1 files changed, 40 insertions, 11 deletions

diff --git a/app/post.go b/app/post.go
index c852a90d2..3845e1006 100644
--- a/app/post.go
+++ b/app/post.go
@@ -44,6 +44,29 @@ func CreatePostAsUser(post *model.Post) (*model.Post, *model.AppError) {
 			err.StatusCode = http.StatusBadRequest
 		}
 
+		if err.Id == "api.post.create_post.town_square_read_only" {
+			uchan := Srv.Store.User().Get(post.UserId)
+			var user *model.User
+			if result := <-uchan; result.Err != nil {
+				return nil, result.Err
+			} else {
+				user = result.Data.(*model.User)
+			}
+
+			T := utils.GetUserTranslations(user.Locale)
+			SendEphemeralPost(
+				post.UserId,
+				&model.Post{
+					ChannelId: channel.Id,
+					ParentId:  post.ParentId,
+					RootId:    post.RootId,
+					UserId:    post.UserId,
+					Message:   T("api.post.create_post.town_square_read_only"),
+					CreateAt:  model.GetMillis() + 1,
+				},
+			)
+		}
+
 		return nil, err
 	} else {
 		// Update the LastViewAt only if the post does not have from_webhook prop set (eg. Zapier app)
@@ -82,6 +105,21 @@ func CreatePost(post *model.Post, channel *model.Channel, triggerWebhooks bool)
 		pchan = Srv.Store.Post().Get(post.RootId)
 	}
 
+	uchan := Srv.Store.User().Get(post.UserId)
+	var user *model.User
+	if result := <-uchan; result.Err != nil {
+		return nil, result.Err
+	} else {
+		user = result.Data.(*model.User)
+	}
+
+	if utils.IsLicensed() && *utils.Cfg.TeamSettings.ExperimentalTownSquareIsReadOnly &&
+		!post.IsSystemMessage() &&
+		channel.Name == model.DEFAULT_CHANNEL &&
+		!CheckIfRolesGrantPermission(user.GetRoles(), model.PERMISSION_MANAGE_SYSTEM.Id) {
+		return nil, model.NewLocAppError("createPost", "api.post.create_post.town_square_read_only", nil, "")
+	}
+
 	// Verify the parent/child relationships are correct
 	var parentPostList *model.PostList
 	if pchan != nil {
@@ -139,21 +177,19 @@ func CreatePost(post *model.Post, channel *model.Channel, triggerWebhooks bool)
 		}
 	}
 
-	if err := handlePostEvents(rpost, channel, triggerWebhooks, parentPostList); err != nil {
+	if err := handlePostEvents(rpost, user, channel, triggerWebhooks, parentPostList); err != nil {
 		return nil, err
 	}
 
 	return rpost, nil
 }
 
-func handlePostEvents(post *model.Post, channel *model.Channel, triggerWebhooks bool, parentPostList *model.PostList) *model.AppError {
+func handlePostEvents(post *model.Post, user *model.User, channel *model.Channel, triggerWebhooks bool, parentPostList *model.PostList) *model.AppError {
 	var tchan store.StoreChannel
 	if len(channel.TeamId) > 0 {
 		tchan = Srv.Store.Team().Get(channel.TeamId)
 	}
 
-	uchan := Srv.Store.User().Get(post.UserId)
-
 	var team *model.Team
 	if tchan != nil {
 		if result := <-tchan; result.Err != nil {
@@ -169,13 +205,6 @@ func handlePostEvents(post *model.Post, channel *model.Channel, triggerWebhooks
 	InvalidateCacheForChannel(channel)
 	InvalidateCacheForChannelPosts(channel.Id)
 
-	var user *model.User
-	if result := <-uchan; result.Err != nil {
-		return result.Err
-	} else {
-		user = result.Data.(*model.User)
-	}
-
 	if _, err := SendNotifications(post, team, channel, user, parentPostList); err != nil {
 		return err
 	}