From 0dbaa2d032ae42cbf39945df12efb20fc572b559 Mon Sep 17 00:00:00 2001
From: Carlos Tadeu Panato Junior <ctadeu@gmail.com>
Date: Fri, 11 May 2018 17:20:47 +0200
Subject: [MM-10458] Change system response to "Could not find the channel" -
 bug fix (#8738)

* [MM-10458] Change system response to "Could not find the channel" when trying to invite user to private channel you can't see

* add another check to check if user have permission to add another in pvt channel
---
 app/apptestlib.go          | 23 +++++++++++++++++++++++
 app/command_invite.go      | 10 +++++++++-
 app/command_invite_test.go |  7 +++++++
 3 files changed, 39 insertions(+), 1 deletion(-)

(limited to 'app')

diff --git a/app/apptestlib.go b/app/apptestlib.go
index 626e932e8..b245ddabf 100644
--- a/app/apptestlib.go
+++ b/app/apptestlib.go
@@ -227,6 +227,29 @@ func (me *TestHelper) createChannel(team *model.Team, channelType string) *model
 	return channel
 }
 
+func (me *TestHelper) createChannelWithAnotherUser(team *model.Team, channelType, userId string) *model.Channel {
+	id := model.NewId()
+
+	channel := &model.Channel{
+		DisplayName: "dn_" + id,
+		Name:        "name_" + id,
+		Type:        channelType,
+		TeamId:      team.Id,
+		CreatorId:   userId,
+	}
+
+	utils.DisableDebugLogForTest()
+	var err *model.AppError
+	if channel, err = me.App.CreateChannel(channel, true); err != nil {
+		mlog.Error(err.Error())
+
+		time.Sleep(time.Second)
+		panic(err)
+	}
+	utils.EnableDebugLogForTest()
+	return channel
+}
+
 func (me *TestHelper) CreateDmChannel(user *model.User) *model.Channel {
 	utils.DisableDebugLogForTest()
 	var err *model.AppError
diff --git a/app/command_invite.go b/app/command_invite.go
index 4b76c0c45..54cf2da02 100644
--- a/app/command_invite.go
+++ b/app/command_invite.go
@@ -79,10 +79,18 @@ func (me *InviteProvider) DoCommand(a *App, args *model.CommandArgs, message str
 		return &model.CommandResponse{Text: args.T("api.command_invite.permission.app_error", map[string]interface{}{"User": userProfile.Username, "Channel": channelToJoin.Name}), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}
 	}
 
-	if channelToJoin.Type == model.CHANNEL_PRIVATE && !a.SessionHasPermissionToChannel(args.Session, channelToJoin.Id, model.PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS) {
+	// Check if the user who wants to add another is trying to add in a pvt channel, but does not have permission
+	// but is in the channel
+	_, err = a.GetChannelMember(channelToJoin.Id, args.UserId)
+	if channelToJoin.Type == model.CHANNEL_PRIVATE && !a.SessionHasPermissionToChannel(args.Session, channelToJoin.Id, model.PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS) && err == nil {
 		return &model.CommandResponse{Text: args.T("api.command_invite.permission.app_error", map[string]interface{}{"User": userProfile.Username, "Channel": channelToJoin.Name}), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}
 	}
 
+	// In this case just check if is a pvt channel and user has permission
+	if channelToJoin.Type == model.CHANNEL_PRIVATE && !a.SessionHasPermissionToChannel(args.Session, channelToJoin.Id, model.PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS) {
+		return &model.CommandResponse{Text: args.T("api.command_invite.private_channel.app_error", map[string]interface{}{"Channel": channelToJoin.Name}), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}
+	}
+
 	// Check if user is already in the channel
 	_, err = a.GetChannelMember(channelToJoin.Id, userProfile.Id)
 	if err == nil {
diff --git a/app/command_invite_test.go b/app/command_invite_test.go
index c46bc4628..0d1db4a07 100644
--- a/app/command_invite_test.go
+++ b/app/command_invite_test.go
@@ -18,6 +18,7 @@ func TestInviteProvider(t *testing.T) {
 	channel := th.createChannel(th.BasicTeam, model.CHANNEL_OPEN)
 	privateChannel := th.createChannel(th.BasicTeam, model.CHANNEL_PRIVATE)
 	dmChannel := th.CreateDmChannel(th.BasicUser2)
+	privateChannel2 := th.createChannelWithAnotherUser(th.BasicTeam, model.CHANNEL_PRIVATE, th.BasicUser2.Id)
 
 	basicUser3 := th.CreateUser()
 	th.LinkUserToTeam(basicUser3, th.BasicTeam)
@@ -36,6 +37,7 @@ func TestInviteProvider(t *testing.T) {
 	userAndDisplayChannel := "@" + th.BasicUser2.Username + " ~" + channel.DisplayName + " "
 	userAndPrivateChannel := "@" + th.BasicUser2.Username + " ~" + privateChannel.Name
 	userAndDMChannel := "@" + basicUser3.Username + " ~" + dmChannel.Name
+	userAndInvalidPrivate := "@" + basicUser3.Username + " ~" + privateChannel2.Name
 
 	tests := []struct {
 		desc     string
@@ -97,6 +99,11 @@ func TestInviteProvider(t *testing.T) {
 			expected: "api.command_invite.directchannel.app_error",
 			msg:      userAndDMChannel,
 		},
+		{
+			desc:     "try to add a user to a privante channel with no permission",
+			expected: "api.command_invite.private_channel.app_error",
+			msg:      userAndInvalidPrivate,
+		},
 	}
 
 	for _, test := range tests {
-- 
cgit v1.2.3-1-g7c22