mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

[MM-36444] Manage config deprecations for 6.0 (#18035)

Просмотр исходного кода 
* removing deprecated stuff

* removing deprecations and marking others for deprecations

* removing some of the configs

* partially remove ExperimentalChannelOrganization

* fixing merge issues

* moving default permissions to defaultroles function

* removing experimentaltownsquare

* removing old tests and remove legacysidebar config

* fixing test

* removing log

* removing unused variables

* MM-36444: Fix for renamed functions.

* MM-36444: go mod tidy and go mod vendor.

* MM-36444: Vendored go modules.

* MM-36444: Removes UseExperimentalGossip config field from model.

* Fix vendors

* fixing test

Co-authored-by: Benjamin Cooke <benjamincooke@Benjamins-MacBook-Pro.local>
Co-authored-by: Mattermod <mattermod@users.noreply.github.com>
Co-authored-by: Martin Kraft <martin@upspin.org>
Co-authored-by: Claudio Costa <cstcld91@gmail.com>
Этот коммит содержится в:
Ben Cooke
2021-09-14 13:22:59 -04:00
коммит произвёл GitHub
родитель 0953e3f0cf
Коммит 3b9324b389
22 изменённых файлов: 92 добавлений и 1176 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

1
api4/post.go
Просмотреть файл

@@ -725,7 +725,6 @@ func saveIsPinnedPost(c *Context, w http.ResponseWriter, isPinned bool) {
}
if c.App.Srv().License() != nil &&
*c.App.Config().TeamSettings.ExperimentalTownSquareIsReadOnly &&
channel.Name == model.DefaultChannelName &&
!c.App.RolesGrantPermission(user.GetRoles(), model.PermissionManageSystem.Id) {
c.Err = model.NewAppError("saveIsPinnedPost", "api.post.save_is_pinned_post.town_square_read_only", nil, "", http.StatusForbidden)

17
api4/post_test.go
Просмотреть файл

@@ -1006,23 +1006,6 @@ func TestPinPost(t *testing.T) {
require.Error(t, err)
CheckForbiddenStatus(t, resp)
t.Run("unable-to-pin-post-in-read-only-town-square", func(t *testing.T) {
townSquareIsReadOnly := *th.App.Config().TeamSettings.ExperimentalTownSquareIsReadOnly
th.App.Srv().SetLicense(model.NewTestLicense())
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = true })
defer th.App.Srv().RemoveLicense()
defer th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = townSquareIsReadOnly })
channel, appErr := th.App.GetChannelByName("town-square", th.BasicTeam.Id, true)
assert.Nil(t, appErr)
adminPost := th.CreatePostWithClient(th.SystemAdminClient, channel)
resp, err = client.PinPost(adminPost.Id)
require.Error(t, err)
CheckForbiddenStatus(t, resp)
})
client.Logout()
resp, err = client.PinPost(post.Id)
require.Error(t, err)

64
api4/reaction_test.go
Просмотреть файл

@@ -165,34 +165,6 @@ func TestSaveReaction(t *testing.T) {
th.AddPermissionToRole(model.PermissionAddReaction.Id, model.ChannelUserRoleId)
})
t.Run("unable-to-react-in-read-only-town-square", func(t *testing.T) {
th.LoginBasic()
channel, appErr := th.App.GetChannelByName("town-square", th.BasicTeam.Id, true)
assert.Nil(t, appErr)
post := th.CreatePostWithClient(th.Client, channel)
th.App.Srv().SetLicense(model.NewTestLicense())
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = true })
reaction := &model.Reaction{
UserId: userId,
PostId: post.Id,
EmojiName: "smile",
}
_, resp, err := client.SaveReaction(reaction)
require.Error(t, err)
CheckForbiddenStatus(t, resp)
reactions, appErr := th.App.GetReactionsForPost(post.Id)
require.Nil(t, appErr)
require.Equal(t, 0, len(reactions), "should have not created a reaction")
th.App.Srv().RemoveLicense()
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = false })
})
t.Run("unable-to-react-in-an-archived-channel", func(t *testing.T) {
th.LoginBasic()
@@ -501,42 +473,6 @@ func TestDeleteReaction(t *testing.T) {
th.AddPermissionToRole(model.PermissionRemoveOthersReactions.Id, model.SystemAdminRoleId)
})
t.Run("unable-to-delete-reactions-in-read-only-town-square", func(t *testing.T) {
th.LoginBasic()
channel, appErr := th.App.GetChannelByName("town-square", th.BasicTeam.Id, true)
assert.Nil(t, appErr)
post := th.CreatePostWithClient(th.Client, channel)
th.App.Srv().SetLicense(model.NewTestLicense())
reaction := &model.Reaction{
UserId: userId,
PostId: post.Id,
EmojiName: "smile",
}
r1, _, err := client.SaveReaction(reaction)
require.NoError(t, err)
reactions, appErr := th.App.GetReactionsForPost(postId)
require.Nil(t, appErr)
require.Equal(t, 1, len(reactions), "should have created a reaction")
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = true })
resp, err := th.SystemAdminClient.DeleteReaction(r1)
require.Error(t, err)
CheckForbiddenStatus(t, resp)
reactions, appErr = th.App.GetReactionsForPost(postId)
require.Nil(t, appErr)
require.Equal(t, 1, len(reactions), "should have not deleted a reaction")
th.App.Srv().RemoveLicense()
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = false })
})
t.Run("unable-to-delete-reactions-in-an-archived-channel", func(t *testing.T) {
th.LoginBasic()

35
api4/user.go
Просмотреть файл

@@ -57,7 +57,6 @@ func (api *API) InitUser() {
api.BaseRoutes.User.Handle("/auth", api.APISessionRequiredTrustRequester(updateUserAuth)).Methods("PUT")
api.BaseRoutes.Users.Handle("/mfa", api.APIHandler(checkUserMfa)).Methods("POST")
api.BaseRoutes.User.Handle("/mfa", api.APISessionRequiredMfa(updateUserMfa)).Methods("PUT")
api.BaseRoutes.User.Handle("/mfa/generate", api.APISessionRequiredMfa(generateMfaSecret)).Methods("POST")
@@ -1510,40 +1509,6 @@ func updateUserAuth(c *Context, w http.ResponseWriter, r *http.Request) {
}
}
// Deprecated: checkUserMfa is deprecated and should not be used anymore, starting with version 6.0 it will be disabled.
// Clients should attempt a login without MFA and will receive a MFA error when it's required.
func checkUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
if *c.App.Config().ServiceSettings.DisableLegacyMFA {
http.NotFound(w, r)
return
}
props := model.MapFromJSON(r.Body)
loginId := props["login_id"]
if loginId == "" {
c.SetInvalidParam("login_id")
return
}
resp := map[string]interface{}{}
resp["mfa_required"] = false
if !*c.App.Config().ServiceSettings.EnableMultifactorAuthentication {
w.Write([]byte(model.StringInterfaceToJSON(resp)))
return
}
if *c.App.Config().ServiceSettings.ExperimentalEnableHardenedMode {
resp["mfa_required"] = true
} else if user, err := c.App.GetUserForLogin("", loginId); err == nil {
resp["mfa_required"] = user.MfaActive
}
w.Write([]byte(model.StringInterfaceToJSON(resp)))
}
func updateUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
c.RequireUserId()
if c.Err != nil {

1
api4/user_test.go
Просмотреть файл

@@ -2769,7 +2769,6 @@ func TestUserLoginMFAFlow(t *testing.T) {
defer th.TearDown()
th.App.UpdateConfig(func(c *model.Config) {
*c.ServiceSettings.DisableLegacyMFA = true
*c.ServiceSettings.EnableMultifactorAuthentication = true
})

