From d10bc67c9d7ca6975c25a2d29c9b4e54e3416e15 Mon Sep 17 00:00:00 2001
From: strawberry <strawberry@puppygock.gay>
Date: Fri, 7 Jun 2024 01:47:06 -0400
Subject: [PATCH] fix(fed): dont reject `/event_auth/` on world readable rooms

Signed-off-by: strawberry <strawberry@puppygock.gay>
---
 src/api/server/event_auth.rs | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/src/api/server/event_auth.rs b/src/api/server/event_auth.rs
index 91770336..1ddf2ce3 100644
--- a/src/api/server/event_auth.rs
+++ b/src/api/server/event_auth.rs
@@ -17,19 +17,23 @@ pub(crate) async fn get_event_authorization_route(
 ) -> Result<get_event_authorization::v1::Response> {
 	let origin = body.origin.as_ref().expect("server is authenticated");
 
-	if !services()
-		.rooms
-		.state_cache
-		.server_in_room(origin, &body.room_id)?
-	{
-		return Err(Error::BadRequest(ErrorKind::forbidden(), "Server is not in room."));
-	}
-
 	services()
 		.rooms
 		.event_handler
 		.acl_check(origin, &body.room_id)?;
 
+	if !services()
+		.rooms
+		.state_accessor
+		.is_world_readable(&body.room_id)?
+		&& !services()
+			.rooms
+			.state_cache
+			.server_in_room(origin, &body.room_id)?
+	{
+		return Err(Error::BadRequest(ErrorKind::forbidden(), "Server is not in room."));
+	}
+
 	let event = services()
 		.rooms
 		.timeline