Skip to content
This repository was archived by the owner on Apr 26, 2024. It is now read-only.

Commit 11523b5

Browse files
Only assert valid next_link params when provided (#65)
Bug introduced in matrix-org/synapse-dinsic@ff91a451b We were checking whether the `nextLink` param was valid, even if it wasn't provided. In that case, `nextLink` was `None`, which would clearly not be a valid URL. This would prevent password reset and other operations if `nextLink` was not provided and the `next_link_domain_whitelist` config option was in use.
1 parent c3bca37 commit 11523b5

File tree

2 files changed

+10
-6
lines changed

2 files changed

+10
-6
lines changed

changelog.d/65.bugfix

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Fix `nextLink` parameters being checked on validation endpoints even if they weren't provided by the client.

synapse/rest/client/v2_alpha/account.py

+9-6
Original file line numberDiff line numberDiff line change
@@ -111,8 +111,9 @@ async def on_POST(self, request):
111111
Codes.THREEPID_DENIED,
112112
)
113113

114-
# Raise if the provided next_link value isn't valid
115-
assert_valid_next_link(self.hs, next_link)
114+
if next_link:
115+
# Raise if the provided next_link value isn't valid
116+
assert_valid_next_link(self.hs, next_link)
116117

117118
# The email will be sent to the stored address.
118119
# This avoids a potential account hijack by requesting a password reset to
@@ -462,8 +463,9 @@ async def on_POST(self, request):
462463
Codes.THREEPID_DENIED,
463464
)
464465

465-
# Raise if the provided next_link value isn't valid
466-
assert_valid_next_link(self.hs, next_link)
466+
if next_link:
467+
# Raise if the provided next_link value isn't valid
468+
assert_valid_next_link(self.hs, next_link)
467469

468470
existing_user_id = await self.store.get_user_id_by_threepid("email", email)
469471

@@ -533,8 +535,9 @@ async def on_POST(self, request):
533535
Codes.THREEPID_DENIED,
534536
)
535537

536-
# Raise if the provided next_link value isn't valid
537-
assert_valid_next_link(self.hs, next_link)
538+
if next_link:
539+
# Raise if the provided next_link value isn't valid
540+
assert_valid_next_link(self.hs, next_link)
538541

539542
existing_user_id = await self.store.get_user_id_by_threepid("msisdn", msisdn)
540543

0 commit comments

Comments
 (0)