Fixing permissions issue when deleting slash commands (#4414)

2 files changed, 20 insertions, 3 deletions

diff --git a/api/command.go b/api/command.go
index 5cf9d730b..e71661a67 100644
--- a/api/command.go
+++ b/api/command.go
@@ -415,7 +415,7 @@ func deleteCommand(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.Err = result.Err
 		return
 	} else {
-		if c.TeamId != result.Data.(*model.Command).TeamId || (c.Session.UserId != result.Data.(*model.Command).CreatorId && HasPermissionToCurrentTeamContext(c, model.PERMISSION_MANAGE_OTHERS_SLASH_COMMANDS)) {
+		if c.TeamId != result.Data.(*model.Command).TeamId || (c.Session.UserId != result.Data.(*model.Command).CreatorId && !HasPermissionToCurrentTeamContext(c, model.PERMISSION_MANAGE_OTHERS_SLASH_COMMANDS)) {
 			c.LogAudit("fail - inappropriate permissions")
 			c.Err = model.NewLocAppError("deleteCommand", "api.command.delete.app_error", nil, "user_id="+c.Session.UserId)
 			return
diff --git a/api/command_test.go b/api/command_test.go
index 9c0b34085..7a78d350d 100644
--- a/api/command_test.go
+++ b/api/command_test.go
@@ -146,14 +146,17 @@ func TestRegenToken(t *testing.T) {
 }
 
 func TestDeleteCommand(t *testing.T) {
-	th := Setup().InitSystemAdmin()
+	th := Setup().InitBasic().InitSystemAdmin()
 	Client := th.SystemAdminClient
 
 	enableCommands := *utils.Cfg.ServiceSettings.EnableCommands
+	onlyAdminIntegration := *utils.Cfg.ServiceSettings.EnableOnlyAdminIntegrations
 	defer func() {
-		utils.Cfg.ServiceSettings.EnableCommands = &enableCommands
+		*utils.Cfg.ServiceSettings.EnableCommands = enableCommands
+		*utils.Cfg.ServiceSettings.EnableOnlyAdminIntegrations = onlyAdminIntegration
 	}()
 	*utils.Cfg.ServiceSettings.EnableCommands = true
+	*utils.Cfg.ServiceSettings.EnableOnlyAdminIntegrations = false
 
 	cmd := &model.Command{URL: "http://nowhere.com", Method: model.COMMAND_METHOD_POST, Trigger: "trigger"}
 	cmd = Client.Must(Client.CreateCommand(cmd)).Data.(*model.Command)
@@ -169,6 +172,20 @@ func TestDeleteCommand(t *testing.T) {
 	if len(cmds) != 0 {
 		t.Fatal("delete didn't work properly")
 	}
+
+	cmd2 := &model.Command{URL: "http://nowhere.com", Method: model.COMMAND_METHOD_POST, Trigger: "trigger2"}
+	cmd2 = Client.Must(Client.CreateCommand(cmd2)).Data.(*model.Command)
+
+	data2 := make(map[string]string)
+	data2["id"] = cmd2.Id
+	if _, err := th.BasicClient.DeleteCommand(data2); err == nil {
+		t.Fatal("Should have errored. Your not allowed to delete other's commands")
+	}
+
+	cmds2 := Client.Must(Client.ListTeamCommands()).Data.([]*model.Command)
+	if len(cmds2) != 1 {
+		t.Fatal("Client was able to delete command without permission.")
+	}
 }
 
 func TestTestCommand(t *testing.T) {