238
app/app_test.go
Просмотреть файл

@@ -186,25 +186,7 @@ func TestDoAdvancedPermissionsMigration(t *testing.T) {
assert.Nil(t, err)
assert.Equal(t, role.Permissions, permissions, fmt.Sprintf("role %q didn't match", name))
}
// Add a license and change the policy config.
restrictPublicChannel := *th.App.Config().TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement
restrictPrivateChannel := *th.App.Config().TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement
defer func() {
th.App.UpdateConfig(func(cfg *model.Config) {
*cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement = restrictPublicChannel
})
th.App.UpdateConfig(func(cfg *model.Config) {
*cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement = restrictPrivateChannel
})
}()
th.App.UpdateConfig(func(cfg *model.Config) {
*cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement = model.PermissionsTeamAdmin
})
th.App.UpdateConfig(func(cfg *model.Config) {
*cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement = model.PermissionsTeamAdmin
})
th.App.Srv().SetLicense(model.NewTestLicense())
// Check the migration doesn't change anything if run again.
@@ -219,235 +201,15 @@ func TestDoAdvancedPermissionsMigration(t *testing.T) {
assert.Nil(t, err)
assert.Equal(t, permissions, role.Permissions)
}
// Reset the database
th.ResetRoleMigration()
// Do the migration again with different policy config settings and a license.
th.App.DoAdvancedPermissionsMigration()
// Check the role permissions.
expected2 := map[string][]string{
"channel_user": {
model.PermissionReadChannel.Id,
model.PermissionAddReaction.Id,
model.PermissionRemoveReaction.Id,
model.PermissionManagePublicChannelMembers.Id,
model.PermissionUploadFile.Id,
model.PermissionGetPublicLink.Id,
model.PermissionCreatePost.Id,
model.PermissionUseChannelMentions.Id,
model.PermissionUseSlashCommands.Id,
model.PermissionDeletePublicChannel.Id,
model.PermissionDeletePrivateChannel.Id,
model.PermissionManagePrivateChannelMembers.Id,
model.PermissionDeletePost.Id,
model.PermissionEditPost.Id,
},
"channel_admin": {
model.PermissionManageChannelRoles.Id,
model.PermissionUseGroupMentions.Id,
},
"team_user": {
model.PermissionListTeamChannels.Id,
model.PermissionJoinPublicChannels.Id,
model.PermissionReadPublicChannel.Id,
model.PermissionViewTeam.Id,
model.PermissionCreatePublicChannel.Id,
model.PermissionCreatePrivateChannel.Id,
model.PermissionInviteUser.Id,
model.PermissionAddUserToTeam.Id,
},
"team_post_all": {
model.PermissionCreatePost.Id,
model.PermissionUseChannelMentions.Id,
},
"team_post_all_public": {
model.PermissionCreatePostPublic.Id,
model.PermissionUseChannelMentions.Id,
},
"team_admin": {
model.PermissionRemoveUserFromTeam.Id,
model.PermissionManageTeam.Id,
model.PermissionImportTeam.Id,
model.PermissionManageTeamRoles.Id,
model.PermissionManageChannelRoles.Id,
model.PermissionManageOthersIncomingWebhooks.Id,
model.PermissionManageOthersOutgoingWebhooks.Id,
model.PermissionManageSlashCommands.Id,
model.PermissionManageOthersSlashCommands.Id,
model.PermissionManageIncomingWebhooks.Id,
model.PermissionManageOutgoingWebhooks.Id,
model.PermissionConvertPublicChannelToPrivate.Id,
model.PermissionConvertPrivateChannelToPublic.Id,
model.PermissionManagePublicChannelProperties.Id,
model.PermissionManagePrivateChannelProperties.Id,
model.PermissionDeletePost.Id,
model.PermissionDeleteOthersPosts.Id,
},
"system_user": {
model.PermissionListPublicTeams.Id,
model.PermissionJoinPublicTeams.Id,
model.PermissionCreateDirectChannel.Id,
model.PermissionCreateGroupChannel.Id,
model.PermissionViewMembers.Id,
model.PermissionCreateTeam.Id,
},
"system_post_all": {
model.PermissionCreatePost.Id,
model.PermissionUseChannelMentions.Id,
},
"system_post_all_public": {
model.PermissionCreatePostPublic.Id,
model.PermissionUseChannelMentions.Id,
},
"system_user_access_token": {
model.PermissionCreateUserAccessToken.Id,
model.PermissionReadUserAccessToken.Id,
model.PermissionRevokeUserAccessToken.Id,
},
"system_admin": allPermissionIDs,
}
roles3, err3 := th.App.GetRolesByNames(roleNames)
assert.Nil(t, err3)
assert.Equal(t, len(roles3), len(roleNames))
for name, permissions := range expected2 {
role, err := th.App.GetRoleByName(context.Background(), name)
assert.Nil(t, err)
assert.Equal(t, permissions, role.Permissions, fmt.Sprintf("'%v' did not have expected permissions", name))
}
// Remove the license.
th.App.Srv().SetLicense(nil)
// Do the migration again.
th.ResetRoleMigration()
th.App.DoAdvancedPermissionsMigration()
// Check the role permissions.
roles4, err4 := th.App.GetRolesByNames(roleNames)
assert.Nil(t, err4)
assert.Equal(t, len(roles4), len(roleNames))
for name, permissions := range expected1 {
role, err := th.App.GetRoleByName(context.Background(), name)
assert.Nil(t, err)
assert.Equal(t, permissions, role.Permissions)
}
// Check that the config setting for "always" and "time_limit" edit posts is updated correctly.
th.ResetRoleMigration()
allowEditPost := *th.App.Config().ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost
postEditTimeLimit := *th.App.Config().ServiceSettings.PostEditTimeLimit
defer func() {
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost = allowEditPost })
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.PostEditTimeLimit = postEditTimeLimit })
}()
th.App.UpdateConfig(func(cfg *model.Config) {
*cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost = "always"
*cfg.ServiceSettings.PostEditTimeLimit = 300
})
th.App.DoAdvancedPermissionsMigration()
config := th.App.Config()
assert.Equal(t, -1, *config.ServiceSettings.PostEditTimeLimit)
th.ResetRoleMigration()
th.App.UpdateConfig(func(cfg *model.Config) {
*cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost = "time_limit"
*cfg.ServiceSettings.PostEditTimeLimit = 300
})
th.App.DoAdvancedPermissionsMigration()
config = th.App.Config()
assert.Equal(t, 300, *config.ServiceSettings.PostEditTimeLimit)
}
func TestDoEmojisPermissionsMigration(t *testing.T) {
th := SetupWithoutPreloadMigrations(t)
defer th.TearDown()
// Add a license and change the policy config.
restrictCustomEmojiCreation := *th.App.Config().ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation
defer func() {
th.App.UpdateConfig(func(cfg *model.Config) {
*cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation = restrictCustomEmojiCreation
})
}()
th.App.UpdateConfig(func(cfg *model.Config) {
*cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation = model.RestrictEmojiCreationSystemAdmin
})
th.ResetEmojisMigration()
th.App.DoEmojisPermissionsMigration()
expectedSystemAdmin := allPermissionIDs
sort.Strings(expectedSystemAdmin)
role1, err1 := th.App.GetRoleByName(context.Background(), model.SystemAdminRoleId)
assert.Nil(t, err1)
sort.Strings(role1.Permissions)
assert.Equal(t, expectedSystemAdmin, role1.Permissions, fmt.Sprintf("'%v' did not have expected permissions", model.SystemAdminRoleId))
th.App.UpdateConfig(func(cfg *model.Config) {
*cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation = model.RestrictEmojiCreationAdmin
})
th.ResetEmojisMigration()
th.App.DoEmojisPermissionsMigration()
role2, err2 := th.App.GetRoleByName(context.Background(), model.TeamAdminRoleId)
assert.Nil(t, err2)
expected2 := []string{
model.PermissionRemoveUserFromTeam.Id,
model.PermissionManageTeam.Id,
model.PermissionImportTeam.Id,
model.PermissionManageTeamRoles.Id,
model.PermissionReadPublicChannelGroups.Id,
model.PermissionReadPrivateChannelGroups.Id,
model.PermissionManageChannelRoles.Id,
model.PermissionManageOthersIncomingWebhooks.Id,
model.PermissionManageOthersOutgoingWebhooks.Id,
model.PermissionManageSlashCommands.Id,
model.PermissionManageOthersSlashCommands.Id,
model.PermissionManageIncomingWebhooks.Id,
model.PermissionManageOutgoingWebhooks.Id,
model.PermissionDeletePost.Id,
model.PermissionDeleteOthersPosts.Id,
model.PermissionCreateEmojis.Id,
model.PermissionDeleteEmojis.Id,
model.PermissionAddReaction.Id,
model.PermissionCreatePost.Id,
model.PermissionManagePublicChannelMembers.Id,
model.PermissionManagePrivateChannelMembers.Id,
model.PermissionRemoveReaction.Id,
model.PermissionUseChannelMentions.Id,
model.PermissionUseGroupMentions.Id,
model.PermissionConvertPublicChannelToPrivate.Id,
model.PermissionConvertPrivateChannelToPublic.Id,
}
sort.Strings(expected2)
sort.Strings(role2.Permissions)
assert.Equal(t, expected2, role2.Permissions, fmt.Sprintf("'%v' did not have expected permissions", model.TeamAdminRoleId))
systemAdmin1, systemAdminErr1 := th.App.GetRoleByName(context.Background(), model.SystemAdminRoleId)
assert.Nil(t, systemAdminErr1)
sort.Strings(systemAdmin1.Permissions)
assert.Equal(t, expectedSystemAdmin, systemAdmin1.Permissions, fmt.Sprintf("'%v' did not have expected permissions", model.SystemAdminRoleId))
th.App.UpdateConfig(func(cfg *model.Config) {
*cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation = model.RestrictEmojiCreationAll
})
th.ResetEmojisMigration()
th.App.DoEmojisPermissionsMigration()

32
app/migrations.go
Просмотреть файл

@@ -10,7 +10,6 @@ import (
"github.com/mattermost/mattermost-server/v6/model"
"github.com/mattermost/mattermost-server/v6/shared/mlog"
"github.com/mattermost/mattermost-server/v6/utils"
)
const EmojisPermissionsMigrationKey = "EmojisPermissionsMigrationComplete"
@@ -31,7 +30,6 @@ func (s *Server) doAdvancedPermissionsMigration() {
mlog.Info("Migrating roles to database.")
roles := model.MakeDefaultRoles()
roles = utils.SetRolePermissionsFromConfig(roles, s.Config(), s.License() != nil)
allSucceeded := true
@@ -68,11 +66,9 @@ func (s *Server) doAdvancedPermissionsMigration() {
}
config := s.Config()
if *config.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost == model.AllowEditPostAlways {
*config.ServiceSettings.PostEditTimeLimit = -1
if _, _, err := s.SaveConfig(config, true); err != nil {
mlog.Error("Failed to update config in Advanced Permissions Phase 1 Migration.", mlog.Err(err))
}
*config.ServiceSettings.PostEditTimeLimit = -1
if _, _, err := s.SaveConfig(config, true); err != nil {
mlog.Error("Failed to update config in Advanced Permissions Phase 1 Migration.", mlog.Err(err))
}
system := model.System{
@@ -110,23 +106,11 @@ func (s *Server) doEmojisPermissionsMigration() {
var err *model.AppError
mlog.Info("Migrating emojis config to database.")
switch *s.Config().ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation {
case model.RestrictEmojiCreationAll:
role, err = s.GetRoleByName(context.Background(), model.SystemUserRoleId)
if err != nil {
mlog.Critical("Failed to migrate emojis creation permissions from mattermost config.", mlog.Err(err))
return
}
case model.RestrictEmojiCreationAdmin:
role, err = s.GetRoleByName(context.Background(), model.TeamAdminRoleId)
if err != nil {
mlog.Critical("Failed to migrate emojis creation permissions from mattermost config.", mlog.Err(err))
return
}
case model.RestrictEmojiCreationSystemAdmin:
role = nil
default:
mlog.Critical("Failed to migrate emojis creation permissions from mattermost config. Invalid restrict emoji creation setting")
// Emoji creation is set to all by default
role, err = s.GetRoleByName(context.Background(), model.SystemUserRoleId)
if err != nil {
mlog.Critical("Failed to migrate emojis creation permissions from mattermost config.", mlog.Err(err))
return
}

