From 3b9324b38956493ba3df05705a30809a0d00ac16 Mon Sep 17 00:00:00 2001 From: Ben Cooke Date: Tue, 14 Sep 2021 13:22:59 -0400 Subject: [PATCH] [MM-36444] Manage config deprecations for 6.0 (#18035) * removing deprecated stuff * removing deprecations and marking others for deprecations * removing some of the configs * partially remove ExperimentalChannelOrganization * fixing merge issues * moving default permissions to defaultroles function * removing experimentaltownsquare * removing old tests and remove legacysidebar config * fixing test * removing log * removing unused variables * MM-36444: Fix for renamed functions. * MM-36444: go mod tidy and go mod vendor. * MM-36444: Vendored go modules. * MM-36444: Removes UseExperimentalGossip config field from model. * Fix vendors * fixing test Co-authored-by: Benjamin Cooke Co-authored-by: Mattermod Co-authored-by: Martin Kraft Co-authored-by: Claudio Costa --- api4/post.go | 1 - api4/post_test.go | 17 -- api4/reaction_test.go | 64 ------ api4/user.go | 35 --- api4/user_test.go | 1 - app/app_test.go | 238 --------------------- app/migrations.go | 32 +-- app/post.go | 2 +- app/reaction.go | 4 +- app/webhook.go | 2 +- config/client.go | 13 -- config/client_test.go | 27 --- gosaml2 | 1 + model/config.go | 242 ++++----------------- model/config_test.go | 38 +--- model/role.go | 14 ++ scripts/config_generator/main_test.go | 1 - services/telemetry/telemetry.go | 60 ++---- tests/test-config.json | 22 +- utils/authorization.go | 295 -------------------------- utils/authorization_test.go | 133 ------------ web/webhook_test.go | 26 --- 22 files changed, 92 insertions(+), 1176 deletions(-) create mode 160000 gosaml2 delete mode 100644 utils/authorization.go delete mode 100644 utils/authorization_test.go diff --git a/api4/post.go b/api4/post.go index 15ba956c0c..539e6f138d 100644 --- a/api4/post.go +++ b/api4/post.go @@ -725,7 +725,6 @@ func saveIsPinnedPost(c *Context, w http.ResponseWriter, isPinned bool) { } if c.App.Srv().License() != nil && - *c.App.Config().TeamSettings.ExperimentalTownSquareIsReadOnly && channel.Name == model.DefaultChannelName && !c.App.RolesGrantPermission(user.GetRoles(), model.PermissionManageSystem.Id) { c.Err = model.NewAppError("saveIsPinnedPost", "api.post.save_is_pinned_post.town_square_read_only", nil, "", http.StatusForbidden) diff --git a/api4/post_test.go b/api4/post_test.go index 6d8a42e887..4db75c01df 100644 --- a/api4/post_test.go +++ b/api4/post_test.go @@ -1006,23 +1006,6 @@ func TestPinPost(t *testing.T) { require.Error(t, err) CheckForbiddenStatus(t, resp) - t.Run("unable-to-pin-post-in-read-only-town-square", func(t *testing.T) { - townSquareIsReadOnly := *th.App.Config().TeamSettings.ExperimentalTownSquareIsReadOnly - th.App.Srv().SetLicense(model.NewTestLicense()) - th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = true }) - - defer th.App.Srv().RemoveLicense() - defer th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = townSquareIsReadOnly }) - - channel, appErr := th.App.GetChannelByName("town-square", th.BasicTeam.Id, true) - assert.Nil(t, appErr) - adminPost := th.CreatePostWithClient(th.SystemAdminClient, channel) - - resp, err = client.PinPost(adminPost.Id) - require.Error(t, err) - CheckForbiddenStatus(t, resp) - }) - client.Logout() resp, err = client.PinPost(post.Id) require.Error(t, err) diff --git a/api4/reaction_test.go b/api4/reaction_test.go index b4c4c1ef55..86044498d8 100644 --- a/api4/reaction_test.go +++ b/api4/reaction_test.go @@ -165,34 +165,6 @@ func TestSaveReaction(t *testing.T) { th.AddPermissionToRole(model.PermissionAddReaction.Id, model.ChannelUserRoleId) }) - t.Run("unable-to-react-in-read-only-town-square", func(t *testing.T) { - th.LoginBasic() - - channel, appErr := th.App.GetChannelByName("town-square", th.BasicTeam.Id, true) - assert.Nil(t, appErr) - post := th.CreatePostWithClient(th.Client, channel) - - th.App.Srv().SetLicense(model.NewTestLicense()) - th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = true }) - - reaction := &model.Reaction{ - UserId: userId, - PostId: post.Id, - EmojiName: "smile", - } - - _, resp, err := client.SaveReaction(reaction) - require.Error(t, err) - CheckForbiddenStatus(t, resp) - - reactions, appErr := th.App.GetReactionsForPost(post.Id) - require.Nil(t, appErr) - require.Equal(t, 0, len(reactions), "should have not created a reaction") - - th.App.Srv().RemoveLicense() - th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = false }) - }) - t.Run("unable-to-react-in-an-archived-channel", func(t *testing.T) { th.LoginBasic() @@ -501,42 +473,6 @@ func TestDeleteReaction(t *testing.T) { th.AddPermissionToRole(model.PermissionRemoveOthersReactions.Id, model.SystemAdminRoleId) }) - t.Run("unable-to-delete-reactions-in-read-only-town-square", func(t *testing.T) { - th.LoginBasic() - - channel, appErr := th.App.GetChannelByName("town-square", th.BasicTeam.Id, true) - assert.Nil(t, appErr) - post := th.CreatePostWithClient(th.Client, channel) - - th.App.Srv().SetLicense(model.NewTestLicense()) - - reaction := &model.Reaction{ - UserId: userId, - PostId: post.Id, - EmojiName: "smile", - } - - r1, _, err := client.SaveReaction(reaction) - require.NoError(t, err) - - reactions, appErr := th.App.GetReactionsForPost(postId) - require.Nil(t, appErr) - require.Equal(t, 1, len(reactions), "should have created a reaction") - - th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = true }) - - resp, err := th.SystemAdminClient.DeleteReaction(r1) - require.Error(t, err) - CheckForbiddenStatus(t, resp) - - reactions, appErr = th.App.GetReactionsForPost(postId) - require.Nil(t, appErr) - require.Equal(t, 1, len(reactions), "should have not deleted a reaction") - - th.App.Srv().RemoveLicense() - th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = false }) - }) - t.Run("unable-to-delete-reactions-in-an-archived-channel", func(t *testing.T) { th.LoginBasic() diff --git a/api4/user.go b/api4/user.go index a32683febc..25054090cb 100644 --- a/api4/user.go +++ b/api4/user.go @@ -57,7 +57,6 @@ func (api *API) InitUser() { api.BaseRoutes.User.Handle("/auth", api.APISessionRequiredTrustRequester(updateUserAuth)).Methods("PUT") - api.BaseRoutes.Users.Handle("/mfa", api.APIHandler(checkUserMfa)).Methods("POST") api.BaseRoutes.User.Handle("/mfa", api.APISessionRequiredMfa(updateUserMfa)).Methods("PUT") api.BaseRoutes.User.Handle("/mfa/generate", api.APISessionRequiredMfa(generateMfaSecret)).Methods("POST") @@ -1510,40 +1509,6 @@ func updateUserAuth(c *Context, w http.ResponseWriter, r *http.Request) { } } -// Deprecated: checkUserMfa is deprecated and should not be used anymore, starting with version 6.0 it will be disabled. -// Clients should attempt a login without MFA and will receive a MFA error when it's required. -func checkUserMfa(c *Context, w http.ResponseWriter, r *http.Request) { - - if *c.App.Config().ServiceSettings.DisableLegacyMFA { - http.NotFound(w, r) - return - } - - props := model.MapFromJSON(r.Body) - - loginId := props["login_id"] - if loginId == "" { - c.SetInvalidParam("login_id") - return - } - - resp := map[string]interface{}{} - resp["mfa_required"] = false - - if !