Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Decentralized reporting requires the reporter to either be in the management room or config.acceptInvitesFromSpace. #475

Open
Tracked by #8
Gnuxie opened this issue Feb 1, 2023 · 0 comments
Labels
T-Other Questions, user support, anything else

Comments

@Gnuxie
Copy link
Contributor

Gnuxie commented Feb 1, 2023

The way room moderator reporting currently seems to work is that the same user is used to relay reports to the management room as is used by Mjolnir to protect rooms. A reporter invites the mjolnir user to a DM in order to send the report, which mjolnir will only accept if the reporter is in the management room or the space specified in config.acceptInvitesFromSpace.

For report-to-moderator to work properly, you'd expect that anyone could invite the relay bot, but this can't be allowed when the same user is being used as the protection and relay roles, not only because accepting any invite is an abuse vector, but also because it conflicts with config.protectAllJoinedRooms. Anyone would be able to use your Mjolnir to protect their rooms just by inviting it.

@H-Shay H-Shay added the T-Other Questions, user support, anything else label Jul 24, 2024
@turt2live turt2live changed the title Decantralized reporting requires the reporter to either be in the management room or config.acceptInvitesFromSpace. Decentralized reporting requires the reporter to either be in the management room or config.acceptInvitesFromSpace. Oct 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
T-Other Questions, user support, anything else
Projects
None yet
Development

No branches or pull requests

2 participants