2
app/post.go
Просмотреть файл

@@ -213,7 +213,7 @@ func (a *App) CreatePost(c *request.Context, post *model.Post, channel *model.Ch
post.AddProp("from_bot", "true")
}
if a.Srv().License() != nil && *a.Config().TeamSettings.ExperimentalTownSquareIsReadOnly &&
if a.Srv().License() != nil &&
!post.IsSystemMessage() &&
channel.Name == model.DefaultChannelName &&
!a.RolesGrantPermission(user.GetRoles(), model.PermissionManageSystem.Id) {

4
app/reaction.go
Просмотреть файл

@@ -29,7 +29,7 @@ func (a *App) SaveReactionForPost(c *request.Context, reaction *model.Reaction)
return nil, model.NewAppError("deleteReactionForPost", "api.reaction.save.archived_channel.app_error", nil, "", http.StatusForbidden)
}
if a.Srv().License() != nil && *a.Config().TeamSettings.ExperimentalTownSquareIsReadOnly && channel.Name == model.DefaultChannelName {
if a.Srv().License() != nil && channel.Name == model.DefaultChannelName {
var user *model.User
user, err = a.GetUser(reaction.UserId)
if err != nil {
@@ -123,7 +123,7 @@ func (a *App) DeleteReactionForPost(c *request.Context, reaction *model.Reaction
return model.NewAppError("DeleteReactionForPost", "api.reaction.delete.archived_channel.app_error", nil, "", http.StatusForbidden)
}
if a.Srv().License() != nil && *a.Config().TeamSettings.ExperimentalTownSquareIsReadOnly && channel.Name == model.DefaultChannelName {
if a.Srv().License() != nil && channel.Name == model.DefaultChannelName {
user, err := a.GetUser(reaction.UserId)
if err != nil {
return err

2
app/webhook.go
Просмотреть файл

@@ -777,7 +777,7 @@ func (a *App) HandleIncomingWebhook(c *request.Context, hookID string, req *mode
}
user = result.Data.(*model.User)
if a.Srv().License() != nil && *a.Config().TeamSettings.ExperimentalTownSquareIsReadOnly &&
if a.Srv().License() != nil &&
channel.Name == model.DefaultChannelName && !a.RolesGrantPermission(user.GetRoles(), model.PermissionManageSystem.Id) {
return model.NewAppError("HandleIncomingWebhook", "api.post.create_post.town_square_read_only", nil, "", http.StatusForbidden)
}

13
config/client.go
Просмотреть файл

@@ -18,7 +18,6 @@ func GenerateClientConfig(c *model.Config, telemetryID string, license *model.Li
props["EnableCustomUserStatuses"] = strconv.FormatBool(*c.TeamSettings.EnableCustomUserStatuses)
props["EnableUserDeactivation"] = strconv.FormatBool(*c.TeamSettings.EnableUserDeactivation)
props["RestrictDirectMessage"] = *c.TeamSettings.RestrictDirectMessage
props["EnableXToLeaveChannelsFromLHS"] = strconv.FormatBool(*c.TeamSettings.EnableXToLeaveChannelsFromLHS)
props["TeammateNameDisplay"] = *c.TeamSettings.TeammateNameDisplay
props["LockTeammateNameDisplay"] = strconv.FormatBool(*c.TeamSettings.LockTeammateNameDisplay)
props["ExperimentalPrimaryTeam"] = *c.TeamSettings.ExperimentalPrimaryTeam
@@ -39,7 +38,6 @@ func GenerateClientConfig(c *model.Config, telemetryID string, license *model.Li
props["EnableDeveloper"] = strconv.FormatBool(*c.ServiceSettings.EnableDeveloper)
props["PostEditTimeLimit"] = fmt.Sprintf("%v", *c.ServiceSettings.PostEditTimeLimit)
props["MinimumHashtagLength"] = fmt.Sprintf("%v", *c.ServiceSettings.MinimumHashtagLength)
props["CloseUnusedDirectMessages"] = strconv.FormatBool(*c.ServiceSettings.CloseUnusedDirectMessages)
props["EnablePreviewFeatures"] = strconv.FormatBool(*c.ServiceSettings.EnablePreviewFeatures)
props["EnableTutorial"] = strconv.FormatBool(*c.ServiceSettings.EnableTutorial)
props["EnableOnboardingFlow"] = strconv.FormatBool(*c.ServiceSettings.EnableOnboardingFlow)
@@ -58,11 +56,6 @@ func GenerateClientConfig(c *model.Config, telemetryID string, license *model.Li
props["ExperimentalCloudUserLimit"] = strconv.FormatInt(*c.ExperimentalSettings.CloudUserLimit, 10)
props["ExperimentalCloudBilling"] = strconv.FormatBool(*c.ExperimentalSettings.CloudBilling)
if *c.ServiceSettings.ExperimentalChannelOrganization || *c.ServiceSettings.ExperimentalGroupUnreadChannels != model.GroupUnreadChannelsDisabled {
props["ExperimentalChannelOrganization"] = strconv.FormatBool(true)
} else {
props["ExperimentalChannelOrganization"] = strconv.FormatBool(false)
}
props["ExperimentalEnableAutomaticReplies"] = strconv.FormatBool(*c.TeamSettings.ExperimentalEnableAutomaticReplies)
props["ExperimentalTimezone"] = strconv.FormatBool(*c.DisplaySettings.ExperimentalTimezone)
@@ -101,13 +94,9 @@ func GenerateClientConfig(c *model.Config, telemetryID string, license *model.Li
props["CloudUserLimit"] = strconv.FormatInt(*c.ExperimentalSettings.CloudUserLimit, 10)
props["EnableLegacySidebar"] = strconv.FormatBool(*c.ServiceSettings.EnableLegacySidebar)
props["EnableReliableWebSockets"] = strconv.FormatBool(*c.ServiceSettings.EnableReliableWebSockets)
// Set default values for all options that require a license.
props["ExperimentalHideTownSquareinLHS"] = "false"
props["ExperimentalTownSquareIsReadOnly"] = "false"
props["ExperimentalEnableAuthenticationTransfer"] = "true"
props["LdapNicknameAttributeSet"] = "false"
props["LdapFirstNameAttributeSet"] = "false"
@@ -144,8 +133,6 @@ func GenerateClientConfig(c *model.Config, telemetryID string, license *model.Li
props["CollapsedThreads"] = *c.ServiceSettings.CollapsedThreads
if license != nil {
props["ExperimentalHideTownSquareinLHS"] = strconv.FormatBool(*c.TeamSettings.ExperimentalHideTownSquareinLHS)
props["ExperimentalTownSquareIsReadOnly"] = strconv.FormatBool(*c.TeamSettings.ExperimentalTownSquareIsReadOnly)
props["ExperimentalEnableAuthenticationTransfer"] = strconv.FormatBool(*c.ServiceSettings.ExperimentalEnableAuthenticationTransfer)
if *license.Features.LDAP {

27
config/client_test.go
Просмотреть файл

@@ -111,33 +111,6 @@ func TestGetClientConfig(t *testing.T) {
"EnforceMultifactorAuthentication": "true",
},
},
{
"experimental channel organization enabled",
&model.Config{
ServiceSettings: model.ServiceSettings{
ExperimentalChannelOrganization: model.NewBool(true),
},
},
"tag1",
nil,
map[string]string{
"ExperimentalChannelOrganization": "true",
},
},
{
"experimental channel organization disabled, but experimental group unread channels on",
&model.Config{
ServiceSettings: model.ServiceSettings{
ExperimentalChannelOrganization: model.NewBool(false),
ExperimentalGroupUnreadChannels: model.NewString(model.GroupUnreadChannelsDefaultOn),
},
},
"tag1",
nil,
map[string]string{
"ExperimentalChannelOrganization": "true",
},
},
{
"default marketplace",
&model.Config{