*c.App.Config().ServiceSettings.EnableMultifactorAuthentication { - w.Write([]byte(model.StringInterfaceToJSON(resp))) - return - } - - if *c.App.Config().ServiceSettings.ExperimentalEnableHardenedMode { - resp["mfa_required"] = true - } else if user, err := c.App.GetUserForLogin("", loginId); err == nil { - resp["mfa_required"] = user.MfaActive - } - - w.Write([]byte(model.StringInterfaceToJSON(resp))) -} - func updateUserMfa(c *Context, w http.ResponseWriter, r *http.Request) { c.RequireUserId() if c.Err != nil { diff --git a/api4/user_test.go b/api4/user_test.go index 99d9fbdb25..8247afdb54 100644 --- a/api4/user_test.go +++ b/api4/user_test.go @@ -2769,7 +2769,6 @@ func TestUserLoginMFAFlow(t *testing.T) { defer th.TearDown() th.App.UpdateConfig(func(c *model.Config) { - *c.ServiceSettings.DisableLegacyMFA = true *c.ServiceSettings.EnableMultifactorAuthentication = true }) diff --git a/app/app_test.go b/app/app_test.go index 91c1af36ef..e3ba8a270f 100644 --- a/app/app_test.go +++ b/app/app_test.go @@ -186,25 +186,7 @@ func TestDoAdvancedPermissionsMigration(t *testing.T) { assert.Nil(t, err) assert.Equal(t, role.Permissions, permissions, fmt.Sprintf("role %q didn't match", name)) } - // Add a license and change the policy config. - restrictPublicChannel := *th.App.Config().TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement - restrictPrivateChannel := *th.App.Config().TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement - defer func() { - th.App.UpdateConfig(func(cfg *model.Config) { - *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement = restrictPublicChannel - }) - th.App.UpdateConfig(func(cfg *model.Config) { - *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement = restrictPrivateChannel - }) - }() - - th.App.UpdateConfig(func(cfg *model.Config) { - *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement = model.PermissionsTeamAdmin - }) - th.App.UpdateConfig(func(cfg *model.Config) { - *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement = model.PermissionsTeamAdmin - }) th.App.Srv().SetLicense(model.NewTestLicense()) // Check the migration doesn't change anything if run again. @@ -219,235 +201,15 @@ func TestDoAdvancedPermissionsMigration(t *testing.T) { assert.Nil(t, err) assert.Equal(t, permissions, role.Permissions) } - - // Reset the database - th.ResetRoleMigration() - - // Do the migration again with different policy config settings and a license. - th.App.DoAdvancedPermissionsMigration() - - // Check the role permissions. - expected2 := map[string][]string{ - "channel_user": { - model.PermissionReadChannel.Id, - model.PermissionAddReaction.Id, - model.PermissionRemoveReaction.Id, - model.PermissionManagePublicChannelMembers.Id, - model.PermissionUploadFile.Id, - model.PermissionGetPublicLink.Id, - model.PermissionCreatePost.Id, - model.PermissionUseChannelMentions.Id, - model.PermissionUseSlashCommands.Id, - model.PermissionDeletePublicChannel.Id, - model.PermissionDeletePrivateChannel.Id, - model.PermissionManagePrivateChannelMembers.Id, - model.PermissionDeletePost.Id, - model.PermissionEditPost.Id, - }, - "channel_admin": { - model.PermissionManageChannelRoles.Id, - model.PermissionUseGroupMentions.Id, - }, - "team_user": { - model.PermissionListTeamChannels.Id, - model.PermissionJoinPublicChannels.Id, - model.PermissionReadPublicChannel.Id, - model.PermissionViewTeam.Id, - model.PermissionCreatePublicChannel.Id, - model.PermissionCreatePrivateChannel.Id, - model.PermissionInviteUser.Id, - model.PermissionAddUserToTeam.Id, - }, - "team_post_all": { - model.PermissionCreatePost.Id, - model.PermissionUseChannelMentions.Id, - }, - "team_post_all_public": { - model.PermissionCreatePostPublic.Id, - model.PermissionUseChannelMentions.Id, - }, - "team_admin": { - model.PermissionRemoveUserFromTeam.Id, - model.PermissionManageTeam.Id, - model.PermissionImportTeam.Id, - model.PermissionManageTeamRoles.Id, - model.PermissionManageChannelRoles.Id, - model.PermissionManageOthersIncomingWebhooks.Id, - model.PermissionManageOthersOutgoingWebhooks.Id, - model.PermissionManageSlashCommands.Id, - model.PermissionManageOthersSlashCommands.Id, - model.PermissionManageIncomingWebhooks.Id, - model.PermissionManageOutgoingWebhooks.Id, - model.PermissionConvertPublicChannelToPrivate.Id, - model.PermissionConvertPrivateChannelToPublic.Id, - model.PermissionManagePublicChannelProperties.Id, - model.PermissionManagePrivateChannelProperties.Id, - model.PermissionDeletePost.Id, - model.PermissionDeleteOthersPosts.Id, - }, - "system_user": { - model.PermissionListPublicTeams.Id, - model.PermissionJoinPublicTeams.Id, - model.PermissionCreateDirectChannel.Id, - model.PermissionCreateGroupChannel.Id, - model.PermissionViewMembers.Id, - model.PermissionCreateTeam.Id, - }, - "system_post_all": { - model.PermissionCreatePost.Id, - model.PermissionUseChannelMentions.Id, - }, - "system_post_all_public": { - model.PermissionCreatePostPublic.Id, - model.PermissionUseChannelMentions.Id, - }, - "system_user_access_token": { - model.PermissionCreateUserAccessToken.Id, - model.PermissionReadUserAccessToken.Id, - model.PermissionRevokeUserAccessToken.Id, - }, - "system_admin": allPermissionIDs, - } - - roles3, err3 := th.App.GetRolesByNames(roleNames) - assert.Nil(t, err3) - assert.Equal(t, len(roles3), len(roleNames)) - - for name, permissions := range expected2 { - role, err := th.App.GetRoleByName(context.Background(), name) - assert.Nil(t, err) - assert.Equal(t, permissions, role.Permissions, fmt.Sprintf("'%v' did not have expected permissions", name)) - } - - // Remove the license. - th.App.Srv().SetLicense(nil) - - // Do the migration again. - th.ResetRoleMigration() - th.App.DoAdvancedPermissionsMigration() - - // Check the role permissions. - roles4, err4 := th.App.GetRolesByNames(roleNames) - assert.Nil(t, err4) - assert.Equal(t, len(roles4), len(roleNames)) - - for name, permissions := range expected1 { - role, err := th.App.GetRoleByName(context.Background(), name) - assert.Nil(t, err) - assert.Equal(t, permissions, role.Permissions) - } - - // Check that the config setting for "always" and "time_limit" edit posts is updated correctly. - th.ResetRoleMigration() - - allowEditPost := *th.App.Config().ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost - postEditTimeLimit := *th.App.Config().ServiceSettings.PostEditTimeLimit - - defer func() { - th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost = allowEditPost }) - th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.PostEditTimeLimit = postEditTimeLimit }) - }() - - th.App.UpdateConfig(func(cfg *model.Config) { - *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost = "always" - *cfg.ServiceSettings.PostEditTimeLimit = 300 - }) - - th.App.DoAdvancedPermissionsMigration() - - config := th.App.Config() - assert.Equal(t, -1, *config.ServiceSettings.PostEditTimeLimit) - - th.ResetRoleMigration() - - th.App.UpdateConfig(func(cfg *model.Config) { - *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost = "time_limit" - *cfg.ServiceSettings.PostEditTimeLimit = 300 - }) - - th.App.DoAdvancedPermissionsMigration() - config = th.App.Config() - assert.Equal(t, 300, *config.ServiceSettings.PostEditTimeLimit) } func TestDoEmojisPermissionsMigration(t *testing.T) { th := SetupWithoutPreloadMigrations(t) defer th.TearDown() - // Add a license and change the policy config. - restrictCustomEmojiCreation := *th.App.Config().ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation - - defer func() { - th.App.UpdateConfig(func(cfg *model.Config) { - *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation = restrictCustomEmojiCreation - }) - }() - - th.App.UpdateConfig(func(cfg *model.Config) { - *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation = model.RestrictEmojiCreationSystemAdmin - }) - - th.ResetEmojisMigration() - th.App.DoEmojisPermissionsMigration() - expectedSystemAdmin := allPermissionIDs sort.Strings(expectedSystemAdmin) - role1, err1 := th.App.GetRoleByName(context.Background(), model.SystemAdminRoleId) - assert.Nil(t, err1) - sort.Strings(role1.Permissions) - assert.Equal(t, expectedSystemAdmin, role1.Permissions, fmt.Sprintf("'%v' did not have expected permissions", model.SystemAdminRoleId)) - - th.App.UpdateConfig(func(cfg *model.Config) { - *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation = model.RestrictEmojiCreationAdmin - }) - - th.ResetEmojisMigration() - th.App.DoEmojisPermissionsMigration() - - role2, err2 := th.App.GetRoleByName(context.Background(), model.TeamAdminRoleId) - assert.Nil(t, err2) - expected2 := []string{ - model.PermissionRemoveUserFromTeam.Id, - model.PermissionManageTeam.Id, - model.PermissionImportTeam.Id, - model.PermissionManageTeamRoles.Id, - model.PermissionReadPublicChannelGroups.Id, - model.PermissionReadPrivateChannelGroups.Id, - model.PermissionManageChannelRoles.Id, - model.PermissionManageOthersIncomingWebhooks.Id, - model.PermissionManageOthersOutgoingWebhooks.Id, - model.PermissionManageSlashCommands.Id, - model.PermissionManageOthersSlashCommands.Id, - model.PermissionManageIncomingWebhooks.Id, - model.PermissionManageOutgoingWebhooks.Id, - model.PermissionDeletePost.Id, - model.PermissionDeleteOthersPosts.Id, - model.PermissionCreateEmojis.Id, - model.PermissionDeleteEmojis.Id, - model.PermissionAddReaction.Id, - model.PermissionCreatePost.Id, - model.PermissionManagePublicChannelMembers.Id, - model.PermissionManagePrivateChannelMembers.Id, - model.PermissionRemoveReaction.Id, - model.PermissionUseChannelMentions.Id, - model.PermissionUseGroupMentions.Id, - model.PermissionConvertPublicChannelToPrivate.Id, - model.PermissionConvertPrivateChannelToPublic.Id, - } - sort.Strings(expected2) - sort.Strings(role2.Permissions) - assert.Equal(t, expected2, role2.Permissions, fmt.Sprintf("'%v' did not have expected permissions", model.TeamAdminRoleId)) - - systemAdmin1, systemAdminErr1 := th.App.GetRoleByName(context.Background(), model.SystemAdminRoleId) - assert.Nil(t, systemAdminErr1) - sort.Strings(systemAdmin1.Permissions) - assert.Equal(t, expectedSystemAdmin, systemAdmin1.Permissions, fmt.Sprintf("'%v' did not have expected permissions", model.SystemAdminRoleId)) - - th.App.UpdateConfig(func(cfg *model.Config) { - *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation = model.RestrictEmojiCreationAll - }) - th.ResetEmojisMigration() th.App.DoEmojisPermissionsMigration() diff --git a/app/migrations.go b/app/migrations.go index 31b1500854..460c5f3ebd 100644 --- a/app/migrations.go +++ b/app/migrations.go @@ -10,7 +10,6 @@ import ( "github.com/mattermost/mattermost-server/v6/model" "github.com/mattermost/mattermost-server/v6/shared/mlog" - "github.com/mattermost/mattermost-server/v6/utils" ) const EmojisPermissionsMigrationKey = "EmojisPermissionsMigrationComplete" @@ -31,7 +30,6 @@ func (s *Server) doAdvancedPermissionsMigration() { mlog.Info("Migrating roles to database.") roles := model.MakeDefaultRoles() - roles = utils.SetRolePermissionsFromConfig(roles, s.Config(), s.License() != nil) allSucceeded := true @@ -68,11 +66,9 @@ func (s *Server) doAdvancedPermissionsMigration() { } config := s.Config() - if *config.