From 0a5f792d2d6ceaa6c9bdb3050acbc4050c0c02f5 Mon Sep 17 00:00:00 2001 From: George Goldberg Date: Wed, 12 Sep 2018 15:32:05 +0100 Subject: MM-11230: Make permissions checks in commands failsafe. (#9392) Also add additional unit tests to make sure the permissions tests are completely solid. --- app/command_channel_rename_test.go | 65 +++++++++++++++++++++++++++++++++++++- 1 file changed, 64 insertions(+), 1 deletion(-) (limited to 'app/command_channel_rename_test.go') diff --git a/app/command_channel_rename_test.go b/app/command_channel_rename_test.go index 9c86b18e0..d4cdeda51 100644 --- a/app/command_channel_rename_test.go +++ b/app/command_channel_rename_test.go @@ -1,10 +1,14 @@ +// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved. +// See License.txt for license information. + package app import ( "testing" - "github.com/mattermost/mattermost-server/model" "github.com/stretchr/testify/assert" + + "github.com/mattermost/mattermost-server/model" ) func TestRenameProviderDoCommand(t *testing.T) { @@ -29,4 +33,63 @@ func TestRenameProviderDoCommand(t *testing.T) { actual := rp.DoCommand(th.App, args, msg).Text assert.Equal(t, expected, actual) } + + // Try a public channel *without* permission. + args = &model.CommandArgs{ + T: func(s string, args ...interface{}) string { return s }, + ChannelId: th.BasicChannel.Id, + Session: model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}}, + } + + actual := rp.DoCommand(th.App, args, "hello").Text + assert.Equal(t, "api.command_channel_rename.permission.app_error", actual) + + // Try a private channel *with* permission. + privateChannel := th.CreatePrivateChannel(th.BasicTeam) + + args = &model.CommandArgs{ + T: func(s string, args ...interface{}) string { return s }, + ChannelId: privateChannel.Id, + Session: model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}}, + } + + actual = rp.DoCommand(th.App, args, "hello").Text + assert.Equal(t, "", actual) + + // Try a private channel *without* permission. + args = &model.CommandArgs{ + T: func(s string, args ...interface{}) string { return s }, + ChannelId: privateChannel.Id, + Session: model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}}, + } + + actual = rp.DoCommand(th.App, args, "hello").Text + assert.Equal(t, "api.command_channel_rename.permission.app_error", actual) + + // Try a group channel *with* being a member. + user1 := th.CreateUser() + user2 := th.CreateUser() + + groupChannel := th.CreateGroupChannel(user1, user2) + + args = &model.CommandArgs{ + T: func(s string, args ...interface{}) string { return s }, + ChannelId: groupChannel.Id, + Session: model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}}, + } + + actual = rp.DoCommand(th.App, args, "hello").Text + assert.Equal(t, "api.command_channel_rename.direct_group.app_error", actual) + + // Try a direct channel *with* being a member. + directChannel := th.CreateDmChannel(user1) + + args = &model.CommandArgs{ + T: func(s string, args ...interface{}) string { return s }, + ChannelId: directChannel.Id, + Session: model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}}, + } + + actual = rp.DoCommand(th.App, args, "hello").Text + assert.Equal(t, "api.command_channel_rename.direct_group.app_error", actual) } -- cgit v1.2.3-1-g7c22