.
    • End with either a period (.) or an exclamation mark (!).
    • Start with a capital letter.
  • Pull request includes a sign off
  • Code style is correct (run the linters)

@clokep clokep requested a review from a team January 22, 2021 12:12
@clokep
Copy link
Member

clokep commented Jan 22, 2021

@AndrewFerr Can you regenerate the sample config for the updates, you should be able to run ./scripts-dev/generate_sample_config to do it. Thanks!

erikjohnston
erikjohnston suggested changes Jan 27, 2021
View reviewed changes
Copy link
Member

@erikjohnston erikjohnston left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Broadly looks good, thanks! Just a few minor things that could be tidied up

synapse/handlers/message.py Outdated
@@ -381,6 +381,12 @@ def __init__(self, hs: "HomeServer"):

self.room_invite_state_types = self.hs.config.room_invite_state_types

self.event_types_to_include_profile_data_in = (
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should probably be called membership_types_...?

synapse/handlers/profile.py Outdated
if (
not self.hs.config.allow_profile_lookup_over_federation
and args.get("origin") != self.hs.hostname
):
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this is only called from the federation API I think we can just not bother with the check args.get("origin") != self.hs.hostname? I think a) it makes it simpler and b) we are sort of trying to limit the places where we do these sort of checks to make any future vhosting efforts easier.

Since you're there could you also add a docstring to the function, something like:

async def on_profile_query(self, args: JsonDict) -> JsonDict:
    """Handles federation profile query requests.
    """

@clokep
Copy link
Member

clokep commented Jan 28, 2021

@AndrewFerr Looks like this needs some style fixed up! You can run ./scripts-dev/lint.sh to do this automatically (although the fix in this case is pretty simple).

@AndrewFerr
Copy link
Member Author

@AndrewFerr Looks like this needs some style fixed up! You can run ./scripts-dev/lint.sh to do this automatically (although the fix in this case is pretty simple).

Sorry about that! The change was so small I assumed it wouldn't need to be linted again. Lesson learned :)

@clokep
Copy link
Member

clokep commented Feb 1, 2021

Arg and now this seems to be hitting the py3.5 failure which was fixed on develop. We'll need to merge develop into this branch to fix that. 😢

@AndrewFerr
Copy link
Member Author

AndrewFerr commented Feb 1, 2021 via email

@AndrewFerr
Add configs to make profile data more private
18cf17e 
Add off-by-default configuration settings to:
- disable putting an invitee's profile info in invite events
- disable profile lookup via federation

Signed-off-by: Andrew Ferrazzutti <[email protected]>
erikjohnston
erikjohnston approved these changes Feb 19, 2021
View reviewed changes
Copy link
Member

@erikjohnston erikjohnston left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for taking so long to get back to this!

@erikjohnston erikjohnston merged commit 9bc7474 into matrix-org:develop Feb 19, 2021
netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this pull request Mar 14, 2021
@Midar
Update chat/matrix-synapse to 1.29.0
d5b1cc5 
Synapse 1.29.0 (2021-03-08)
===========================

Note that synapse now expects an `X-Forwarded-Proto` header when used with a reverse proxy. Please see [UPGRADE.rst](UPGRADE.rst#upgrading-to-v1290) for more details on this change.


No significant changes.


Synapse 1.29.0rc1 (2021-03-04)
==============================

Features
--------

- Add rate limiters to cross-user key sharing requests. ([\#8957](matrix-org/synapse#8957))
- Add `order_by` to the admin API `GET /_synapse/admin/v1/users/<user_id>/media`. Contributed by @dklimpel. ([\#8978](matrix-org/synapse#8978))
- Add some configuration settings to make users' profile data more private. ([\#9203](matrix-org/synapse#9203))
- The `no_proxy` and `NO_PROXY` environment variables are now respected in proxied HTTP clients with the lowercase form taking precedence if both are present. Additionally, the lowercase `https_proxy` environment variable is now respected in proxied HTTP clients on top of existing support for the uppercase `HTTPS_PROXY` form and takes precedence if both are present. Contributed by Timothy Leung. ([\#9372](matrix-org/synapse#9372))
- Add a configuration option, `user_directory.prefer_local_users`, which when enabled will make it more likely for users on the same server as you to appear above other users. ([\#9383](matrix-org/synapse#9383), [\#9385](matrix-org/synapse#9385))
- Add support for regenerating thumbnails if they have been deleted but the original image is still stored. ([\#9438](matrix-org/synapse#9438))
- Add support for `X-Forwarded-Proto` header when using a reverse proxy. ([\#9472](matrix-org/synapse#9472), [\#9501](matrix-org/synapse#9501), [\#9512](matrix-org/synapse#9512), [\#9539](matrix-org/synapse#9539))