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost == model.AllowEditPostAlways { - *config.ServiceSettings.PostEditTimeLimit = -1 - if _, _, err := s.SaveConfig(config, true); err != nil { - mlog.Error("Failed to update config in Advanced Permissions Phase 1 Migration.", mlog.Err(err)) - } + *config.ServiceSettings.PostEditTimeLimit = -1 + if _, _, err := s.SaveConfig(config, true); err != nil { + mlog.Error("Failed to update config in Advanced Permissions Phase 1 Migration.", mlog.Err(err)) } system := model.System{ @@ -110,23 +106,11 @@ func (s *Server) doEmojisPermissionsMigration() { var err *model.AppError mlog.Info("Migrating emojis config to database.") - switch *s.Config().ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation { - case model.RestrictEmojiCreationAll: - role, err = s.GetRoleByName(context.Background(), model.SystemUserRoleId) - if err != nil { - mlog.Critical("Failed to migrate emojis creation permissions from mattermost config.", mlog.Err(err)) - return - } - case model.RestrictEmojiCreationAdmin: - role, err = s.GetRoleByName(context.Background(), model.TeamAdminRoleId) - if err != nil { - mlog.Critical("Failed to migrate emojis creation permissions from mattermost config.", mlog.Err(err)) - return - } - case model.RestrictEmojiCreationSystemAdmin: - role = nil - default: - mlog.Critical("Failed to migrate emojis creation permissions from mattermost config. Invalid restrict emoji creation setting") + + // Emoji creation is set to all by default + role, err = s.GetRoleByName(context.Background(), model.SystemUserRoleId) + if err != nil { + mlog.Critical("Failed to migrate emojis creation permissions from mattermost config.", mlog.Err(err)) return } diff --git a/app/post.go b/app/post.go index 005fcfaa83..7ffb940fa5 100644 --- a/app/post.go +++ b/app/post.go @@ -213,7 +213,7 @@ func (a *App) CreatePost(c *request.Context, post *model.Post, channel *model.Ch post.AddProp("from_bot", "true") } - if a.Srv().License() != nil && *a.Config().TeamSettings.ExperimentalTownSquareIsReadOnly && + if a.Srv().License() != nil && !post.IsSystemMessage() && channel.Name == model.DefaultChannelName && !a.RolesGrantPermission(user.GetRoles(), model.PermissionManageSystem.Id) { diff --git a/app/reaction.go b/app/reaction.go index 74382decd6..f3293bfc36 100644 --- a/app/reaction.go +++ b/app/reaction.go @@ -29,7 +29,7 @@ func (a *App) SaveReactionForPost(c *request.Context, reaction *model.Reaction) return nil, model.NewAppError("deleteReactionForPost", "api.reaction.save.archived_channel.app_error", nil, "", http.StatusForbidden) } - if a.Srv().License() != nil && *a.Config().TeamSettings.ExperimentalTownSquareIsReadOnly && channel.Name == model.DefaultChannelName { + if a.Srv().License() != nil && channel.Name == model.DefaultChannelName { var user *model.User user, err = a.GetUser(reaction.UserId) if err != nil { @@ -123,7 +123,7 @@ func (a *App) DeleteReactionForPost(c *request.Context, reaction *model.Reaction return model.NewAppError("DeleteReactionForPost", "api.reaction.delete.archived_channel.app_error", nil, "", http.StatusForbidden) } - if a.Srv().License() != nil && *a.Config().TeamSettings.ExperimentalTownSquareIsReadOnly && channel.Name == model.DefaultChannelName { + if a.Srv().License() != nil && channel.Name == model.DefaultChannelName { user, err := a.GetUser(reaction.UserId) if err != nil { return err diff --git a/app/webhook.go b/app/webhook.go index 25d0fa69ae..ec58cfed4d 100644 --- a/app/webhook.go +++ b/app/webhook.go @@ -777,7 +777,7 @@ func (a *App) HandleIncomingWebhook(c *request.Context, hookID string, req *mode } user = result.Data.