From 81bf4b71506822d91b3317c4de484aaabb7a5984 Mon Sep 17 00:00:00 2001
From: strawberry <strawberry@puppygock.gay>
Date: Sun, 26 May 2024 15:22:19 -0400
Subject: [PATCH] check user ID server against ACLs for /make_leave

Signed-off-by: strawberry <strawberry@puppygock.gay>
---
 src/api/server_server.rs | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/api/server_server.rs b/src/api/server_server.rs
index ecf2f571..47b8f4de 100644
--- a/src/api/server_server.rs
+++ b/src/api/server_server.rs
@@ -1302,7 +1302,21 @@ pub(crate) async fn create_leave_event_template_route(
 	services()
 		.rooms
 		.event_handler
-		.acl_check(sender_servername, &body.room_id)?;
+		.acl_check(origin, &body.room_id)?;
+
+	// ACL check invited user server name
+	services()
+		.rooms
+		.event_handler
+		.acl_check(body.user_id.server_name(), &body.room_id)?;
+
+	// check if origin server is trying to send for another server
+	if body.user_id.server_name() != origin {
+		return Err(Error::BadRequest(
+			ErrorKind::InvalidParam,
+			"Not allowed to leave on behalf of another server/user",
+		));
+	}
 
 	let room_version_id = services().rooms.state.get_room_version(&body.room_id)?;