{"action":"closed","issue":{"url":"https://api.github.com/repos/matrix-org/synapse/issues/2402","repository_url":"https://api.github.com/repos/matrix-org/synapse","labels_url":"https://api.github.com/repos/matrix-org/synapse/issues/2402/labels{/name}","comments_url":"https://api.github.com/repos/matrix-org/synapse/issues/2402/comments","events_url":"https://api.github.com/repos/matrix-org/synapse/issues/2402/events","html_url":"https://github.com/matrix-org/synapse/issues/2402","id":247589236,"number":2402,"title":"m.room.power_levels cannot restrict m.room.aliases","user":{"login":"turt2live","id":1190097,"avatar_url":"https://avatars2.githubusercontent.com/u/1190097?v=4","gravatar_id":"","url":"https://api.github.com/users/turt2live","html_url":"https://github.com/turt2live","followers_url":"https://api.github.com/users/turt2live/followers","following_url":"https://api.github.com/users/turt2live/following{/other_user}","gists_url":"https://api.github.com/users/turt2live/gists{/gist_id}","starred_url":"https://api.github.com/users/turt2live/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/turt2live/subscriptions","organizations_url":"https://api.github.com/users/turt2live/orgs","repos_url":"https://api.github.com/users/turt2live/repos","events_url":"https://api.github.com/users/turt2live/events{/privacy}","received_events_url":"https://api.github.com/users/turt2live/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-08-03T04:29:47Z","updated_at":"2018-05-16T20:21:06Z","closed_at":"2018-05-16T20:21:06Z","author_association":"CONTRIBUTOR","body":"It seems as though the power level check doesn't restrict users from adding additional room aliases. Here's the room configuration used to test:\r\n\r\n`m.room.power_levels`:\r\n```\r\n{\r\n  \"events_default\": 0,\r\n  \"invite\": 0,\r\n  \"state_default\": 50,\r\n  \"redact\": 50,\r\n  \"ban\": 50,\r\n  \"users_default\": 0,\r\n  \"events\": {\r\n    \"m.room.avatar\": 50,\r\n    \"m.room.name\": 50,\r\n    \"m.room.canonical_alias\": 50,\r\n    \"m.room.history_visibility\": 100,\r\n    \"m.room.power_levels\": 100,\r\n    \"m.room.aliases\": 50\r\n  },\r\n  \"kick\": 50,\r\n  \"users\": {\r\n    \"@travis:t2l.io\": 100\r\n  }\r\n}\r\n```\r\n\r\nRoom members:\r\n* `@travis:t2l.io` - Myself (PL100)\r\n* `@turt2live:matrix.org` - Myself (PL0 - Plain user)\r\n\r\nAfter publishing the `m.room.power_levels` event above, the matrix.org user can still add aliases to the room."}}
{"actor":{"display_login":"turt2live"}}