1
gosaml2 Подмодуль

Submodule gosaml2 added at 4e9a72d40b

242
model/config.go
Просмотреть файл

@@ -79,10 +79,6 @@ const (
PermissionsDeletePostTeamAdmin = "team_admin"
PermissionsDeletePostSystemAdmin = "system_admin"
AllowEditPostAlways = "always"
AllowEditPostNever = "never"
AllowEditPostTimeLimit = "time_limit"
GroupUnreadChannelsDisabled = "disabled"
GroupUnreadChannelsDefaultOn = "default_on"
GroupUnreadChannelsDefaultOff = "default_off"
@@ -301,7 +297,6 @@ type ServiceSettings struct {
EnablePostUsernameOverride *bool `access:"integrations_integration_management"`
EnablePostIconOverride *bool `access:"integrations_integration_management"`
GoogleDeveloperKey *string `access:"site_posts,write_restrictable,cloud_restrictable"`
DEPRECATED_DO_NOT_USE_EnableOnlyAdminIntegrations *bool `json:"EnableOnlyAdminIntegrations" mapstructure:"EnableOnlyAdminIntegrations"` // Deprecated: do not use
EnableLinkPreviews *bool `access:"site_posts"`
EnablePermalinkPreviews *bool `access:"site_posts"`
RestrictLinkPreviews *string `access:"site_posts"`
@@ -333,9 +328,6 @@ type ServiceSettings struct {
GfycatAPISecret *string `access:"integrations_gif"`
EnableCustomEmoji *bool `access:"site_emoji"`
EnableEmojiPicker *bool `access:"site_emoji"`
DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation *string `json:"RestrictCustomEmojiCreation" mapstructure:"RestrictCustomEmojiCreation"` // Deprecated: do not use
DEPRECATED_DO_NOT_USE_RestrictPostDelete *string `json:"RestrictPostDelete" mapstructure:"RestrictPostDelete"` // Deprecated: do not use
DEPRECATED_DO_NOT_USE_AllowEditPost *string `json:"AllowEditPost" mapstructure:"AllowEditPost"` // Deprecated: do not use
PostEditTimeLimit *int `access:"user_management_permissions"`
TimeBetweenUserTypingUpdatesMilliseconds *int64 `access:"experimental_features,write_restrictable,cloud_restrictable"`
EnablePostSearch *bool `access:"write_restrictable,cloud_restrictable"`
@@ -346,20 +338,14 @@ type ServiceSettings struct {
EnableUserStatuses *bool `access:"write_restrictable,cloud_restrictable"`
ExperimentalEnableAuthenticationTransfer *bool `access:"experimental_features,write_restrictable,cloud_restrictable"`
ClusterLogTimeoutMilliseconds *int `access:"write_restrictable,cloud_restrictable"`
CloseUnusedDirectMessages *bool `access:"experimental_features"`
EnablePreviewFeatures *bool `access:"experimental_features"`
EnableTutorial *bool `access:"experimental_features"`
EnableOnboardingFlow *bool `access:"experimental_features"`
ExperimentalEnableDefaultChannelLeaveJoinMessages *bool `access:"experimental_features"`
ExperimentalGroupUnreadChannels *string `access:"experimental_features"`
ExperimentalChannelOrganization *bool `access:"experimental_features"`
DEPRECATED_DO_NOT_USE_ImageProxyType *string `json:"ImageProxyType" mapstructure:"ImageProxyType"` // Deprecated: do not use
DEPRECATED_DO_NOT_USE_ImageProxyURL *string `json:"ImageProxyURL" mapstructure:"ImageProxyURL"` // Deprecated: do not use
DEPRECATED_DO_NOT_USE_ImageProxyOptions *string `json:"ImageProxyOptions" mapstructure:"ImageProxyOptions"` // Deprecated: do not use
EnableAPITeamDeletion *bool
EnableAPIUserDeletion *bool
ExperimentalEnableHardenedMode *bool `access:"experimental_features"`
DisableLegacyMFA *bool `access:"write_restrictable,cloud_restrictable"`
ExperimentalStrictCSRFEnforcement *bool `access:"experimental_features,write_restrictable,cloud_restrictable"`
EnableEmailInvitations *bool `access:"authentication_signup"`
DisableBotsWhenOwnerIsDeactivated *bool `access:"integrations_bot_accounts,write_restrictable,cloud_restrictable"`
@@ -377,7 +363,6 @@ type ServiceSettings struct {
ThreadAutoFollow *bool `access:"experimental_features"`
CollapsedThreads *string `access:"experimental_features"`
ManagedResourcePaths *string `access:"environment_web_server,write_restrictable,cloud_restrictable"`
EnableLegacySidebar *bool `access:"experimental_features"`
EnableReliableWebSockets *bool `access:"experimental_features"` // telemetry: none
}
@@ -577,10 +562,6 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) {
s.ClusterLogTimeoutMilliseconds = NewInt(2000)
}
if s.CloseUnusedDirectMessages == nil {
s.CloseUnusedDirectMessages = NewBool(false)
}
if s.EnableTutorial == nil {
s.EnableTutorial = NewBool(true)
}
@@ -626,10 +607,6 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) {
s.EnableCommands = NewBool(true)
}
if s.DEPRECATED_DO_NOT_USE_EnableOnlyAdminIntegrations == nil {
s.DEPRECATED_DO_NOT_USE_EnableOnlyAdminIntegrations = NewBool(true)
}
if s.EnablePostUsernameOverride == nil {
s.EnablePostUsernameOverride = NewBool(false)
}
@@ -692,18 +669,6 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) {
s.GfycatAPISecret = NewString(ServiceSettingsDefaultGfycatAPISecret)
}
if s.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation == nil {
s.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation = NewString(RestrictEmojiCreationAll)
}
if s.DEPRECATED_DO_NOT_USE_RestrictPostDelete == nil {
s.DEPRECATED_DO_NOT_USE_RestrictPostDelete = NewString(PermissionsDeletePostAll)
}
if s.DEPRECATED_DO_NOT_USE_AllowEditPost == nil {
s.DEPRECATED_DO_NOT_USE_AllowEditPost = NewString(AllowEditPostAlways)
}
if s.ExperimentalEnableAuthenticationTransfer == nil {
s.ExperimentalEnableAuthenticationTransfer = NewBool(true)
}
@@ -728,23 +693,6 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) {
s.ExperimentalGroupUnreadChannels = NewString(GroupUnreadChannelsDefaultOn)
}
if s.ExperimentalChannelOrganization == nil {
experimentalUnreadEnabled := *s.ExperimentalGroupUnreadChannels != GroupUnreadChannelsDisabled
s.ExperimentalChannelOrganization = NewBool(experimentalUnreadEnabled)
}
if s.DEPRECATED_DO_NOT_USE_ImageProxyType == nil {
s.DEPRECATED_DO_NOT_USE_ImageProxyType = NewString("")
}
if s.DEPRECATED_DO_NOT_USE_ImageProxyURL == nil {
s.DEPRECATED_DO_NOT_USE_ImageProxyURL = NewString("")
}
if s.DEPRECATED_DO_NOT_USE_ImageProxyOptions == nil {
s.DEPRECATED_DO_NOT_USE_ImageProxyOptions = NewString("")
}
if s.EnableAPITeamDeletion == nil {
s.EnableAPITeamDeletion = NewBool(false)
}
@@ -761,10 +709,6 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) {
s.ExperimentalEnableHardenedMode = NewBool(false)
}
if s.DisableLegacyMFA == nil {
s.DisableLegacyMFA = NewBool(!isUpdate)
}
if s.ExperimentalStrictCSRFEnforcement == nil {
s.ExperimentalStrictCSRFEnforcement = NewBool(false)
}
@@ -833,32 +777,27 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) {
s.ManagedResourcePaths = NewString("")
}
if s.EnableLegacySidebar == nil {
s.EnableLegacySidebar = NewBool(false)
}
if s.EnableReliableWebSockets == nil {
s.EnableReliableWebSockets = NewBool(true)
}
}
type ClusterSettings struct {
Enable *bool `access:"environment_high_availability,write_restrictable"`
ClusterName *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
OverrideHostname *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
NetworkInterface *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
BindAddress *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
AdvertiseAddress *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
UseIPAddress *bool `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
DEPRECATED_DO_NOT_USE_UseExperimentalGossip *bool `json:"UseExperimentalGossip" access:"environment_high_availability,write_restrictable,cloud_restrictable"` // Deprecated: do not use
EnableGossipCompression *bool `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
EnableExperimentalGossipEncryption *bool `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
ReadOnlyConfig *bool `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
GossipPort *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
StreamingPort *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
MaxIdleConns *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
MaxIdleConnsPerHost *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
IdleConnTimeoutMilliseconds *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
Enable *bool `access:"environment_high_availability,write_restrictable"`
ClusterName *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
OverrideHostname *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
NetworkInterface *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
BindAddress *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
AdvertiseAddress *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
UseIPAddress *bool `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
EnableGossipCompression *bool `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
EnableExperimentalGossipEncryption *bool `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
ReadOnlyConfig *bool `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
GossipPort *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
StreamingPort *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
MaxIdleConns *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
MaxIdleConnsPerHost *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
IdleConnTimeoutMilliseconds *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
}
func (s *ClusterSettings) SetDefaults() {
@@ -890,10 +829,6 @@ func (s *ClusterSettings) SetDefaults() {
s.UseIPAddress = NewBool(true)
}
if s.DEPRECATED_DO_NOT_USE_UseExperimentalGossip == nil {
s.DEPRECATED_DO_NOT_USE_UseExperimentalGossip = NewBool(true)
}
if s.EnableExperimentalGossipEncryption == nil {
s.EnableExperimentalGossipEncryption = NewBool(false)
}
@@ -1930,39 +1865,27 @@ func (s *ThemeSettings) SetDefaults() {
}
type TeamSettings struct {
SiteName *string `access:"site_customization"`
MaxUsersPerTeam *int `access:"site_users_and_teams"`
DEPRECATED_DO_NOT_USE_EnableTeamCreation *bool `json:"EnableTeamCreation" mapstructure:"EnableTeamCreation"` // Deprecated: do not use
EnableUserCreation *bool `access:"authentication_signup"`
EnableOpenServer *bool `access:"authentication_signup"`
EnableUserDeactivation *bool `access:"experimental_features"`
RestrictCreationToDomains *string `access:"authentication_signup"` // telemetry: none
EnableCustomUserStatuses *bool `access:"site_users_and_teams"`
EnableCustomBrand *bool `access:"site_customization"`
CustomBrandText *string `access:"site_customization"`
CustomDescriptionText *string `access:"site_customization"`
RestrictDirectMessage *string `access:"site_users_and_teams"`
DEPRECATED_DO_NOT_USE_RestrictTeamInvite *string `json:"RestrictTeamInvite" mapstructure:"RestrictTeamInvite"` // Deprecated: do not use
DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement *string `json:"RestrictPublicChannelManagement" mapstructure:"RestrictPublicChannelManagement"` // Deprecated: do not use
DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement *string `json:"RestrictPrivateChannelManagement" mapstructure:"RestrictPrivateChannelManagement"` // Deprecated: do not use
DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation *string `json:"RestrictPublicChannelCreation" mapstructure:"RestrictPublicChannelCreation"` // Deprecated: do not use
DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation *string `json:"RestrictPrivateChannelCreation" mapstructure:"RestrictPrivateChannelCreation"` // Deprecated: do not use
DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion *string `json:"RestrictPublicChannelDeletion" mapstructure:"RestrictPublicChannelDeletion"` // Deprecated: do not use
DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion *string `json:"RestrictPrivateChannelDeletion" mapstructure:"RestrictPrivateChannelDeletion"` // Deprecated: do not use
DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManageMembers *string `json:"RestrictPrivateChannelManageMembers" mapstructure:"RestrictPrivateChannelManageMembers"` // Deprecated: do not use
EnableXToLeaveChannelsFromLHS *bool `access:"experimental_features"`
UserStatusAwayTimeout *int64 `access:"experimental_features"`
MaxChannelsPerTeam *int64 `access:"site_users_and_teams"`
MaxNotificationsPerChannel *int64 `access:"environment_push_notification_server"`
EnableConfirmNotificationsToChannel *bool `access:"site_notifications"`
TeammateNameDisplay *string `access:"site_users_and_teams"`
ExperimentalViewArchivedChannels *bool `access:"experimental_features,site_users_and_teams"`
ExperimentalEnableAutomaticReplies *bool `access:"experimental_features"`
ExperimentalHideTownSquareinLHS *bool `access:"experimental_features"`
ExperimentalTownSquareIsReadOnly *bool `access:"experimental_features"`
LockTeammateNameDisplay *bool `access:"site_users_and_teams"`
ExperimentalPrimaryTeam *string `access:"experimental_features"`
ExperimentalDefaultChannels []string `access:"experimental_features"`
SiteName *string `access:"site_customization"`
MaxUsersPerTeam *int `access:"site_users_and_teams"`
EnableUserCreation *bool `access:"authentication_signup"`
EnableOpenServer *bool `access:"authentication_signup"`
EnableUserDeactivation *bool `access:"experimental_features"`
RestrictCreationToDomains *string `access:"authentication_signup"` // telemetry: none
EnableCustomUserStatuses *bool `access:"site_users_and_teams"`
EnableCustomBrand *bool `access:"site_customization"`
CustomBrandText *string `access:"site_customization"`
CustomDescriptionText *string `access:"site_customization"`
RestrictDirectMessage *string `access:"site_users_and_teams"`
UserStatusAwayTimeout *int64 `access:"experimental_features"`
MaxChannelsPerTeam *int64 `access:"site_users_and_teams"`
MaxNotificationsPerChannel *int64 `access:"environment_push_notification_server"`
EnableConfirmNotificationsToChannel *bool `access:"site_notifications"`
TeammateNameDisplay *string `access:"site_users_and_teams"`
ExperimentalViewArchivedChannels *bool `access:"experimental_features,site_users_and_teams"`
ExperimentalEnableAutomaticReplies *bool `access:"experimental_features"`
LockTeammateNameDisplay *bool `access:"site_users_and_teams"`
ExperimentalPrimaryTeam *string `access:"experimental_features"`
ExperimentalDefaultChannels []string `access:"experimental_features"`
}
func (s *TeamSettings) SetDefaults() {
@@ -1975,10 +1898,6 @@ func (s *TeamSettings) SetDefaults() {
s.MaxUsersPerTeam = NewInt(TeamSettingsDefaultMaxUsersPerTeam)
}
if s.DEPRECATED_DO_NOT_USE_EnableTeamCreation == nil {
s.DEPRECATED_DO_NOT_USE_EnableTeamCreation = NewBool(true)
}
if s.EnableUserCreation == nil {
s.EnableUserCreation = NewBool(true)
}
@@ -2015,55 +1934,6 @@ func (s *TeamSettings) SetDefaults() {
s.RestrictDirectMessage = NewString(DirectMessageAny)
}
if s.DEPRECATED_DO_NOT_USE_RestrictTeamInvite == nil {
s.DEPRECATED_DO_NOT_USE_RestrictTeamInvite = NewString(PermissionsAll)
}
if s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement == nil {
s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement = NewString(PermissionsAll)
}
if s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement == nil {
s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement = NewString(PermissionsAll)
}
if s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation == nil {
s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation = new(string)
// If this setting does not exist, assume migration from <3.6, so use management setting as default.
if *s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement == PermissionsChannelAdmin {
*s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation = PermissionsTeamAdmin
} else {
*s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation = *s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement
}
}
if s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation == nil {
// If this setting does not exist, assume migration from <3.6, so use management setting as default.
if *s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement == PermissionsChannelAdmin {
s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation = NewString(PermissionsTeamAdmin)
} else {
s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation = NewString(*s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement)
}
}
if s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion == nil {
// If this setting does not exist, assume migration from <3.6, so use management setting as default.
s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion = NewString(*s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement)
}
if s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion == nil {
// If this setting does not exist, assume migration from <3.6, so use management setting as default.
s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion = NewString(*s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement)
}
if s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManageMembers == nil {
s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManageMembers = NewString(PermissionsAll)
}
if s.EnableXToLeaveChannelsFromLHS == nil {
s.EnableXToLeaveChannelsFromLHS = NewBool(false)
}
if s.UserStatusAwayTimeout == nil {
s.UserStatusAwayTimeout = NewInt64(TeamSettingsDefaultUserStatusAwayTimeout)
}
@@ -2084,14 +1954,6 @@ func (s *TeamSettings) SetDefaults() {
s.ExperimentalEnableAutomaticReplies = NewBool(false)
}
if s.ExperimentalHideTownSquareinLHS == nil {
s.ExperimentalHideTownSquareinLHS = NewBool(false)
}
if s.ExperimentalTownSquareIsReadOnly == nil {
s.ExperimentalTownSquareIsReadOnly = NewBool(false)
}
if s.ExperimentalPrimaryTeam == nil {
s.ExperimentalPrimaryTeam = NewString("")
}
@@ -2100,10 +1962,6 @@ func (s *TeamSettings) SetDefaults() {
s.ExperimentalDefaultChannels = []string{}
}
if s.DEPRECATED_DO_NOT_USE_EnableTeamCreation == nil {
s.DEPRECATED_DO_NOT_USE_EnableTeamCreation = NewBool(true)
}
if s.EnableUserCreation == nil {
s.EnableUserCreation = NewBool(true)
}
@@ -3001,37 +2859,21 @@ type ImageProxySettings struct {
RemoteImageProxyOptions *string `access:"environment_image_proxy"`
}
func (s *ImageProxySettings) SetDefaults(ss ServiceSettings) {
func (s *ImageProxySettings) SetDefaults() {
if s.Enable == nil {
if ss.DEPRECATED_DO_NOT_USE_ImageProxyType == nil || *ss.DEPRECATED_DO_NOT_USE_ImageProxyType == "" {
s.Enable = NewBool(false)
} else {
s.Enable = NewBool(true)
}
s.Enable = NewBool(false)
}
if s.ImageProxyType == nil {
if ss.DEPRECATED_DO_NOT_USE_ImageProxyType == nil || *ss.DEPRECATED_DO_NOT_USE_ImageProxyType == "" {
s.ImageProxyType = NewString(ImageProxyTypeLocal)
} else {
s.ImageProxyType = ss.DEPRECATED_DO_NOT_USE_ImageProxyType
}
s.ImageProxyType = NewString(ImageProxyTypeLocal)
}
if s.RemoteImageProxyURL == nil {
if ss.DEPRECATED_DO_NOT_USE_ImageProxyURL == nil {
s.RemoteImageProxyURL = NewString("")
} else {
s.RemoteImageProxyURL = ss.DEPRECATED_DO_NOT_USE_ImageProxyURL
}
s.RemoteImageProxyURL = NewString("")
}
if s.RemoteImageProxyOptions == nil {
if ss.DEPRECATED_DO_NOT_USE_ImageProxyOptions == nil {
s.RemoteImageProxyOptions = NewString("")
} else {
s.RemoteImageProxyOptions = ss.DEPRECATED_DO_NOT_USE_ImageProxyOptions
}
s.RemoteImageProxyOptions = NewString("")
}
}
@@ -3282,7 +3124,7 @@ func (o *Config) SetDefaults() {
o.MessageExportSettings.SetDefaults()
o.DisplaySettings.SetDefaults()
o.GuestAccountsSettings.SetDefaults()
o.ImageProxySettings.SetDefaults(o.ServiceSettings)
o.ImageProxySettings.SetDefaults()
o.CloudSettings.SetDefaults()
if o.FeatureFlags == nil {
o.FeatureFlags = &FeatureFlags{}

