Skip to content

Commit f1e01dd

Browse files
anoadragon453phil-flex
authored andcommitted
Ensure 'deactivated' parameter is a boolean on user admin API, Fix error handling of call to deactivate user (matrix-org#6990)
1 parent 61ac743 commit f1e01dd

File tree

2 files changed

+8
-4
lines changed

2 files changed

+8
-4
lines changed

changelog.d/6990.bugfix

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Prevent user from setting 'deactivated' to anything other than a bool on the v2 PUT /users Admin API.

synapse/rest/admin/users.py

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -226,13 +226,16 @@ async def on_PUT(self, request, user_id):
226226
)
227227

228228
if "deactivated" in body:
229-
deactivate = bool(body["deactivated"])
229+
deactivate = body["deactivated"]
230+
if not isinstance(deactivate, bool):
231+
raise SynapseError(
232+
400, "'deactivated' parameter is not of type boolean"
233+
)
234+
230235
if deactivate and not user["deactivated"]:
231-
result = await self.deactivate_account_handler.deactivate_account(
236+
await self.deactivate_account_handler.deactivate_account(
232237
target_user.to_string(), False
233238
)
234-
if not result:
235-
raise SynapseError(500, "Could not deactivate user")
236239

237240
user = await self.admin_handler.get_user(target_user)
238241
return 200, user

0 commit comments

Comments
 (0)