1 files changed, 29 insertions, 6 deletions

diff --git a/app/preference.go b/app/preference.go
index 793f1802b..425b88d29 100644
--- a/app/preference.go
+++ b/app/preference.go
@@ -39,22 +39,45 @@ func GetPreferenceByCategoryAndNameForUser(userId string, category string, prefe
 	}
 }
 
-func UpdatePreferences(preferences model.Preferences) (bool, *model.AppError) {
+func UpdatePreferences(userId string, preferences model.Preferences) *model.AppError {
+	for _, preference := range preferences {
+		if userId != preference.UserId {
+			return model.NewAppError("savePreferences", "api.preference.update_preferences.set.app_error", nil,
+				"userId="+userId+", preference.UserId="+preference.UserId, http.StatusForbidden)
+		}
+	}
+
 	if result := <-Srv.Store.Preference().Save(&preferences); result.Err != nil {
 		result.Err.StatusCode = http.StatusBadRequest
-		return false, result.Err
+		return result.Err
 	}
 
-	return true, nil
+	message := model.NewWebSocketEvent(model.WEBSOCKET_EVENT_PREFERENCES_CHANGED, "", "", userId, nil)
+	message.Add("preferences", preferences.ToJson())
+	go Publish(message)
+
+	return nil
 }
 
-func DeletePreferences(userId string, preferences model.Preferences) (bool, *model.AppError) {
+func DeletePreferences(userId string, preferences model.Preferences) *model.AppError {
+	for _, preference := range preferences {
+		if userId != preference.UserId {
+			err := model.NewAppError("deletePreferences", "api.preference.delete_preferences.delete.app_error", nil,
+				"userId="+userId+", preference.UserId="+preference.UserId, http.StatusForbidden)
+			return err
+		}
+	}
+
 	for _, preference := range preferences {
 		if result := <-Srv.Store.Preference().Delete(userId, preference.Category, preference.Name); result.Err != nil {
 			result.Err.StatusCode = http.StatusBadRequest
-			return false, result.Err
+			return result.Err
 		}
 	}
 
-	return true, nil
+	message := model.NewWebSocketEvent(model.WEBSOCKET_EVENT_PREFERENCES_DELETED, "", "", userId, nil)
+	message.Add("preferences", preferences.ToJson())
+	go Publish(message)
+
+	return nil
 }