Bugfixes
--------

- Fix a bug where users' pushers were not all deleted when they deactivated their account. ([\#9285](matrix-org/synapse#9285), [\#9516](matrix-org/synapse#9516))
- Fix a bug where a lot of unnecessary presence updates were sent when joining a room. ([\#9402](matrix-org/synapse#9402))
- Fix a bug that caused multiple calls to the experimental `shared_rooms` endpoint to return stale results. ([\#9416](matrix-org/synapse#9416))
- Fix a bug in single sign-on which could cause a "No session cookie found" error. ([\#9436](matrix-org/synapse#9436))
- Fix bug introduced in v1.27.0 where allowing a user to choose their own username when logging in via single sign-on did not work unless an `idp_icon` was defined. ([\#9440](matrix-org/synapse#9440))
- Fix a bug introduced in v1.26.0 where some sequences were not properly configured when running `synapse_port_db`. ([\#9449](matrix-org/synapse#9449))
- Fix deleting pushers when using sharded pushers. ([\#9465](matrix-org/synapse#9465), [\#9466](matrix-org/synapse#9466), [\#9479](matrix-org/synapse#9479), [\#9536](matrix-org/synapse#9536))
- Fix missing startup checks for the consistency of certain PostgreSQL sequences. ([\#9470](matrix-org/synapse#9470))
- Fix a long-standing bug where the media repository could leak file descriptors while previewing media. ([\#9497](matrix-org/synapse#9497))
- Properly purge the event chain cover index when purging history. ([\#9498](matrix-org/synapse#9498))
- Fix missing chain cover index due to a schema delta not being applied correctly. Only affected servers that ran development versions. ([\#9503](matrix-org/synapse#9503))
- Fix a bug introduced in v1.25.0 where `/_synapse/admin/join/` would fail when given a room alias. ([\#9506](matrix-org/synapse#9506))
- Prevent presence background jobs from running when presence is disabled. ([\#9530](matrix-org/synapse#9530))
- Fix rare edge case that caused a background update to fail if the server had rejected an event that had duplicate auth events. ([\#9537](matrix-org/synapse#9537))


Improved Documentation
----------------------

- Update the example systemd config to propagate reloads to individual units. ([\#9463](matrix-org/synapse#9463))


Internal Changes
----------------

- Add documentation and type hints to `parse_duration`. ([\#9432](matrix-org/synapse#9432))
- Remove vestiges of `uploads_path` configuration setting. ([\#9462](matrix-org/synapse#9462))
- Add a comment about systemd-python. ([\#9464](matrix-org/synapse#9464))
- Test that we require validated email for email pushers. ([\#9496](matrix-org/synapse#9496))
- Allow python to generate bytecode for synapse. ([\#9502](matrix-org/synapse#9502))
- Fix incorrect type hints. ([\#9515](matrix-org/synapse#9515), [\#9518](matrix-org/synapse#9518))
- Add type hints to device and event report admin API. ([\#9519](matrix-org/synapse#9519))
- Add type hints to user admin API. ([\#9521](matrix-org/synapse#9521))
- Bump the versions of mypy and mypy-zope used for static type checking. ([\#9529](matrix-org/synapse#9529))
@H-Shay H-Shay mentioned this pull request Dec 8, 2021
Merged
@Bubu Bubu mentioned this pull request Mar 4, 2021
Closed
@dkasak dkasak mentioned this pull request Jul 19, 2022
Closed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@erikjohnston erikjohnston erikjohnston approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@AndrewFerr @clokep @erikjohnston