38
model/config_test.go
Просмотреть файл

@@ -814,49 +814,15 @@ func TestListenAddressIsValidated(t *testing.T) {
}
func TestImageProxySettingsSetDefaults(t *testing.T) {
ss := ServiceSettings{
DEPRECATED_DO_NOT_USE_ImageProxyType: NewString(ImageProxyTypeAtmosCamo),
DEPRECATED_DO_NOT_USE_ImageProxyURL: NewString("http://images.example.com"),
DEPRECATED_DO_NOT_USE_ImageProxyOptions: NewString("1234abcd"),
}
t.Run("default, no old settings", func(t *testing.T) {
t.Run("default settings", func(t *testing.T) {
ips := ImageProxySettings{}
ips.SetDefaults(ServiceSettings{})
ips.SetDefaults()
assert.Equal(t, false, *ips.Enable)
assert.Equal(t, ImageProxyTypeLocal, *ips.ImageProxyType)
assert.Equal(t, "", *ips.RemoteImageProxyURL)
assert.Equal(t, "", *ips.RemoteImageProxyOptions)
})
t.Run("default, old settings", func(t *testing.T) {
ips := ImageProxySettings{}
ips.SetDefaults(ss)
assert.Equal(t, true, *ips.Enable)
assert.Equal(t, *ss.DEPRECATED_DO_NOT_USE_ImageProxyType, *ips.ImageProxyType)
assert.Equal(t, *ss.DEPRECATED_DO_NOT_USE_ImageProxyURL, *ips.RemoteImageProxyURL)
assert.Equal(t, *ss.DEPRECATED_DO_NOT_USE_ImageProxyOptions, *ips.RemoteImageProxyOptions)
})
t.Run("not default, old settings", func(t *testing.T) {
url := "http://images.mattermost.com"
options := "aaaaaaaa"
ips := ImageProxySettings{
Enable: NewBool(false),
ImageProxyType: NewString(ImageProxyTypeLocal),
RemoteImageProxyURL: &url,
RemoteImageProxyOptions: &options,
}
ips.SetDefaults(ss)
assert.Equal(t, false, *ips.Enable)
assert.Equal(t, ImageProxyTypeLocal, *ips.ImageProxyType)
assert.Equal(t, url, *ips.RemoteImageProxyURL)
assert.Equal(t, options, *ips.RemoteImageProxyOptions)
})
}
func TestImageProxySettingsIsValid(t *testing.T) {

