From 0fe75cb7826944a3352705d5e78eba1d12cc213a Mon Sep 17 00:00:00 2001
From: Harrison Healey <harrisonmhealey@gmail.com>
Date: Tue, 17 May 2016 12:27:03 -0400
Subject: [PATCH] PLT-1909 Removed the ability to edit system posts (#3013)

* Removed the ability to edit system posts

* Added increased timeout to SpinnerButton unit tests
---
 api/post.go                          |  6 ++++++
 api/post_test.go                     | 11 +++++++++++
 i18n/en.json                         |  4 ++++
 webapp/components/post_info.jsx      |  3 ++-
 webapp/components/rhs_comment.jsx    |  3 ++-
 webapp/components/rhs_root_post.jsx  |  3 ++-
 webapp/tests/spinner_button.test.jsx |  1 +
 7 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/api/post.go b/api/post.go
index 734cb71481..6be3ec7ebc 100644
--- a/api/post.go
+++ b/api/post.go
@@ -919,6 +919,12 @@ func updatePost(c *Context, w http.ResponseWriter, r *http.Request) {
 			c.Err.StatusCode = http.StatusForbidden
 			return
 		}
+
+		if oldPost.IsSystemMessage() {
+			c.Err = model.NewLocAppError("updatePost", "api.post.update_post.system_message.app_error", nil, "id="+post.Id)
+			c.Err.StatusCode = http.StatusForbidden
+			return
+		}
 	}
 
 	hashtags, _ := model.ParseHashtags(post.Message)
diff --git a/api/post_test.go b/api/post_test.go
index bb11a5439f..b4c23ff06c 100644
--- a/api/post_test.go
+++ b/api/post_test.go
@@ -155,6 +155,17 @@ func TestUpdatePost(t *testing.T) {
 			t.Fatal("failed to updates")
 		}
 	}
+
+	post3 := &model.Post{ChannelId: channel1.Id, Message: "a" + model.NewId() + "a", Type: model.POST_JOIN_LEAVE}
+	rpost3, err := Client.CreatePost(post3)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	up3 := &model.Post{Id: rpost3.Data.(*model.Post).Id, ChannelId: channel1.Id, Message: "a" + model.NewId() + " update post 3"}
+	if _, err := Client.UpdatePost(up3); err == nil {
+		t.Fatal("shouldn't have been able to update system message")
+	}
 }
 
 func TestGetPosts(t *testing.T) {
diff --git a/i18n/en.json b/i18n/en.json
index abdc647b7f..40f722add2 100644
--- a/i18n/en.json
+++ b/i18n/en.json
@@ -935,6 +935,10 @@
     "id": "api.post.update_post.permissions_details.app_error",
     "translation": "Already deleted id={{.PostId}}"
   },
+  {
+    "id": "api.post.update_post.system_message.app_error",
+    "translation": "Unable to update system message"
+  },
   {
     "id": "api.post_get_post_by_id.get.app_error",
     "translation": "Unable to get post"
diff --git a/webapp/components/post_info.jsx b/webapp/components/post_info.jsx
index f86c63fd78..ed316745f0 100644
--- a/webapp/components/post_info.jsx
+++ b/webapp/components/post_info.jsx
@@ -33,6 +33,7 @@ export default class PostInfo extends React.Component {
         var post = this.props.post;
         var isOwner = this.props.currentUser.id === post.user_id;
         var isAdmin = TeamStore.isTeamAdminForCurrentTeam() || UserStore.isSystemAdminForCurrentUser();
+        const isSystemMessage = post.type.startsWith(Constants.SYSTEM_MESSAGE_PREFIX);
 
         if (post.state === Constants.POST_FAILED || post.state === Constants.POST_LOADING || Utils.isPostEphemeral(post)) {
             return '';
@@ -108,7 +109,7 @@ export default class PostInfo extends React.Component {
             );
         }
 
-        if (isOwner) {
+        if (isOwner && !isSystemMessage) {
             dropdownContents.push(
                 <li
                     key='editPost'
diff --git a/webapp/components/rhs_comment.jsx b/webapp/components/rhs_comment.jsx
index 5097e05737..c4b62efcf4 100644
--- a/webapp/components/rhs_comment.jsx
+++ b/webapp/components/rhs_comment.jsx
@@ -85,6 +85,7 @@ export default class RhsComment extends React.Component {
 
         const isOwner = this.props.currentUser.id === post.user_id;
         var isAdmin = TeamStore.isTeamAdminForCurrentTeam() || UserStore.isSystemAdminForCurrentUser();
+        const isSystemMessage = post.type.startsWith(Constants.SYSTEM_MESSAGE_PREFIX);
 
         var dropdownContents = [];
 
@@ -107,7 +108,7 @@ export default class RhsComment extends React.Component {
             );
         }
 
-        if (isOwner) {
+        if (isOwner && !isSystemMessage) {
             dropdownContents.push(
                 <li
                     role='presentation'
diff --git a/webapp/components/rhs_root_post.jsx b/webapp/components/rhs_root_post.jsx
index 8499718647..f829487269 100644
--- a/webapp/components/rhs_root_post.jsx
+++ b/webapp/components/rhs_root_post.jsx
@@ -41,6 +41,7 @@ export default class RhsRootPost extends React.Component {
         const user = this.props.user;
         var isOwner = this.props.currentUser.id === post.user_id;
         var isAdmin = TeamStore.isTeamAdminForCurrentTeam() || UserStore.isSystemAdminForCurrentUser();
+        const isSystemMessage = post.type.startsWith(Constants.SYSTEM_MESSAGE_PREFIX);
         var timestamp = UserStore.getProfile(post.user_id).update_at;
         var channel = ChannelStore.get(post.channel_id);
 
@@ -94,7 +95,7 @@ export default class RhsRootPost extends React.Component {
             );
         }
 
-        if (isOwner) {
+        if (isOwner && !isSystemMessage) {
             dropdownContents.push(
                 <li
                     key='rhs-root-edit'
diff --git a/webapp/tests/spinner_button.test.jsx b/webapp/tests/spinner_button.test.jsx
index 68488b61dc..296f4eaff2 100644
--- a/webapp/tests/spinner_button.test.jsx
+++ b/webapp/tests/spinner_button.test.jsx
@@ -6,6 +6,7 @@ import SpinnerButton from '../components/spinner_button.jsx';
 import React from 'react';
 
 describe('SpinnerButton', function() {
+    this.timeout(10000);
     jsdom();
 
     it('check props', function() {