From 0a5f792d2d6ceaa6c9bdb3050acbc4050c0c02f5 Mon Sep 17 00:00:00 2001 From: George Goldberg Date: Wed, 12 Sep 2018 15:32:05 +0100 Subject: MM-11230: Make permissions checks in commands failsafe. (#9392) Also add additional unit tests to make sure the permissions tests are completely solid. --- app/command_channel_rename.go | 57 +++++++++++++++++++++++++++++++------------ 1 file changed, 42 insertions(+), 15 deletions(-) (limited to 'app/command_channel_rename.go') diff --git a/app/command_channel_rename.go b/app/command_channel_rename.go index ddcfea67a..a2e45ed46 100644 --- a/app/command_channel_rename.go +++ b/app/command_channel_rename.go @@ -4,8 +4,9 @@ package app import ( - "github.com/mattermost/mattermost-server/model" goi18n "github.com/nicksnyder/go-i18n/i18n" + + "github.com/mattermost/mattermost-server/model" ) type RenameProvider struct { @@ -36,27 +37,50 @@ func (me *RenameProvider) GetCommand(a *App, T goi18n.TranslateFunc) *model.Comm func (me *RenameProvider) DoCommand(a *App, args *model.CommandArgs, message string) *model.CommandResponse { channel, err := a.GetChannel(args.ChannelId) if err != nil { - return &model.CommandResponse{Text: args.T("api.command_channel_rename.channel.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL} - } - - if channel.Type == model.CHANNEL_OPEN && !a.SessionHasPermissionToChannel(args.Session, args.ChannelId, model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES) { - return &model.CommandResponse{Text: args.T("api.command_channel_rename.permission.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL} - } - - if channel.Type == model.CHANNEL_PRIVATE && !a.SessionHasPermissionToChannel(args.Session, args.ChannelId, model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES) { - return &model.CommandResponse{Text: args.T("api.command_channel_rename.permission.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL} + return &model.CommandResponse{ + Text: args.T("api.command_channel_rename.channel.app_error"), + ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL, + } } - if channel.Type == model.CHANNEL_GROUP || channel.Type == model.CHANNEL_DIRECT { + switch channel.Type { + case model.CHANNEL_OPEN: + if !a.SessionHasPermissionToChannel(args.Session, args.ChannelId, model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES) { + return &model.CommandResponse{ + Text: args.T("api.command_channel_rename.permission.app_error"), + ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL, + } + } + case model.CHANNEL_PRIVATE: + if !a.SessionHasPermissionToChannel(args.Session, args.ChannelId, model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES) { + return &model.CommandResponse{ + Text: args.T("api.command_channel_rename.permission.app_error"), + ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL, + } + } + default: return &model.CommandResponse{Text: args.T("api.command_channel_rename.direct_group.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL} } if len(message) == 0 { - return &model.CommandResponse{Text: args.T("api.command_channel_rename.message.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL} + return &model.CommandResponse{ + Text: args.T("api.command_channel_rename.message.app_error"), + ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL, + } } else if len(message) > model.CHANNEL_NAME_UI_MAX_LENGTH { - return &model.CommandResponse{Text: args.T("api.command_channel_rename.too_long.app_error", map[string]interface{}{"Length": model.CHANNEL_NAME_UI_MAX_LENGTH}), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL} + return &model.CommandResponse{ + Text: args.T("api.command_channel_rename.too_long.app_error", map[string]interface{}{ + "Length": model.CHANNEL_NAME_UI_MAX_LENGTH, + }), + ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL, + } } else if len(message) < model.CHANNEL_NAME_MIN_LENGTH { - return &model.CommandResponse{Text: args.T("api.command_channel_rename.too_short.app_error", map[string]interface{}{"Length": model.CHANNEL_NAME_MIN_LENGTH}), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL} + return &model.CommandResponse{ + Text: args.T("api.command_channel_rename.too_short.app_error", map[string]interface{}{ + "Length": model.CHANNEL_NAME_MIN_LENGTH, + }), + ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL, + } } patch := &model.ChannelPatch{ @@ -66,7 +90,10 @@ func (me *RenameProvider) DoCommand(a *App, args *model.CommandArgs, message str _, err = a.PatchChannel(channel, patch, args.UserId) if err != nil { - return &model.CommandResponse{Text: args.T("api.command_channel_rename.update_channel.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL} + return &model.CommandResponse{ + Text: args.T("api.command_channel_rename.update_channel.app_error"), + ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL, + } } return &model.CommandResponse{} -- cgit v1.2.3-1-g7c22