From 03f5c939deb4a6ab2fd01639b5570799e4118bab Mon Sep 17 00:00:00 2001 From: Chris Date: Tue, 12 Dec 2017 17:44:01 -0600 Subject: fix PUT webhook permissions (#7970) --- api/webhook.go | 2 +- api4/webhook.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/api/webhook.go b/api/webhook.go index 3d0036aba..dce5ddc1e 100644 --- a/api/webhook.go +++ b/api/webhook.go @@ -88,7 +88,7 @@ func updateIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) { return } - if c.Session.UserId != hook.UserId && !c.App.SessionHasPermissionToTeam(c.Session, oldHook.TeamId, model.PERMISSION_MANAGE_OTHERS_WEBHOOKS) { + if c.Session.UserId != oldHook.UserId && !c.App.SessionHasPermissionToTeam(c.Session, oldHook.TeamId, model.PERMISSION_MANAGE_OTHERS_WEBHOOKS) { c.LogAudit("fail - inappropriate permissions") c.SetPermissionError(model.PERMISSION_MANAGE_OTHERS_WEBHOOKS) return diff --git a/api4/webhook.go b/api4/webhook.go index 4382bac94..5146024f7 100644 --- a/api4/webhook.go +++ b/api4/webhook.go @@ -109,7 +109,7 @@ func updateIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) { return } - if c.Session.UserId != updatedHook.UserId && !c.App.SessionHasPermissionToTeam(c.Session, updatedHook.TeamId, model.PERMISSION_MANAGE_OTHERS_WEBHOOKS) { + if c.Session.UserId != oldHook.UserId && !c.App.SessionHasPermissionToTeam(c.Session, updatedHook.TeamId, model.PERMISSION_MANAGE_OTHERS_WEBHOOKS) { c.LogAudit("fail - inappropriate permissions") c.SetPermissionError(model.PERMISSION_MANAGE_OTHERS_WEBHOOKS) return -- cgit v1.2.3-1-g7c22