matrix-continuwuity: 0.5.0-rc.8.1 -> 0.5.0, nixos/matrix-continuwuity: set TimeoutStartSec to account for database migrations (#473790)

This commit is contained in:
Aleksana
2025-12-25 08:21:33 +00:00
committed by GitHub
3 changed files with 6 additions and 59 deletions
@@ -220,6 +220,9 @@ in
User = cfg.user;
Group = cfg.group;
# To avoid timing out during database migrations
TimeoutStartSec = "10m";
DevicePolicy = "closed";
LockPersonality = true;
MemoryDenyWriteExecute = true;
@@ -1,51 +0,0 @@
diff --git a/src/api/server/invite.rs b/src/api/server/invite.rs
index 78a65fe8..d284fedd 100644
--- a/src/api/server/invite.rs
+++ b/src/api/server/invite.rs
@@ -61,6 +61,46 @@ pub(crate) async fn create_invite_route(
let mut signed_event = utils::to_canonical_object(&body.event)
.map_err(|_| err!(Request(InvalidParam("Invite event is invalid."))))?;
+ // Ensure this is a membership event
+ if signed_event
+ .get("type")
+ .expect("event must have a type")
+ .as_str()
+ .expect("type must be a string")
+ != "m.room.member"
+ {
+ return Err!(Request(BadJson(
+ "Not allowed to send non-membership event to invite endpoint."
+ )));
+ }
+
+ let content: RoomMemberEventContent = serde_json::from_value(
+ signed_event
+ .get("content")
+ .ok_or_else(|| err!(Request(BadJson("Event missing content property"))))?
+ .clone()
+ .into(),
+ )
+ .map_err(|e| err!(Request(BadJson(warn!("Event content is empty or invalid: {e}")))))?;
+
+ // Ensure this is an invite membership event
+ if content.membership != MembershipState::Invite {
+ return Err!(Request(BadJson(
+ "Not allowed to send a non-invite membership event to invite endpoint."
+ )));
+ }
+
+ // Ensure the sending user isn't a lying bozo
+ let sender_server = signed_event
+ .get("sender")
+ .try_into()
+ .map(UserId::server_name)
+ .map_err(|e| err!(Request(InvalidParam("Invalid sender property: {e}"))))?;
+ if sender_server != body.origin() {
+ return Err!(Request(Forbidden("Sender's server does not match the origin server.",)));
+ }
+
+ // Ensure the target user belongs to this server
let recipient_user: OwnedUserId = signed_event
.get("state_key")
.try_into()
@@ -77,22 +77,17 @@ let
in
rustPlatform.buildRustPackage (finalAttrs: {
pname = "matrix-continuwuity";
version = "0.5.0-rc.8.1";
version = "0.5.0";
src = fetchFromGitea {
domain = "forgejo.ellis.link";
owner = "continuwuation";
repo = "continuwuity";
tag = "v${finalAttrs.version}";
hash = "sha256-UHlKAYgIkVtZJV+H2Xl7HssV03Q3XNxluMfLRY2e+Do=";
hash = "sha256-k+B7OjOoVd/vcy/jKBEXAXOolnWt4RoPhJucMwYxyEk=";
};
# https://forgejo.ellis.link/continuwuation/continuwuity/commit/b2bead67ac8bc45de9a612578f295e5b7fc6c2b5
# https://forgejo.ellis.link/continuwuation/continuwuity/commit/7fa4fa98628593c1a963f5aa8dbc3657d604b047
# this patch is probably unneeded with the next release
patches = [ ./continuwuity-exploit-fix.diff ];
cargoHash = "sha256-imfpl+72zlqeEREdTGFG3bsMdPTXe/sb1uGvMC6BGT0=";
cargoHash = "sha256-xqP2wOaGJEcn/ZF8u1Ol6j7zyr/3dLHKU6eYQfIBr7o=";
nativeBuildInputs = [
pkg-config