Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Creating a user might overwrite an existing user with same MXID #467

Open
zh0ra opened this issue Feb 8, 2024 · 2 comments
Open

Creating a user might overwrite an existing user with same MXID #467

zh0ra opened this issue Feb 8, 2024 · 2 comments
Labels
wontfix This will not be worked on

Comments

@zh0ra
Copy link

zh0ra commented Feb 8, 2024

User-Id field is not safe in your admin-panel application. When the admin creates a new user, and fills up the field User-Id the existing id of user, it can lead to overwriting the existing user profile when User-ID is the same as the existing user. Admin user does’t have any warnings about existing user with the same User-Id. That would be good if your application could check user Id and warned admin if it existed when user admin created a new user.

@awesome-manuel
Copy link
Member

The problem is actually in synapse. Here you can see that create and modify use the same HTTP verb (PUT). So synapse can't figure out if we want to create a new user or update an existing user.

Yes, we could work around this by first trying to fetch the user info and only create if it does not exist, but the makes our code much more messy.

@awesome-manuel awesome-manuel added the wontfix This will not be worked on label Apr 18, 2024
@awesome-manuel awesome-manuel changed the title User-Id field is not safe in your admin-panel application. Creating a user might overwrite an existing user with same MXID Apr 23, 2024
@dklimpel
Copy link
Contributor

dklimpel commented Jun 6, 2024

Duplicate to

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
wontfix This will not be worked on
Projects
None yet
Development

No branches or pull requests

3 participants