Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Decantralized reporting requires the reporter to either be in the management room or config.acceptInvitesFromSpace. #475

Open
Tracked by #8
Gnuxie opened this issue Feb 1, 2023 · 0 comments

Comments

@Gnuxie
Copy link
Contributor

Gnuxie commented Feb 1, 2023

The way room moderator reporting currently seems to work is that the same user is used to relay reports to the management room as is used by Mjolnir to protect rooms. A reporter invites the mjolnir user to a DM in order to send the report, which mjolnir will only accept if the reporter is in the management room or the space specified in config.acceptInvitesFromSpace.

For report-to-moderator to work properly, you'd expect that anyone could invite the relay bot, but this can't be allowed when the same user is being used as the protection and relay roles, not only because accepting any invite is an abuse vector, but also because it conflicts with config.protectAllJoinedRooms. Anyone would be able to use your Mjolnir to protect their rooms just by inviting it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant