summaryrefslogtreecommitdiffstats
path: root/api
diff options
context:
space:
mode:
Diffstat (limited to 'api')
-rw-r--r--api/context.go4
-rw-r--r--api/post.go2
-rw-r--r--api/team.go36
-rw-r--r--api/user.go87
-rw-r--r--api/user_test.go1
5 files changed, 78 insertions, 52 deletions
diff --git a/api/context.go b/api/context.go
index aaf304e2c..2beea2408 100644
--- a/api/context.go
+++ b/api/context.go
@@ -285,7 +285,7 @@ func (c *Context) HasPermissionsToChannel(sc store.StoreChannel, where string) b
}
func (c *Context) IsSystemAdmin() bool {
- if strings.Contains(c.Session.Roles, model.ROLE_SYSTEM_ADMIN) && IsPrivateIpAddress(c.IpAddress) {
+ if model.IsInRole(c.Session.Roles, model.ROLE_SYSTEM_ADMIN) && IsPrivateIpAddress(c.IpAddress) {
return true
}
return false
@@ -297,7 +297,7 @@ func (c *Context) IsTeamAdmin(userId string) bool {
return false
} else {
user := uresult.Data.(*model.User)
- return strings.Contains(c.Session.Roles, model.ROLE_ADMIN) && user.TeamId == c.Session.TeamId
+ return model.IsInRole(c.Session.Roles, model.ROLE_ADMIN) && user.TeamId == c.Session.TeamId
}
}
diff --git a/api/post.go b/api/post.go
index 5363fdf79..f969dd031 100644
--- a/api/post.go
+++ b/api/post.go
@@ -716,7 +716,7 @@ func deletePost(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
- if post.UserId != c.Session.UserId && !strings.Contains(c.Session.Roles, model.ROLE_ADMIN) {
+ if post.UserId != c.Session.UserId && !model.IsInRole(c.Session.Roles, model.ROLE_ADMIN) {
c.Err = model.NewAppError("deletePost", "You do not have the appropriate permissions", "")
c.Err.StatusCode = http.StatusForbidden
return
diff --git a/api/team.go b/api/team.go
index 8cce384c3..8c0be9486 100644
--- a/api/team.go
+++ b/api/team.go
@@ -239,47 +239,55 @@ func createTeamFromSignup(c *Context, w http.ResponseWriter, r *http.Request) {
}
func createTeam(c *Context, w http.ResponseWriter, r *http.Request) {
+ team := model.TeamFromJson(r.Body)
+ rteam := CreateTeam(c, team)
+ if c.Err != nil {
+ return
+ }
+
+ w.Write([]byte(rteam.ToJson()))
+}
+
+func CreateTeam(c *Context, team *model.Team) *model.Team {
if utils.Cfg.ServiceSettings.DisableEmailSignUp {
c.Err = model.NewAppError("createTeam", "Team sign-up with email is disabled.", "")
c.Err.StatusCode = http.StatusNotImplemented
- return
+ return nil
}
- team := model.TeamFromJson(r.Body)
-
if team == nil {
c.SetInvalidParam("createTeam", "team")
- return
+ return nil
}
if !isTreamCreationAllowed(c, team.Email) {
- return
+ return nil
}
if utils.Cfg.ServiceSettings.Mode != utils.MODE_DEV {
- c.Err = model.NewAppError("createTeam", "The mode does not allow network creation without a valid invite", "")
- return
+ c.Err = model.NewAppError("CreateTeam", "The mode does not allow network creation without a valid invite", "")
+ return nil
}
if result := <-Srv.Store.Team().Save(team); result.Err != nil {
c.Err = result.Err
- return
+ return nil
} else {
rteam := result.Data.(*model.Team)
if _, err := CreateDefaultChannels(c, rteam.Id); err != nil {
c.Err = err
- return
+ return nil
}
if rteam.AllowValet {
CreateValet(c, rteam)
if c.Err != nil {
- return
+ return nil
}
}
- w.Write([]byte(rteam.ToJson()))
+ return rteam
}
}
@@ -467,7 +475,7 @@ func InviteMembers(c *Context, team *model.Team, user *model.User, invites []str
sender := user.GetDisplayName()
senderRole := ""
- if strings.Contains(user.Roles, model.ROLE_ADMIN) || strings.Contains(user.Roles, model.ROLE_SYSTEM_ADMIN) {
+ if model.IsInRole(user.Roles, model.ROLE_ADMIN) || model.IsInRole(user.Roles, model.ROLE_SYSTEM_ADMIN) {
senderRole = "administrator"
} else {
senderRole = "member"
@@ -526,7 +534,7 @@ func updateTeamDisplayName(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
- if !strings.Contains(c.Session.Roles, model.ROLE_ADMIN) {
+ if !model.IsInRole(c.Session.Roles, model.ROLE_ADMIN) {
c.Err = model.NewAppError("updateTeamDisplayName", "You do not have the appropriate permissions", "userId="+c.Session.UserId)
c.Err.StatusCode = http.StatusForbidden
return
@@ -566,7 +574,7 @@ func updateValetFeature(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
- if !strings.Contains(c.Session.Roles, model.ROLE_ADMIN) {
+ if !model.IsInRole(c.Session.Roles, model.ROLE_ADMIN) {
c.Err = model.NewAppError("updateValetFeature", "You do not have the appropriate permissions", "userId="+c.Session.UserId)
c.Err.StatusCode = http.StatusForbidden
return
diff --git a/api/user.go b/api/user.go
index d69244fad..f4ebcaaf8 100644
--- a/api/user.go
+++ b/api/user.go
@@ -925,7 +925,16 @@ func updateRoles(c *Context, w http.ResponseWriter, r *http.Request) {
}
new_roles := props["new_roles"]
- // no check since we allow the clearing of Roles
+ if model.IsValidRoles(new_roles) {
+ c.SetInvalidParam("updateRoles", "new_roles")
+ return
+ }
+
+ if model.IsInRole(new_roles, model.ROLE_SYSTEM_ADMIN) {
+ c.Err = model.NewAppError("updateRoles", "The system_admin role can only be set from the command line", "")
+ c.Err.StatusCode = http.StatusForbidden
+ return
+ }
var user *model.User
if result := <-Srv.Store.User().Get(user_id); result.Err != nil {
@@ -939,43 +948,15 @@ func updateRoles(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
- if !strings.Contains(c.Session.Roles, model.ROLE_ADMIN) && !c.IsSystemAdmin() {
+ if !model.IsInRole(c.Session.Roles, model.ROLE_ADMIN) && !c.IsSystemAdmin() {
c.Err = model.NewAppError("updateRoles", "You do not have the appropriate permissions", "userId="+user_id)
c.Err.StatusCode = http.StatusForbidden
return
}
- // make sure there is at least 1 other active admin
- if strings.Contains(user.Roles, model.ROLE_ADMIN) && !strings.Contains(new_roles, model.ROLE_ADMIN) {
- if result := <-Srv.Store.User().GetProfiles(user.TeamId); result.Err != nil {
- c.Err = result.Err
- return
- } else {
- activeAdmins := -1
- profileUsers := result.Data.(map[string]*model.User)
- for _, profileUser := range profileUsers {
- if profileUser.DeleteAt == 0 && strings.Contains(profileUser.Roles, model.ROLE_ADMIN) {
- activeAdmins = activeAdmins + 1
- }
- }
-
- if activeAdmins <= 0 {
- c.Err = model.NewAppError("updateRoles", "There must be at least one active admin", "userId="+user_id)
- return
- }
- }
- }
-
- user.Roles = new_roles
-
- var ruser *model.User