14
model/role.go
Просмотреть файл

@@ -705,6 +705,13 @@ func MakeDefaultRoles() map[string]*Role {
PermissionCreatePost.Id,
PermissionUseChannelMentions.Id,
PermissionUseSlashCommands.Id,
PermissionManagePublicChannelProperties.Id,
PermissionDeletePublicChannel.Id,
PermissionManagePrivateChannelProperties.Id,
PermissionDeletePrivateChannel.Id,
PermissionManagePrivateChannelMembers.Id,
PermissionDeletePost.Id,
PermissionEditPost.Id,
},
SchemeManaged: true,
BuiltIn: true,
@@ -742,6 +749,10 @@ func MakeDefaultRoles() map[string]*Role {
PermissionJoinPublicChannels.Id,
PermissionReadPublicChannel.Id,
PermissionViewTeam.Id,
PermissionCreatePublicChannel.Id,
PermissionCreatePrivateChannel.Id,
PermissionInviteUser.Id,
PermissionAddUserToTeam.Id,
},
SchemeManaged: true,
BuiltIn: true,
@@ -789,6 +800,8 @@ func MakeDefaultRoles() map[string]*Role {
PermissionManageOutgoingWebhooks.Id,
PermissionConvertPublicChannelToPrivate.Id,
PermissionConvertPrivateChannelToPublic.Id,
PermissionDeletePost.Id,
PermissionDeleteOthersPosts.Id,
},
SchemeManaged: true,
BuiltIn: true,
@@ -816,6 +829,7 @@ func MakeDefaultRoles() map[string]*Role {
PermissionCreateDirectChannel.Id,
PermissionCreateGroupChannel.Id,
PermissionViewMembers.Id,
PermissionCreateTeam.Id,
},
SchemeManaged: true,
BuiltIn: true,

1
scripts/config_generator/main_test.go
Просмотреть файл

@@ -25,7 +25,6 @@ func TestDefaultsGenerator(t *testing.T) {
b, err := ioutil.ReadFile(tmpFile.Name())
require.NoError(t, err)
require.NoError(t, json.Unmarshal(b, &config))
require.True(t, *config.ServiceSettings.DisableLegacyMFA)
require.Equal(t, *config.SqlSettings.AtRestEncryptKey, "")
require.Equal(t, *config.FileSettings.PublicLinkSalt, "")

60
services/telemetry/telemetry.go
Просмотреть файл

@@ -366,7 +366,6 @@ func (ts *TelemetryService) trackConfig() {
"enable_incoming_webhooks": cfg.ServiceSettings.EnableIncomingWebhooks,
"enable_outgoing_webhooks": cfg.ServiceSettings.EnableOutgoingWebhooks,
"enable_commands": *cfg.ServiceSettings.EnableCommands,
"enable_only_admin_integrations": *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_EnableOnlyAdminIntegrations,
"enable_post_username_override": cfg.ServiceSettings.EnablePostUsernameOverride,
"enable_post_icon_override": cfg.ServiceSettings.EnablePostIconOverride,
"enable_user_access_tokens": *cfg.ServiceSettings.EnableUserAccessTokens,
@@ -376,7 +375,6 @@ func (ts *TelemetryService) trackConfig() {
"gfycat_api_key": isDefault(*cfg.ServiceSettings.GfycatAPIKey, model.ServiceSettingsDefaultGfycatAPIKey),
"gfycat_api_secret": isDefault(*cfg.ServiceSettings.GfycatAPISecret, model.ServiceSettingsDefaultGfycatAPISecret),
"experimental_enable_authentication_transfer": *cfg.ServiceSettings.ExperimentalEnableAuthenticationTransfer,
"restrict_custom_emoji_creation": *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation,
"enable_testing": cfg.ServiceSettings.EnableTesting,
"enable_developer": *cfg.ServiceSettings.EnableDeveloper,
"enable_multifactor_authentication": *cfg.ServiceSettings.EnableMultifactorAuthentication,
@@ -405,8 +403,6 @@ func (ts *TelemetryService) trackConfig() {
"cors_allow_credentials": *cfg.ServiceSettings.CorsAllowCredentials,
"cors_debug": *cfg.ServiceSettings.CorsDebug,
"isdefault_allowed_untrusted_internal_connections": isDefault(*cfg.ServiceSettings.AllowedUntrustedInternalConnections, ""),
"restrict_post_delete": *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictPostDelete,
"allow_edit_post": *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost,
"post_edit_time_limit": *cfg.ServiceSettings.PostEditTimeLimit,
"enable_user_typing_messages": *cfg.ServiceSettings.EnableUserTypingMessages,
"enable_channel_viewed_messages": *cfg.ServiceSettings.EnableChannelViewedMessages,
@@ -415,7 +411,6 @@ func (ts *TelemetryService) trackConfig() {
"enable_post_search": *cfg.ServiceSettings.EnablePostSearch,
"minimum_hashtag_length": *cfg.ServiceSettings.MinimumHashtagLength,
"enable_user_statuses": *cfg.ServiceSettings.EnableUserStatuses,
"close_unused_direct_messages": *cfg.ServiceSettings.CloseUnusedDirectMessages,
"enable_preview_features": *cfg.ServiceSettings.EnablePreviewFeatures,
"enable_tutorial": *cfg.ServiceSettings.EnableTutorial,
"enable_onboarding_flow": *cfg.ServiceSettings.EnableOnboardingFlow,
@@ -428,10 +423,8 @@ func (ts *TelemetryService) trackConfig() {
"enable_api_user_deletion": *cfg.ServiceSettings.EnableAPIUserDeletion,
"enable_api_channel_deletion": *cfg.ServiceSettings.EnableAPIChannelDeletion,
"experimental_enable_hardened_mode": *cfg.ServiceSettings.ExperimentalEnableHardenedMode,
"disable_legacy_mfa": *cfg.ServiceSettings.DisableLegacyMFA,
"experimental_strict_csrf_enforcement": *cfg.ServiceSettings.ExperimentalStrictCSRFEnforcement,
"enable_email_invitations": *cfg.ServiceSettings.EnableEmailInvitations,
"experimental_channel_organization": *cfg.ServiceSettings.ExperimentalChannelOrganization,
"disable_bots_when_owner_is_deactivated": *cfg.ServiceSettings.DisableBotsWhenOwnerIsDeactivated,
"enable_bot_account_creation": *cfg.ServiceSettings.EnableBotAccountCreation,
"enable_svgs": *cfg.ServiceSettings.EnableSVGs,
@@ -440,7 +433,6 @@ func (ts *TelemetryService) trackConfig() {
"enable_opentracing": *cfg.ServiceSettings.EnableOpenTracing,
"enable_local_mode": *cfg.ServiceSettings.EnableLocalMode,
"managed_resource_paths": isDefault(*cfg.ServiceSettings.ManagedResourcePaths, ""),
"enable_legacy_sidebar": *cfg.ServiceSettings.EnableLegacySidebar,
"thread_auto_follow": *cfg.ServiceSettings.ThreadAutoFollow,
"enable_link_previews": *cfg.ServiceSettings.EnableLinkPreviews,
"enable_permalink_previews": *cfg.ServiceSettings.EnablePermalinkPreviews,
@@ -449,38 +441,26 @@ func (ts *TelemetryService) trackConfig() {
})
ts.sendTelemetry(TrackConfigTeam, map[string]interface{}{
"enable_user_creation": cfg.TeamSettings.EnableUserCreation,
"enable_team_creation": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_EnableTeamCreation,
"restrict_team_invite": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictTeamInvite,
"restrict_public_channel_creation": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation,
"restrict_private_channel_creation": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation,
"restrict_public_channel_management": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement,
"restrict_private_channel_management": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement,
"restrict_public_channel_deletion": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion,
"restrict_private_channel_deletion": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion,
"enable_open_server": *cfg.TeamSettings.EnableOpenServer,
"enable_user_deactivation": *cfg.TeamSettings.EnableUserDeactivation,
"enable_custom_user_statuses": *cfg.TeamSettings.EnableCustomUserStatuses,
"enable_custom_brand": *cfg.TeamSettings.EnableCustomBrand,
"restrict_direct_message": *cfg.TeamSettings.RestrictDirectMessage,
"max_notifications_per_channel": *cfg.TeamSettings.MaxNotificationsPerChannel,
"enable_confirm_notifications_to_channel": *cfg.TeamSettings.EnableConfirmNotificationsToChannel,
"max_users_per_team": *cfg.TeamSettings.MaxUsersPerTeam,
"max_channels_per_team": *cfg.TeamSettings.MaxChannelsPerTeam,
"teammate_name_display": *cfg.TeamSettings.TeammateNameDisplay,
"experimental_view_archived_channels": *cfg.TeamSettings.ExperimentalViewArchivedChannels,
"lock_teammate_name_display": *cfg.TeamSettings.LockTeammateNameDisplay,
"isdefault_site_name": isDefault(cfg.TeamSettings.SiteName, "Mattermost"),
"isdefault_custom_brand_text": isDefault(*cfg.TeamSettings.CustomBrandText, model.TeamSettingsDefaultCustomBrandText),
"isdefault_custom_description_text": isDefault(*cfg.TeamSettings.CustomDescriptionText, model.TeamSettingsDefaultCustomDescriptionText),
"isdefault_user_status_away_timeout": isDefault(*cfg.TeamSettings.UserStatusAwayTimeout, model.TeamSettingsDefaultUserStatusAwayTimeout),
"restrict_private_channel_manage_members": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManageMembers,
"enable_X_to_leave_channels_from_LHS": *cfg.TeamSettings.EnableXToLeaveChannelsFromLHS,
"experimental_enable_automatic_replies": *cfg.TeamSettings.ExperimentalEnableAutomaticReplies,
"experimental_town_square_is_hidden_in_lhs": *cfg.TeamSettings.ExperimentalHideTownSquareinLHS,
"experimental_town_square_is_read_only": *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly,
"experimental_primary_team": isDefault(*cfg.TeamSettings.ExperimentalPrimaryTeam, ""),
"experimental_default_channels": len(cfg.TeamSettings.ExperimentalDefaultChannels),
"enable_user_creation": cfg.TeamSettings.EnableUserCreation,
"enable_open_server": *cfg.TeamSettings.EnableOpenServer,
"enable_user_deactivation": *cfg.TeamSettings.EnableUserDeactivation,
"enable_custom_user_statuses": *cfg.TeamSettings.EnableCustomUserStatuses,
"enable_custom_brand": *cfg.TeamSettings.EnableCustomBrand,
"restrict_direct_message": *cfg.TeamSettings.RestrictDirectMessage,
"max_notifications_per_channel": *cfg.TeamSettings.MaxNotificationsPerChannel,
"enable_confirm_notifications_to_channel": *cfg.TeamSettings.EnableConfirmNotificationsToChannel,
"max_users_per_team": *cfg.TeamSettings.MaxUsersPerTeam,
"max_channels_per_team": *cfg.TeamSettings.MaxChannelsPerTeam,
"teammate_name_display": *cfg.TeamSettings.TeammateNameDisplay,
"experimental_view_archived_channels": *cfg.TeamSettings.ExperimentalViewArchivedChannels,
"lock_teammate_name_display": *cfg.TeamSettings.LockTeammateNameDisplay,
"isdefault_site_name": isDefault(cfg.TeamSettings.SiteName, "Mattermost"),
"isdefault_custom_brand_text": isDefault(*cfg.TeamSettings.CustomBrandText, model.TeamSettingsDefaultCustomBrandText),
"isdefault_custom_description_text": isDefault(*cfg.TeamSettings.CustomDescriptionText, model.TeamSettingsDefaultCustomDescriptionText),
"isdefault_user_status_away_timeout": isDefault(*cfg.TeamSettings.UserStatusAwayTimeout, model.TeamSettingsDefaultUserStatusAwayTimeout),
"experimental_enable_automatic_replies": *cfg.TeamSettings.ExperimentalEnableAutomaticReplies,
"experimental_primary_team": isDefault(*cfg.TeamSettings.ExperimentalPrimaryTeam, ""),
"experimental_default_channels": len(cfg.TeamSettings.ExperimentalDefaultChannels),
})
ts.sendTelemetry(TrackConfigClientReq, map[string]interface{}{

