1 files changed, 19 insertions, 4 deletions

diff --git a/api/command.go b/api/command.go
index 449483bbf..aedbe07cc 100644
--- a/api/command.go
+++ b/api/command.go
@@ -9,6 +9,8 @@ import (
 	"github.com/mattermost/platform/model"
 	"github.com/mattermost/platform/utils"
 	"net/http"
+	"reflect"
+	"runtime"
 	"strconv"
 	"strings"
 )
@@ -19,16 +21,13 @@ var commands = []commandHandler{
 	logoutCommand,
 	joinCommand,
 	loadTestCommand,
+	echoCommand,
 }
 
 func InitCommand(r *mux.Router) {
 	l4g.Debug("Initializing command api routes")
 	r.Handle("/command", ApiUserRequired(command)).Methods("POST")
 
-	if utils.Cfg.TeamSettings.AllowValet {
-		commands = append(commands, echoCommand)
-	}
-
 	hub.Start()
 }
 
@@ -59,6 +58,8 @@ func checkCommand(c *Context, command *model.Command) bool {
 		return false
 	}
 
+	tchan := Srv.Store.Team().Get(c.Session.TeamId)
+
 	if len(command.ChannelId) > 0 {
 		cchan := Srv.Store.Channel().CheckPermissionsTo(c.Session.TeamId, command.ChannelId, c.Session.UserId)
 
@@ -67,7 +68,21 @@ func checkCommand(c *Context, command *model.Command) bool {
 		}
 	}
 
+	allowValet := false
+	if tResult := <-tchan; tResult.Err != nil {
+		c.Err = model.NewAppError("checkCommand", "Could not find the team for this session, team_id="+c.Session.TeamId, "")
+		return false
+	} else {
+		allowValet = tResult.Data.(*model.Team).AllowValet
+	}
+
+	ec := runtime.FuncForPC(reflect.ValueOf(echoCommand).Pointer()).Name()
+
 	for _, v := range commands {
+		if !allowValet && ec == runtime.FuncForPC(reflect.ValueOf(v).Pointer()).Name() {
+			continue
+		}
+
 		if v(c, command) {
 			return true
 		} else if c.Err != nil {