(*model.User) - if a.Srv().License() != nil && *a.Config().TeamSettings.ExperimentalTownSquareIsReadOnly && + if a.Srv().License() != nil && channel.Name == model.DefaultChannelName && !a.RolesGrantPermission(user.GetRoles(), model.PermissionManageSystem.Id) { return model.NewAppError("HandleIncomingWebhook", "api.post.create_post.town_square_read_only", nil, "", http.StatusForbidden) } diff --git a/config/client.go b/config/client.go index bf80bb3f1e..fcdf44c112 100644 --- a/config/client.go +++ b/config/client.go @@ -18,7 +18,6 @@ func GenerateClientConfig(c *model.Config, telemetryID string, license *model.Li props["EnableCustomUserStatuses"] = strconv.FormatBool(*c.TeamSettings.EnableCustomUserStatuses) props["EnableUserDeactivation"] = strconv.FormatBool(*c.TeamSettings.EnableUserDeactivation) props["RestrictDirectMessage"] = *c.TeamSettings.RestrictDirectMessage - props["EnableXToLeaveChannelsFromLHS"] = strconv.FormatBool(*c.TeamSettings.EnableXToLeaveChannelsFromLHS) props["TeammateNameDisplay"] = *c.TeamSettings.TeammateNameDisplay props["LockTeammateNameDisplay"] = strconv.FormatBool(*c.TeamSettings.LockTeammateNameDisplay) props["ExperimentalPrimaryTeam"] = *c.TeamSettings.ExperimentalPrimaryTeam @@ -39,7 +38,6 @@ func GenerateClientConfig(c *model.Config, telemetryID string, license *model.Li props["EnableDeveloper"] = strconv.FormatBool(*c.ServiceSettings.EnableDeveloper) props["PostEditTimeLimit"] = fmt.Sprintf("%v", *c.ServiceSettings.PostEditTimeLimit) props["MinimumHashtagLength"] = fmt.Sprintf("%v", *c.ServiceSettings.MinimumHashtagLength) - props["CloseUnusedDirectMessages"] = strconv.FormatBool(*c.ServiceSettings.CloseUnusedDirectMessages) props["EnablePreviewFeatures"] = strconv.FormatBool(*c.ServiceSettings.EnablePreviewFeatures) props["EnableTutorial"] = strconv.FormatBool(*c.ServiceSettings.EnableTutorial) props["EnableOnboardingFlow"] = strconv.FormatBool(*c.ServiceSettings.EnableOnboardingFlow) @@ -58,11 +56,6 @@ func GenerateClientConfig(c *model.Config, telemetryID string, license *model.Li props["ExperimentalCloudUserLimit"] = strconv.FormatInt(*c.ExperimentalSettings.CloudUserLimit, 10) props["ExperimentalCloudBilling"] = strconv.FormatBool(*c.ExperimentalSettings.CloudBilling) - if *c.ServiceSettings.ExperimentalChannelOrganization || *c.ServiceSettings.ExperimentalGroupUnreadChannels != model.GroupUnreadChannelsDisabled { - props["ExperimentalChannelOrganization"] = strconv.FormatBool(true) - } else { - props["ExperimentalChannelOrganization"] = strconv.FormatBool(false) - } props["ExperimentalEnableAutomaticReplies"] = strconv.FormatBool(*c.TeamSettings.ExperimentalEnableAutomaticReplies) props["ExperimentalTimezone"] = strconv.FormatBool(*c.DisplaySettings.ExperimentalTimezone) @@ -101,13 +94,9 @@ func GenerateClientConfig(c *model.Config, telemetryID string, license *model.Li props["CloudUserLimit"] = strconv.FormatInt(*c.ExperimentalSettings.CloudUserLimit, 10) - props["EnableLegacySidebar"] = strconv.FormatBool(*c.ServiceSettings.EnableLegacySidebar) - props["EnableReliableWebSockets"] = strconv.FormatBool(*c.ServiceSettings.EnableReliableWebSockets) // Set default values for all options that require a license. - props["ExperimentalHideTownSquareinLHS"] = "false" - props["ExperimentalTownSquareIsReadOnly"] = "false" props["ExperimentalEnableAuthenticationTransfer"] = "true" props["LdapNicknameAttributeSet"] = "false" props["LdapFirstNameAttributeSet"] = "false" @@ -144,8 +133,6 @@ func GenerateClientConfig(c *model.Config, telemetryID