- if result := <-Srv.Store.User().Update(user, true); result.Err != nil {
- c.Err = result.Err
+ ruser := UpdateRoles(c, user, new_roles)
+ if c.Err != nil {
return
- } else {
- c.LogAuditWithUserId(user.Id, "roles="+new_roles)
-
- ruser = result.Data.([2]*model.User)[0]
}
uchan := Srv.Store.Session().UpdateRoles(user.Id, new_roles)
@@ -1002,6 +983,42 @@ func updateRoles(c *Context, w http.ResponseWriter, r *http.Request) {
w.Write([]byte(ruser.ToJson()))
}
+func UpdateRoles(c *Context, user *model.User, roles string) *model.User {
+ // make sure there is at least 1 other active admin
+ if model.IsInRole(user.Roles, model.ROLE_ADMIN) && !model.IsInRole(roles, model.ROLE_ADMIN) {
+ if result := <-Srv.Store.User().GetProfiles(user.TeamId); result.Err != nil {
+ c.Err = result.Err
+ return nil
+ } else {
+ activeAdmins := -1
+ profileUsers := result.Data.(map[string]*model.User)
+ for _, profileUser := range profileUsers {
+ if profileUser.DeleteAt == 0 && model.IsInRole(profileUser.Roles, model.ROLE_ADMIN) {
+ activeAdmins = activeAdmins + 1
+ }
+ }
+
+ if activeAdmins <= 0 {
+ c.Err = model.NewAppError("updateRoles", "There must be at least one active admin", "")
+ return nil
+ }
+ }
+ }
+
+ user.Roles = roles
+
+ var ruser *model.User
+ if result := <-Srv.Store.User().Update(user, true); result.Err != nil {
+ c.Err = result.Err
+ return nil
+ } else {
+ c.LogAuditWithUserId(user.Id, "roles="+roles)
+ ruser = result.Data.([2]*model.User)[0]
+ }
+
+ return ruser
+}
+
func updateActive(c *Context, w http.ResponseWriter, r *http.Request) {
props := model.MapFromJson(r.Body)
@@ -1025,14 +1042,14 @@ func updateActive(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
- if !strings.Contains(c.Session.Roles, model.ROLE_ADMIN) && !c.IsSystemAdmin() {
+ if !model.IsInRole(c.Session.Roles, model.ROLE_ADMIN) && !c.IsSystemAdmin() {
c.Err = model.NewAppError("updateActive", "You do not have the appropriate permissions", "userId="+user_id)
c.Err.StatusCode = http.StatusForbidden
return
}
// make sure there is at least 1 other active admin
- if !active && strings.Contains(user.Roles, model.ROLE_ADMIN) {
+ if !active && model.IsInRole(user.Roles, model.ROLE_ADMIN) {
if result := <-Srv.Store.User().GetProfiles(user.TeamId); result.Err != nil {
c.Err = result.Err
return
@@ -1040,7 +1057,7 @@ func updateActive(c *Context, w http.ResponseWriter, r *http.Request) {
activeAdmins := -1
profileUsers := result.Data.(map[string]*model.User)
for _, profileUser := range profileUsers {
- if profileUser.DeleteAt == 0 && strings.Contains(profileUser.Roles, model.ROLE_ADMIN) {
+ if profileUser.DeleteAt == 0 && model.IsInRole(profileUser.Roles, model.ROLE_ADMIN) {
activeAdmins = activeAdmins + 1
}
}
diff --git a/api/user_test.go b/api/user_test.go
index b5435e3c0..8c037fdf3 100644
--- a/api/user_test.go
+++ b/api/user_test.go
@@ -684,6 +684,7 @@ func TestUserUpdateRoles(t *testing.T) {
data["user_id"] = user2.Id
if result, err := Client.UpdateUserRoles(data); err != nil {
+ t.Log(data["new_roles"])
t.Fatal(err)
} else {
if result.Data.(*model.User).Roles != "admin" {
generated by cgit v1.2.3-1-g7c22 (git 2.25.1) at 2024-07-07 18:05:18 +0000