From 047e8d214e7fac103c854a6d164e862101db3cea Mon Sep 17 00:00:00 2001
From: Neil Alexander <neilalexander@users.noreply.github.com>
Date: Thu, 15 Jul 2021 14:01:24 +0100
Subject: [PATCH] Additional checks on federated /event

---
 roomserver/internal/query/query.go | 40 ++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/roomserver/internal/query/query.go b/roomserver/internal/query/query.go
index 4af0e639..e9eff719 100644
--- a/roomserver/internal/query/query.go
+++ b/roomserver/internal/query/query.go
@@ -16,6 +16,7 @@ package query
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 
@@ -389,6 +390,45 @@ func (r *Queryer) QueryServerAllowedToSeeEvent(
 	}
 	roomID := events[0].RoomID()
 
+	isRoomPublicReq := &api.QueryCurrentStateRequest{
+		RoomID: roomID,
+		StateTuples: []gomatrixserverlib.StateKeyTuple{
+			{EventType: gomatrixserverlib.MRoomCreate},
+			{EventType: gomatrixserverlib.MRoomHistoryVisibility},
+		},
+	}
+	isRoomPublicRes := &api.QueryCurrentStateResponse{}
+	if err = r.QueryCurrentState(ctx, isRoomPublicReq, isRoomPublicRes); err != nil {
+		return fmt.Errorf("r.Queryer.QueryCurrentState: %w", err)
+	}
+	for _, event := range isRoomPublicRes.StateEvents {
+		switch event.Type() {
+		case gomatrixserverlib.MRoomCreate:
+			content := struct {
+				Federate bool `json:"m.federate"`
+			}{
+				Federate: true,
+			}
+			if err = json.Unmarshal(event.Content(), &content); err != nil {
+				continue
+			}
+			if !content.Federate {
+				response.AllowedToSeeEvent = false
+				return nil
+			}
+
+		case gomatrixserverlib.MRoomHistoryVisibility:
+			var content gomatrixserverlib.HistoryVisibilityContent
+			if err = json.Unmarshal(event.Content(), &content); err != nil {
+				continue
+			}
+			if content.HistoryVisibility == gomatrixserverlib.Public {
+				response.AllowedToSeeEvent = true
+				return nil
+			}
+		}
+	}
+
 	inRoomReq := &api.QueryServerJoinedToRoomRequest{
 		RoomID:     roomID,
 		ServerName: request.ServerName,