MM-42271: Restrict support packet generation to system admin. (#19726)

api4/system.go

@@ -81,10 +81,9 @@ func generateSupportPacket(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Checking to see if the user is a admin of any sort or not
+	// Support packet generation is limited to system admins (MM-42271).
-	// If they are a admin, they should theoretically have access to one or more of the system console read permissions
+	if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionManageSystem) {
-	if !c.App.SessionHasPermissionToAny(*c.AppContext.Session(), model.SysconsoleReadPermissions) {
+		c.SetPermissionError(model.PermissionManageSystem)
-		c.SetPermissionError(model.SysconsoleReadPermissions...)
 		return
 	}
 

api4/system_test.go

@@ -222,6 +222,12 @@ func TestGenerateSupportPacket(t *testing.T) {
 		CheckForbiddenStatus(t, resp)
 	})
 
+	t.Run("As a system role, not system admin", func(t *testing.T) {
+		_, resp, err := th.SystemManagerClient.GenerateSupportPacket()
+		require.Error(t, err)
+		CheckForbiddenStatus(t, resp)
+	})
+
 	t.Run("As a Regular User", func(t *testing.T) {
 		_, resp, err := th.Client.GenerateSupportPacket()
 		require.Error(t, err)