dfuchss / matrixjoinlink Goto Github PK

Current behavior

Any permitted user of the bot can manage JoinLinks for any room the bot is present in. Neither the users presence in the target room nor any permissions for the user is required.
This is problematic in the following scenario:

1. Create a private room, invite the JoinLink bot and give it the appropriate permissions.
2. Switch to a second user who (is not in the room|does not have a powerlevel sufficient to send invite others) but in the allowed user for the JoinLink bot.
3. (2nd User) Send a !join link <room-id> MyTestLink command to the JoinLink bot
4. A invite link is generated/the existing one is sent to the user.
5. The user, previously not invited, now can join the room in question or invite others when they should not be able to.

In the same schema, any user is able to unlink any arbitrary room without the need for them to be present in the affected room.

Proposed behavior

It should be verified whether the user (un)linking the room is

1. Member of the room¹ AND
2. Has a powerlevel that's sufficient for inviting users.

Motivation

I'd like to offer the functionality provided by this bot to all users on the server (Thank you for building it!). However, I do not feel comfortable with doing so when it effectively allows anyone to join into arbitrary rooms one was not supposed to be invited to.