From 37196a6a26a6d6f7f173eb6e2f7bcfa9a44c574a Mon Sep 17 00:00:00 2001 From: Nick Misasi Date: Mon, 12 Jun 2023 10:33:11 -0400 Subject: [PATCH] Enforce PermissionSysconsoleWriteBilling in self serve workspace deletion (#23691) --- server/channels/api4/cloud.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/server/channels/api4/cloud.go b/server/channels/api4/cloud.go index 893921464d..5eddeb72b8 100644 --- a/server/channels/api4/cloud.go +++ b/server/channels/api4/cloud.go @@ -875,6 +875,11 @@ func selfServeDeleteWorkspace(c *Context, w http.ResponseWriter, r *http.Request } defer r.Body.Close() + if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionSysconsoleWriteBilling) { + c.SetPermissionError(model.PermissionSysconsoleWriteBilling) + return + } + var deleteRequest *model.WorkspaceDeletionRequest if err = json.Unmarshal(bodyBytes, &deleteRequest); err != nil { c.Err = model.NewAppError("Api4.selfServeDeleteWorkspace", "api.cloud.app_error", nil, err.Error(), http.StatusInternalServerError)