3 files changed, 39 insertions, 24 deletions

diff --git a/api/channel.go b/api/channel.go
index adf125378..70f7eba4b 100644
--- a/api/channel.go
+++ b/api/channel.go
@@ -568,7 +568,7 @@ func updateLastViewedAt(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	Srv.Store.Channel().UpdateLastViewedAt(id, c.Session.UserId)
 
-	message := model.NewMessage(c.Session.TeamId, id, c.Session.UserId, model.ACTION_VIEWED)
+	message := model.NewMessage(c.Session.TeamId, id, c.Session.UserId, model.ACTION_CHANNEL_VIEWED)
 	message.Add("channel_id", id)
 
 	PublishAndForget(message)
@@ -777,9 +777,8 @@ func RemoveUserFromChannel(userIdToRemove string, removerUserId string, channel
 
 	UpdateChannelAccessCacheAndForget(channel.TeamId, userIdToRemove, channel.Id)
 
-	message := model.NewMessage(channel.TeamId, "", userIdToRemove, model.ACTION_USER_REMOVED)
-	message.Add("channel_id", channel.Id)
-	message.Add("remover", removerUserId)
+	message := model.NewMessage(channel.TeamId, channel.Id, userIdToRemove, model.ACTION_USER_REMOVED)
+	message.Add("remover_id", removerUserId)
 	PublishAndForget(message)
 
 	return nil
diff --git a/api/web_conn.go b/api/web_conn.go
index a5099e520..50a003ace 100644
--- a/api/web_conn.go
+++ b/api/web_conn.go
@@ -92,24 +92,9 @@ func (c *WebConn) writePump() {
 				return
 			}
 
-			if len(msg.ChannelId) > 0 {
-				allowed, ok := c.ChannelAccessCache[msg.ChannelId]
-				if !ok {
-					allowed = hasPermissionsToChannel(Srv.Store.Channel().CheckPermissionsTo(c.TeamId, msg.ChannelId, c.UserId))
-					c.ChannelAccessCache[msg.ChannelId] = allowed
-				}
-
-				if allowed {
-					c.WebSocket.SetWriteDeadline(time.Now().Add(WRITE_WAIT))
-					if err := c.WebSocket.WriteJSON(msg); err != nil {
-						return
-					}
-				}
-			} else {
-				c.WebSocket.SetWriteDeadline(time.Now().Add(WRITE_WAIT))
-				if err := c.WebSocket.WriteJSON(msg); err != nil {
-					return
-				}
+			c.WebSocket.SetWriteDeadline(time.Now().Add(WRITE_WAIT))
+			if err := c.WebSocket.WriteJSON(msg); err != nil {
+				return
 			}
 
 		case <-ticker.C:
@@ -121,9 +106,11 @@ func (c *WebConn) writePump() {
 	}
 }
 
-func (c *WebConn) updateChannelAccessCache(channelId string) {
+func (c *WebConn) updateChannelAccessCache(channelId string) bool {
 	allowed := hasPermissionsToChannel(Srv.Store.Channel().CheckPermissionsTo(c.TeamId, channelId, c.UserId))
 	c.ChannelAccessCache[channelId] = allowed
+
+	return allowed
 }
 
 func hasPermissionsToChannel(sc store.StoreChannel) bool {
diff --git a/api/web_team_hub.go b/api/web_team_hub.go
index c57de550f..6a25b7d3d 100644
--- a/api/web_team_hub.go
+++ b/api/web_team_hub.go
@@ -53,7 +53,7 @@ func (h *TeamHub) Start() {
 				}
 			case msg := <-h.broadcast:
 				for webCon := range h.connections {
-					if !(webCon.UserId == msg.UserId && msg.Action == model.ACTION_TYPING) {
+					if ShouldSendEvent(webCon, msg) {
 						select {
 						case webCon.Send <- msg:
 						default:
@@ -86,3 +86,32 @@ func (h *TeamHub) UpdateChannelAccessCache(userId string, channelId string) {
 		}
 	}
 }
+
+func ShouldSendEvent(webCon *WebConn, msg *model.Message) bool {
+
+	if webCon.UserId == msg.UserId {
+		// Don't need to tell the user they are typing
+		if msg.Action == model.ACTION_TYPING {
+			return false
+		}
+	} else {
+		// Don't share a user's view events with other users
+		if msg.Action == model.ACTION_CHANNEL_VIEWED {
+			return false
+		}
+
+		// Only report events to a user who is the subject of the event, or is in the channel of the event
+		if len(msg.ChannelId) > 0 {
+			allowed, ok := webCon.ChannelAccessCache[msg.ChannelId]
+			if !ok {
+				allowed = webCon.updateChannelAccessCache(msg.ChannelId)
+			}
+
+			if !allowed {
+				return false
+			}
+		}
+	}
+
+	return true
+}