From 2df818b9c680d9e6aec2cddb4c910ecf8341e3a9 Mon Sep 17 00:00:00 2001
From: George Goldberg <george@gberg.me>
Date: Tue, 10 Jul 2018 09:54:49 +0100
Subject: MM-11227: Fix group msg slash command. (#9070)

---
 app/channel.go               | 24 ++++++++++++++++++
 app/command_groupmsg.go      | 18 ++++++++++---
 app/command_groupmsg_test.go | 60 ++++++++++++++++++++++++++++++++++++++++++++
 i18n/en.json                 |  4 +++
 4 files changed, 102 insertions(+), 4 deletions(-)

diff --git a/app/channel.go b/app/channel.go
index eee27a6de..5607601c6 100644
--- a/app/channel.go
+++ b/app/channel.go
@@ -340,6 +340,30 @@ func (a *App) createGroupChannel(userIds []string, creatorId string) (*model.Cha
 	}
 }
 
+func (a *App) GetGroupChannel(userIds []string) (*model.Channel, *model.AppError) {
+	if len(userIds) > model.CHANNEL_GROUP_MAX_USERS || len(userIds) < model.CHANNEL_GROUP_MIN_USERS {
+		return nil, model.NewAppError("GetGroupChannel", "api.channel.create_group.bad_size.app_error", nil, "", http.StatusBadRequest)
+	}
+
+	var users []*model.User
+	if result := <-a.Srv.Store.User().GetProfileByIds(userIds, true); result.Err != nil {
+		return nil, result.Err
+	} else {
+		users = result.Data.([]*model.User)
+	}
+
+	if len(users) != len(userIds) {
+		return nil, model.NewAppError("GetGroupChannel", "api.channel.create_group.bad_user.app_error", nil, "user_ids="+model.ArrayToJson(userIds), http.StatusBadRequest)
+	}
+
+	channel, err := a.GetChannelByName(model.GetGroupNameFromUserIds(userIds), "")
+	if err != nil {
+		return nil, err
+	}
+
+	return channel, nil
+}
+
 func (a *App) UpdateChannel(channel *model.Channel) (*model.Channel, *model.AppError) {
 	if result := <-a.Srv.Store.Channel().Update(channel); result.Err != nil {
 		return nil, result.Err
diff --git a/app/command_groupmsg.go b/app/command_groupmsg.go
index 0e783e1a8..9ec84fda0 100644
--- a/app/command_groupmsg.go
+++ b/app/command_groupmsg.go
@@ -93,10 +93,20 @@ func (me *groupmsgProvider) DoCommand(a *App, args *model.CommandArgs, message s
 		}
 	}
 
-	groupChannel, channelErr := a.CreateGroupChannel(targetUsersSlice, args.UserId)
-	if channelErr != nil {
-		mlog.Error(channelErr.Error())
-		return &model.CommandResponse{Text: args.T("api.command_groupmsg.group_fail.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}
+	var groupChannel *model.Channel
+	var channelErr *model.AppError
+
+	if a.SessionHasPermissionTo(args.Session, model.PERMISSION_CREATE_GROUP_CHANNEL) {
+		groupChannel, channelErr = a.CreateGroupChannel(targetUsersSlice, args.UserId)
+		if channelErr != nil {
+			mlog.Error(channelErr.Error())
+			return &model.CommandResponse{Text: args.T("api.command_groupmsg.group_fail.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}
+		}
+	} else {
+		groupChannel, channelErr = a.GetGroupChannel(targetUsersSlice)
+		if channelErr != nil {
+			return &model.CommandResponse{Text: args.T("api.command_groupmsg.permission.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}
+		}
 	}
 
 	if len(parsedMessage) > 0 {
diff --git a/app/command_groupmsg_test.go b/app/command_groupmsg_test.go
index 610d2e446..422679525 100644
--- a/app/command_groupmsg_test.go
+++ b/app/command_groupmsg_test.go
@@ -2,6 +2,11 @@ package app
 
 import (
 	"testing"
+
+	"github.com/nicksnyder/go-i18n/i18n"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/mattermost/mattermost-server/model"
 )
 
 func TestGroupMsgUsernames(t *testing.T) {
@@ -35,3 +40,58 @@ func TestGroupMsgUsernames(t *testing.T) {
 		t.Fatal("error parsing different types of users")
 	}
 }
+
+func TestGroupMsgProvider(t *testing.T) {
+	th := Setup().InitBasic()
+	defer th.TearDown()
+
+	user3 := th.CreateUser()
+	targetUsers := "@" + th.BasicUser2.Username + ",@" + user3.Username + " "
+
+	team := th.CreateTeam()
+	th.LinkUserToTeam(th.BasicUser, team)
+	cmd := &groupmsgProvider{}
+
+	// Check without permission to create a GM channel.
+	resp := cmd.DoCommand(th.App, &model.CommandArgs{
+		T:       i18n.IdentityTfunc(),
+		SiteURL: "http://test.url",
+		TeamId:  team.Id,
+		UserId:  th.BasicUser.Id,
+		Session: model.Session{
+			Roles: "",
+		},
+	}, targetUsers+"hello")
+
+	channelName := model.GetGroupNameFromUserIds([]string{th.BasicUser.Id, th.BasicUser2.Id, user3.Id})
+	assert.Equal(t, "api.command_groupmsg.permission.app_error", resp.Text)
+	assert.Equal(t, "", resp.GotoLocation)
+
+	// Check with permission to create a GM channel.
+	resp = cmd.DoCommand(th.App, &model.CommandArgs{
+		T:       i18n.IdentityTfunc(),
+		SiteURL: "http://test.url",
+		TeamId:  team.Id,
+		UserId:  th.BasicUser.Id,
+		Session: model.Session{
+			Roles: model.SYSTEM_USER_ROLE_ID,
+		},
+	}, targetUsers+"hello")
+
+	assert.Equal(t, "", resp.Text)
+	assert.Equal(t, "http://test.url/"+team.Name+"/channels/"+channelName, resp.GotoLocation)
+
+	// Check without permission to post to an existing GM channel.
+	resp = cmd.DoCommand(th.App, &model.CommandArgs{
+		T:       i18n.IdentityTfunc(),
+		SiteURL: "http://test.url",
+		TeamId:  team.Id,
+		UserId:  th.BasicUser.Id,
+		Session: model.Session{
+			Roles: "",
+		},
+	}, targetUsers+"hello")
+
+	assert.Equal(t, "", resp.Text)
+	assert.Equal(t, "http://test.url/"+team.Name+"/channels/"+channelName, resp.GotoLocation)
+}
diff --git a/i18n/en.json b/i18n/en.json
index f257a86a4..518846a0f 100644
--- a/i18n/en.json
+++ b/i18n/en.json
@@ -834,6 +834,10 @@
     "id": "api.command_remove.user_not_in_channel",
     "translation": "{{.Username}} is not a member of this channel."
   },
+  {
+    "id": "api.command_groupmsg.permission.app_error",
+    "translation": "You don't have the appropriate permissions to create a new group message."
+  },
   {
     "id": "api.command_search.desc",
     "translation": "Search text in messages"
-- 
cgit v1.2.3-1-g7c22