Skip to content

Commit

Permalink
Don't allow previewing shared history rooms
Browse files Browse the repository at this point in the history
Only `world_readable` can be considered as opting into having history publicly on the web. Anything else must not be archived until there's a dedicated state event for opting into archiving.
  • Loading branch information
tulir authored May 30, 2023
1 parent ff4c948 commit d1a4117
Showing 1 changed file with 3 additions and 5 deletions.
8 changes: 3 additions & 5 deletions server/routes/room-routes.js
Original file line number Diff line number Diff line change
Expand Up @@ -828,15 +828,13 @@ router.get(
}),
]);

// Only `world_readable` or `shared` rooms that are `public` are viewable in the archive
const allowedToViewRoom =
roomData.historyVisibility === 'world_readable' ||
(roomData.historyVisibility === 'shared' && roomData.joinRule === 'public');
// Only `world_readable` rooms are viewable in the archive
const allowedToViewRoom = roomData.historyVisibility === 'world_readable';

if (!allowedToViewRoom) {
throw new StatusError(
403,
`Only \`world_readable\` or \`shared\` rooms that are \`public\` can be viewed in the archive. ${roomData.id} has m.room.history_visiblity=${roomData.historyVisibility} m.room.join_rules=${roomData.joinRule}`
`Only \`world_readable\` rooms can be viewed in the archive. ${roomData.id} has m.room.history_visiblity=${roomData.historyVisibility} m.room.join_rules=${roomData.joinRule}`
);
}

Expand Down

0 comments on commit d1a4117

Please sign in to comment.