mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

Manual Cherrypick: Add audits for accessing posts without membership (#31266) (#35022)

Просмотр исходного кода 
Automatic Merge
Этот коммит содержится в:
Daniel Espino García
2026-01-26 11:23:28 +01:00
коммит произвёл GitHub
родитель 12dce033d6
Коммит 21a86506f9
79 изменённых файлов: 1707 добавлений и 1001 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

45
server/channels/app/channel.go
Просмотреть файл

@@ -847,7 +847,7 @@ func (a *App) postChannelPrivacyMessage(c request.CTX, user *model.User, channel
},
}
if _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
if _, _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
return model.NewAppError("postChannelPrivacyMessage", "api.channel.post_channel_privacy_message.error", nil, "", http.StatusInternalServerError).Wrap(err)
}
@@ -902,7 +902,7 @@ func (a *App) RestoreChannel(c request.CTX, channel *model.Channel, userID strin
},
}
if _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
if _, _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
c.Logger().Warn("Failed to post unarchive message", mlog.Err(err))
}
} else {
@@ -923,7 +923,7 @@ func (a *App) RestoreChannel(c request.CTX, channel *model.Channel, userID strin
},
}
if _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
if _, _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
c.Logger().Error("Failed to post unarchive message", mlog.Err(err))
}
})
@@ -1560,7 +1560,7 @@ func (a *App) DeleteChannel(c request.CTX, channel *model.Channel, userID string
},
}
if _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
if _, _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
c.Logger().Warn("Failed to post archive message", mlog.Err(err))
}
} else {
@@ -1578,7 +1578,7 @@ func (a *App) DeleteChannel(c request.CTX, channel *model.Channel, userID string
},
}
if _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
if _, _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
c.Logger().Warn("Failed to post archive message", mlog.Err(err))
}
}
@@ -1900,7 +1900,7 @@ func (a *App) PostUpdateChannelHeaderMessage(c request.CTX, userID string, chann
},
}
if _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
if _, _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
return model.NewAppError("", "api.channel.post_update_channel_header_message_and_forget.post.error", nil, "", http.StatusInternalServerError).Wrap(err)
}
@@ -1933,7 +1933,7 @@ func (a *App) PostUpdateChannelPurposeMessage(c request.CTX, userID string, chan
"new_purpose": newChannelPurpose,
},
}
if _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
if _, _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
return model.NewAppError("", "app.channel.post_update_channel_purpose_message.post.error", nil, "", http.StatusInternalServerError).Wrap(err)
}
@@ -1960,7 +1960,7 @@ func (a *App) PostUpdateChannelDisplayNameMessage(c request.CTX, userID string,
},
}
if _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
if _, _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
return model.NewAppError("PostUpdateChannelDisplayNameMessage", "api.channel.post_update_channel_displayname_message_and_forget.create_post.error", nil, "", http.StatusInternalServerError).Wrap(err)
}
@@ -2477,7 +2477,7 @@ func (a *App) postJoinChannelMessage(c request.CTX, user *model.User, channel *m
},
}
if _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
if _, _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
return model.NewAppError("postJoinChannelMessage", "api.channel.post_user_add_remove_message_and_forget.error", nil, "", http.StatusInternalServerError).Wrap(err)
}
@@ -2495,7 +2495,7 @@ func (a *App) postJoinTeamMessage(c request.CTX, user *model.User, channel *mode
},
}
if _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
if _, _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
return model.NewAppError("postJoinTeamMessage", "api.channel.post_user_add_remove_message_and_forget.error", nil, "", http.StatusInternalServerError).Wrap(err)
}
@@ -2578,7 +2578,7 @@ func (a *App) postLeaveChannelMessage(c request.CTX, user *model.User, channel *
},
}
if _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
if _, _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
return model.NewAppError("postLeaveChannelMessage", "api.channel.post_user_add_remove_message_and_forget.error", nil, "", http.StatusInternalServerError).Wrap(err)
}
@@ -2607,7 +2607,7 @@ func (a *App) PostAddToChannelMessage(c request.CTX, user *model.User, addedUser
},
}
if _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
if _, _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
return model.NewAppError("postAddToChannelMessage", "api.channel.post_user_add_remove_message_and_forget.error", nil, "", http.StatusInternalServerError).Wrap(err)
}
@@ -2629,7 +2629,7 @@ func (a *App) postAddToTeamMessage(c request.CTX, user *model.User, addedUser *m
},
}
if _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
if _, _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
return model.NewAppError("postAddToTeamMessage", "api.channel.post_user_add_remove_message_and_forget.error", nil, "", http.StatusInternalServerError).Wrap(err)
}
@@ -2661,7 +2661,7 @@ func (a *App) postRemoveFromChannelMessage(c request.CTX, removerUserId string,
},
}
if _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
if _, _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
return model.NewAppError("postRemoveFromChannelMessage", "api.channel.post_user_add_remove_message_and_forget.error", nil, "", http.StatusInternalServerError).Wrap(err)
}
@@ -2894,9 +2894,16 @@ func (a *App) ValidateUserPermissionsOnChannels(c request.CTX, userId string, ch
continue
}
if channel.Type == model.ChannelTypePrivate && a.HasPermissionToChannel(c, userId, channelId, model.PermissionManagePrivateChannelMembers) {
allowedChannelIds = append(allowedChannelIds, channelId)
} else if channel.Type == model.ChannelTypeOpen && a.HasPermissionToChannel(c, userId, channelId, model.PermissionManagePublicChannelMembers) {
allowedPrivate := false
if channel.Type == model.ChannelTypePrivate {
allowedPrivate, _ = a.HasPermissionToChannel(c, userId, channelId, model.PermissionManagePrivateChannelMembers)
}
allowedPublic := false
if channel.Type == model.ChannelTypeOpen {
allowedPublic, _ = a.HasPermissionToChannel(c, userId, channelId, model.PermissionManagePublicChannelMembers)
}
if allowedPrivate || allowedPublic {
allowedChannelIds = append(allowedChannelIds, channelId)
} else {
c.Logger().Info("Invite users to team - no permission to add members to that channel. UserId: " + userId + " ChannelId: " + channelId)
@@ -3453,7 +3460,7 @@ func (a *App) postChannelMoveMessage(c request.CTX, user *model.User, channel *m
},
}
if _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
if _, _, err := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); err != nil {
return model.NewAppError("postChannelMoveMessage", "api.team.move_channel.post.error", nil, "", http.StatusInternalServerError).Wrap(err)
}
@@ -3967,7 +3974,7 @@ func (a *App) postMessageForConvertGroupMessageToChannel(c request.CTX, channelI
return appErr
}
if _, appErr := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); appErr != nil {
if _, _, appErr := a.CreatePost(c, post, channel, model.CreatePostFlags{SetOnline: true}); appErr != nil {
c.Logger().Error("Failed to create post for notifying about GM converted to private channel", mlog.Err(appErr))
return model.NewAppError(