archive
/
matrix-spec-proposals
mirror of https://github.com/matrix-org/matrix-spec-proposals
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix accidental usage of deactivation where demotion was intended

Browse Source
pull/4165/head
Matthias Ahouansou 1 year ago
parent b4b3223454
commit 156a18d026
No known key found for this signature in database
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File

2
proposals/4165-remove-own-power-level-on-deactivation.md
Unescape Escape View File

@ -4,7 +4,7 @@ When an account is
[deactivated](https://spec.matrix.org/v1.11/client-server-api/#post_matrixclientv3accountdeactivate), the [deactivated](https://spec.matrix.org/v1.11/client-server-api/#post_matrixclientv3accountdeactivate), the
[`m.room.power_levels`](https://spec.matrix.org/v1.11/client-server-api/#mroompower_levels) in rooms the [`m.room.power_levels`](https://spec.matrix.org/v1.11/client-server-api/#mroompower_levels) in rooms the
account is currently in is unmodified. If no other accounts have a higher power level than the deactivated account is currently in is unmodified. If no other accounts have a higher power level than the deactivated
account, the account cannot be deactivated without intervention of the server admin. This leads to potential account, the account cannot be demoted without intervention of the server admin. This leads to potential
security issues, such as if the server is compromised or the domain is later bought by a bad actor, the rooms security issues, such as if the server is compromised or the domain is later bought by a bad actor, the rooms
where deactivated users on that domain had elevated privileges could also become compromised. where deactivated users on that domain had elevated privileges could also become compromised.

Write Preview
Loading…
Cancel
Save