22
tests/test-config.json
Просмотреть файл

@@ -19,7 +19,6 @@
"EnableIncomingWebhooks": true,
"EnableOutgoingWebhooks": true,
"EnableCommands": true,
"EnableOnlyAdminIntegrations": true,
"EnablePostUsernameOverride": false,
"EnablePostIconOverride": false,
"EnableLinkPreviews": false,
@@ -45,9 +44,6 @@
"WebserverMode": "gzip",
"EnableCustomEmoji": false,
"EnableEmojiPicker": true,
"RestrictCustomEmojiCreation": "all",
"RestrictPostDelete": "all",
"AllowEditPost": "always",
"PostEditTimeLimit": -1,
"TimeBetweenUserTypingUpdatesMilliseconds": 5000,
"EnablePostSearch": true,
@@ -57,22 +53,17 @@
"EnableUserStatuses": true,
"ExperimentalEnableAuthenticationTransfer": true,
"ClusterLogTimeoutMilliseconds": 2000,
"CloseUnusedDirectMessages": false,
"EnablePreviewFeatures": true,
"EnableTutorial": true,
"EnableOnboardingFlow": true,
"ExperimentalEnableDefaultChannelLeaveJoinMessages": true,
"ExperimentalGroupUnreadChannels": "disabled",
"ImageProxyType": "",
"ImageProxyURL": "",
"ImageProxyOptions": "",
"EnableAPITeamDeletion": false,
"ExperimentalEnableHardenedMode": false,
"ExperimentalEnableHardenedMode": false
},
"TeamSettings": {
"SiteName": "Mattermost",
"MaxUsersPerTeam": 50,
"EnableTeamCreation": true,
"EnableUserCreation": true,
"EnableOpenServer": false,
"EnableUserDeactivation": false,
@@ -81,23 +72,12 @@
"CustomBrandText": "",
"CustomDescriptionText": "",
"RestrictDirectMessage": "any",
"RestrictTeamInvite": "all",
"RestrictPublicChannelManagement": "all",
"RestrictPrivateChannelManagement": "all",
"RestrictPublicChannelCreation": "all",
"RestrictPrivateChannelCreation": "all",
"RestrictPublicChannelDeletion": "all",
"RestrictPrivateChannelDeletion": "all",
"RestrictPrivateChannelManageMembers": "all",
"EnableXToLeaveChannelsFromLHS": false,
"UserStatusAwayTimeout": 300,
"MaxChannelsPerTeam": 2000,
"MaxNotificationsPerChannel": 1000,
"EnableConfirmNotificationsToChannel": true,
"TeammateNameDisplay": "username",
"ExperimentalEnableAutomaticReplies": false,
"ExperimentalHideTownSquareinLHS": false,
"ExperimentalTownSquareIsReadOnly": false,
"ExperimentalPrimaryTeam": ""
},
"ClientRequirements": {

295
utils/authorization.go
Просмотреть файл

@@ -1,295 +0,0 @@
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
// See LICENSE.txt for license information.
package utils
import (
"github.com/mattermost/mattermost-server/v6/model"
)
func SetRolePermissionsFromConfig(roles map[string]*model.Role, cfg *model.Config, isLicensed bool) map[string]*model.Role {
if isLicensed {
switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation {
case model.PermissionsAll:
roles[model.TeamUserRoleId].Permissions = append(
roles[model.TeamUserRoleId].Permissions,
model.PermissionCreatePublicChannel.Id,
)
case model.PermissionsTeamAdmin:
roles[model.TeamAdminRoleId].Permissions = append(
roles[model.TeamAdminRoleId].Permissions,
model.PermissionCreatePublicChannel.Id,
)
}
} else {
roles[model.TeamUserRoleId].Permissions = append(
roles[model.TeamUserRoleId].Permissions,
model.PermissionCreatePublicChannel.Id,
)
}
if isLicensed {
switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement {
case model.PermissionsAll:
roles[model.ChannelUserRoleId].Permissions = append(
roles[model.ChannelUserRoleId].Permissions,
model.PermissionManagePublicChannelProperties.Id,
)
case model.PermissionsChannelAdmin:
roles[model.TeamAdminRoleId].Permissions = append(
roles[model.TeamAdminRoleId].Permissions,
model.PermissionManagePublicChannelProperties.Id,
)
roles[model.ChannelAdminRoleId].Permissions = append(
roles[model.ChannelAdminRoleId].Permissions,
model.PermissionManagePublicChannelProperties.Id,
)
case model.PermissionsTeamAdmin:
roles[model.TeamAdminRoleId].Permissions = append(
roles[model.TeamAdminRoleId].Permissions,
model.PermissionManagePublicChannelProperties.Id,
)
}
} else {
roles[model.ChannelUserRoleId].Permissions = append(
roles[model.ChannelUserRoleId].Permissions,
model.PermissionManagePublicChannelProperties.Id,
)
}
if isLicensed {
switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion {
case model.PermissionsAll:
roles[model.ChannelUserRoleId].Permissions = append(
roles[model.ChannelUserRoleId].Permissions,
model.PermissionDeletePublicChannel.Id,
)
case model.PermissionsChannelAdmin:
roles[model.TeamAdminRoleId].Permissions = append(
roles[model.TeamAdminRoleId].Permissions,
model.PermissionDeletePublicChannel.Id,
)
roles[model.ChannelAdminRoleId].Permissions = append(
roles[model.ChannelAdminRoleId].Permissions,
model.PermissionDeletePublicChannel.Id,
)
case model.PermissionsTeamAdmin:
roles[model.TeamAdminRoleId].Permissions = append(
roles[model.TeamAdminRoleId].Permissions,
model.PermissionDeletePublicChannel.Id,
)
}
} else {
roles[model.ChannelUserRoleId].Permissions = append(
roles[model.ChannelUserRoleId].Permissions,
model.PermissionDeletePublicChannel.Id,
)
}
if isLicensed {
switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation {
case model.PermissionsAll:
roles[model.TeamUserRoleId].Permissions = append(
roles[model.TeamUserRoleId].Permissions,
model.PermissionCreatePrivateChannel.Id,
)
case model.PermissionsTeamAdmin:
roles[model.TeamAdminRoleId].Permissions = append(
roles[model.TeamAdminRoleId].Permissions,
model.PermissionCreatePrivateChannel.Id,
)
}
} else {
roles[model.TeamUserRoleId].Permissions = append(
roles[model.TeamUserRoleId].Permissions,
model.PermissionCreatePrivateChannel.Id,
)
}
if isLicensed {
switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement {
case model.PermissionsAll:
roles[model.ChannelUserRoleId].Permissions = append(
roles[model.ChannelUserRoleId].Permissions,
model.PermissionManagePrivateChannelProperties.Id,
)
case model.PermissionsChannelAdmin:
roles[model.TeamAdminRoleId].Permissions = append(
roles[model.TeamAdminRoleId].Permissions,
model.PermissionManagePrivateChannelProperties.Id,
)
roles[model.ChannelAdminRoleId].Permissions = append(
roles[model.ChannelAdminRoleId].Permissions,
model.PermissionManagePrivateChannelProperties.Id,
)
case model.PermissionsTeamAdmin:
roles[model.TeamAdminRoleId].Permissions = append(
roles[model.TeamAdminRoleId].Permissions,
model.PermissionManagePrivateChannelProperties.Id,
)
}
} else {
roles[model.ChannelUserRoleId].Permissions = append(
roles[model.ChannelUserRoleId].Permissions,
model.PermissionManagePrivateChannelProperties.Id,
)
}
if isLicensed {
switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion {
case model.PermissionsAll:
roles[model.ChannelUserRoleId].Permissions = append(
roles[model.ChannelUserRoleId].Permissions,
model.PermissionDeletePrivateChannel.Id,
)
case model.PermissionsChannelAdmin:
roles[model.TeamAdminRoleId].Permissions = append(
roles[model.TeamAdminRoleId].Permissions,
model.PermissionDeletePrivateChannel.Id,
)
roles[model.ChannelAdminRoleId].Permissions = append(
roles[model.ChannelAdminRoleId].Permissions,
model.PermissionDeletePrivateChannel.Id,
)
case model.PermissionsTeamAdmin:
roles[model.TeamAdminRoleId].Permissions = append(
roles[model.TeamAdminRoleId].Permissions,
model.PermissionDeletePrivateChannel.Id,
)
}
} else {
roles[model.ChannelUserRoleId].Permissions = append(
roles[model.ChannelUserRoleId].Permissions,
model.PermissionDeletePrivateChannel.Id,
)
}
// Restrict permissions for Private Channel Manage Members
if isLicensed {
switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManageMembers {
case model.PermissionsAll:
roles[model.ChannelUserRoleId].Permissions = append(
roles[model.ChannelUserRoleId].Permissions,
model.PermissionManagePrivateChannelMembers.Id,
)
case model.PermissionsChannelAdmin:
roles[model.TeamAdminRoleId].Permissions = append(
roles[model.TeamAdminRoleId].Permissions,
model.PermissionManagePrivateChannelMembers.Id,
)
roles[model.ChannelAdminRoleId].Permissions = append(
roles[model.ChannelAdminRoleId].Permissions,
model.PermissionManagePrivateChannelMembers.Id,
)
case model.PermissionsTeamAdmin:
roles[model.TeamAdminRoleId].Permissions = append(
roles[model.TeamAdminRoleId].Permissions,
model.PermissionManagePrivateChannelMembers.Id,
)
}
} else {
roles[model.ChannelUserRoleId].Permissions = append(
roles[model.ChannelUserRoleId].Permissions,
model.PermissionManagePrivateChannelMembers.Id,
)
}
if !*cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_EnableOnlyAdminIntegrations {
roles[model.TeamUserRoleId].Permissions = append(
roles[model.TeamUserRoleId].Permissions,
model.PermissionManageIncomingWebhooks.Id,
model.PermissionManageOutgoingWebhooks.Id,
model.PermissionManageSlashCommands.Id,
)
roles[model.SystemUserRoleId].Permissions = append(
roles[model.SystemUserRoleId].Permissions,
model.PermissionManageOAuth.Id,
)
}
// Grant permissions for inviting and adding users to a team.
if isLicensed {
if *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictTeamInvite == model.PermissionsTeamAdmin {
roles[model.TeamAdminRoleId].Permissions = append(
roles[model.TeamAdminRoleId].Permissions,
model.PermissionInviteUser.Id,
model.PermissionAddUserToTeam.Id,
)
} else if *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictTeamInvite == model.PermissionsAll {
roles[model.TeamUserRoleId].Permissions = append(
roles[model.TeamUserRoleId].Permissions,
model.PermissionInviteUser.Id,
model.PermissionAddUserToTeam.Id,
)
}
} else {
roles[model.TeamUserRoleId].Permissions = append(
roles[model.TeamUserRoleId].Permissions,
model.PermissionInviteUser.Id,
model.PermissionAddUserToTeam.Id,
)
}
if isLicensed {
switch *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictPostDelete {
case model.PermissionsDeletePostAll:
roles[model.ChannelUserRoleId].Permissions = append(
roles[model.ChannelUserRoleId].Permissions,
model.PermissionDeletePost.Id,
)
roles[model.TeamAdminRoleId].Permissions = append(
roles[model.TeamAdminRoleId].Permissions,
model.PermissionDeletePost.Id,
model.PermissionDeleteOthersPosts.Id,
)
case model.PermissionsDeletePostTeamAdmin:
roles[model.TeamAdminRoleId].Permissions = append(
roles[model.TeamAdminRoleId].Permissions,
model.PermissionDeletePost.Id,
model.PermissionDeleteOthersPosts.Id,
)
}
} else {
roles[model.ChannelUserRoleId].Permissions = append(
roles[model.ChannelUserRoleId].Permissions,
model.PermissionDeletePost.Id,
)
roles[model.TeamAdminRoleId].Permissions = append(
roles[model.TeamAdminRoleId].Permissions,
model.PermissionDeletePost.Id,
model.PermissionDeleteOthersPosts.Id,
)
}
if *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_EnableTeamCreation {
roles[model.SystemUserRoleId].Permissions = append(
roles[model.SystemUserRoleId].Permissions,
model.PermissionCreateTeam.Id,
)
}
if isLicensed {
switch *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost {
case model.AllowEditPostAlways, model.AllowEditPostTimeLimit:
roles[model.ChannelUserRoleId].Permissions = append(
roles[model.ChannelUserRoleId].Permissions,
model.PermissionEditPost.Id,
)
roles[model.SystemAdminRoleId].Permissions = append(
roles[model.SystemAdminRoleId].Permissions,
model.PermissionEditPost.Id,
)
}
} else {
roles[model.ChannelUserRoleId].Permissions = append(
roles[model.ChannelUserRoleId].Permissions,
model.PermissionEditPost.Id,
)
roles[model.SystemAdminRoleId].Permissions = append(
roles[model.SystemAdminRoleId].Permissions,
model.PermissionEditPost.Id,
)
}
return roles
}

133
utils/authorization_test.go
Просмотреть файл

@@ -1,133 +0,0 @@
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
// See LICENSE.txt for license information.
package utils
import (
"encoding/json"
"fmt"
"io/ioutil"
"reflect"
"strconv"
"strings"
"testing"
"github.com/stretchr/testify/require"
"github.com/mattermost/mattermost-server/v6/model"
)
type RoleState struct {
RoleName string `json:"roleName"`
Permission string `json:"permission"`
ShouldHave bool `json:"shouldHave"`
}
func mockConfig() *model.Config {
config := model.Config{}
config.SetDefaults()
return &config
}
func mapping() (map[string]map[string][]RoleState, error) {
policiesRolesMapping := make(map[string]map[string][]RoleState)
raw, err := ioutil.ReadFile("./policies-roles-mapping.json")
if err != nil {
return policiesRolesMapping, err
}
var f map[string]interface{}
err = json.Unmarshal(raw, &f)
if err != nil {
return policiesRolesMapping, err
}
for policyName, value := range f {
capitalizedName := fmt.Sprintf("%v%v", strings.ToUpper(policyName[:1]), policyName[1:])
policiesRolesMapping[capitalizedName] = make(map[string][]RoleState)
for policyValue, roleStatesMappings := range value.(map[string]interface{}) {
var roleStates []RoleState
for _, roleStateMapping := range roleStatesMappings.([]interface{}) {
roleStateMappingJSON, _ := json.Marshal(roleStateMapping)
var roleState RoleState
_ = json.Unmarshal(roleStateMappingJSON, &roleState)
roleStates = append(roleStates, roleState)
}
policiesRolesMapping[capitalizedName][policyValue] = roleStates
}
}
return policiesRolesMapping, nil
}
func TestSetRolePermissionsFromConfig(t *testing.T) {
mapping, err := mapping()
if err != nil {
require.NoError(t, err)
}
for policyName, v := range mapping {
for policyValue, rolesMappings := range v {
config := mockConfig()
updateConfig(config, "DEPRECATED_DO_NOT_USE_"+policyName, policyValue)
roles := model.MakeDefaultRoles()
SetRolePermissionsFromConfig(roles, config, true)
for _, roleMappingItem := range rolesMappings {
role := roles[roleMappingItem.RoleName]
permission := roleMappingItem.Permission
hasPermission := roleHasPermission(role, permission)
if (roleMappingItem.ShouldHave && !hasPermission) || (!roleMappingItem.ShouldHave && hasPermission) {
wording := "not to"
if roleMappingItem.ShouldHave {
wording = "to"
}
t.Errorf("Expected '%v' %v have '%v' permission when '%v' is set to '%v'.", role.Name, wording, permission, policyName, policyValue)
}
}
}
}
}
func updateConfig(config *model.Config, key string, value string) {
v := reflect.ValueOf(config.ServiceSettings)
field := v.FieldByName(key)
if !field.IsValid() {
v = reflect.ValueOf(config.TeamSettings)
field = v.FieldByName(key)
}
switch value {
case "true", "false":
b, _ := strconv.ParseBool(value)
field.Elem().SetBool(b)
default:
field.Elem().SetString(value)
}
}
func roleHasPermission(role *model.Role, permission string) bool {
for _, p := range role.Permissions {
if p == permission {
return true
}
}
return false
}

26
web/webhook_test.go
Просмотреть файл

@@ -129,32 +129,6 @@ func TestIncomingWebhook(t *testing.T) {
assert.Equal(t, http.StatusOK, resp.StatusCode)
})
t.Run("WebhookExperimentalReadOnly", func(t *testing.T) {
th.App.Srv().SetLicense(model.NewTestLicense())
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = true })
// Read only default channel should fail.
resp, err := http.Post(url, "application/json", strings.NewReader(fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", model.DefaultChannelName)))
require.NoError(t, err)
assert.True(t, resp.StatusCode != http.StatusOK)
// None-default channel should still work.
resp, err = http.Post(url, "application/json", strings.NewReader(fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", th.BasicChannel.Name)))
require.NoError(t, err)
assert.True(t, resp.StatusCode == http.StatusOK)
// System-Admin Owned Hook
adminHook, appErr := th.App.CreateIncomingWebhookForChannel(th.SystemAdminUser.Id, th.BasicChannel, &model.IncomingWebhook{ChannelId: th.BasicChannel.Id})
require.Nil(t, appErr)
adminURL := apiClient.URL + "/hooks/" + adminHook.Id
resp, err = http.Post(adminURL, "application/json", strings.NewReader(fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", model.DefaultChannelName)))
require.NoError(t, err)
assert.Equal(t, http.StatusOK, resp.StatusCode)
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = false })
})
t.Run("WebhookAttachments", func(t *testing.T) {
attachmentPayload := `{
"text": "this is a test",