string, license *model.Li props["CollapsedThreads"] = *c.ServiceSettings.CollapsedThreads if license != nil { - props["ExperimentalHideTownSquareinLHS"] = strconv.FormatBool(*c.TeamSettings.ExperimentalHideTownSquareinLHS) - props["ExperimentalTownSquareIsReadOnly"] = strconv.FormatBool(*c.TeamSettings.ExperimentalTownSquareIsReadOnly) props["ExperimentalEnableAuthenticationTransfer"] = strconv.FormatBool(*c.ServiceSettings.ExperimentalEnableAuthenticationTransfer) if *license.Features.LDAP { diff --git a/config/client_test.go b/config/client_test.go index b10ff9bdaf..8402d14af3 100644 --- a/config/client_test.go +++ b/config/client_test.go @@ -111,33 +111,6 @@ func TestGetClientConfig(t *testing.T) { "EnforceMultifactorAuthentication": "true", }, }, - { - "experimental channel organization enabled", - &model.Config{ - ServiceSettings: model.ServiceSettings{ - ExperimentalChannelOrganization: model.NewBool(true), - }, - }, - "tag1", - nil, - map[string]string{ - "ExperimentalChannelOrganization": "true", - }, - }, - { - "experimental channel organization disabled, but experimental group unread channels on", - &model.Config{ - ServiceSettings: model.ServiceSettings{ - ExperimentalChannelOrganization: model.NewBool(false), - ExperimentalGroupUnreadChannels: model.NewString(model.GroupUnreadChannelsDefaultOn), - }, - }, - "tag1", - nil, - map[string]string{ - "ExperimentalChannelOrganization": "true", - }, - }, { "default marketplace", &model.Config{ diff --git a/gosaml2 b/gosaml2 new file mode 160000 index 0000000000..4e9a72d40b --- /dev/null +++ b/gosaml2 @@ -0,0 +1 @@ +Subproject commit 4e9a72d40b7841a1e3b89a53daed0f69ead6ef95 diff --git a/model/config.go b/model/config.go index 540e4226cc..4f6f37ef46 100644 --- a/model/config.go +++ b/model/config.go @@ -79,10 +79,6 @@ const ( PermissionsDeletePostTeamAdmin = "team_admin" PermissionsDeletePostSystemAdmin = "system_admin" - AllowEditPostAlways = "always" - AllowEditPostNever = "never" - AllowEditPostTimeLimit = "time_limit" - GroupUnreadChannelsDisabled = "disabled" GroupUnreadChannelsDefaultOn = "default_on" GroupUnreadChannelsDefaultOff = "default_off" @@ -301,7 +297,6 @@ type ServiceSettings struct { EnablePostUsernameOverride *bool `access:"integrations_integration_management"` EnablePostIconOverride *bool `access:"integrations_integration_management"` GoogleDeveloperKey *string `access:"site_posts,write_restrictable,cloud_restrictable"` - DEPRECATED_DO_NOT_USE_EnableOnlyAdminIntegrations *bool `json:"EnableOnlyAdminIntegrations" mapstructure:"EnableOnlyAdminIntegrations"` // Deprecated: do not use EnableLinkPreviews *bool `access:"site_posts"` EnablePermalinkPreviews *bool `access:"site_posts"` RestrictLinkPreviews *string `access:"site_posts"` @@ -333,9 +328,6 @@ type ServiceSettings struct { GfycatAPISecret *string `access:"integrations_gif"` EnableCustomEmoji *bool `access:"site_emoji"` EnableEmojiPicker *bool `access:"site_emoji"` - DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation *string `json:"RestrictCustomEmojiCreation" mapstructure:"RestrictCustomEmojiCreation"` // Deprecated: do not use - DEPRECATED_DO_NOT_USE_RestrictPostDelete *string `json:"RestrictPostDelete" mapstructure:"RestrictPostDelete"` // Deprecated: do not use - DEPRECATED_DO_NOT_USE_AllowEditPost *string `json:"AllowEditPost" mapstructure:"AllowEditPost"` // Deprecated: do not use PostEditTimeLimit *int `access:"user_management_permissions"` TimeBetweenUserTypingUpdatesMilliseconds *int64 `access:"experimental_features,write_restrictable,cloud_restrictable"` EnablePostSearch *bool `access:"write_restrictable,cloud_restrictable"` @@ -346,20 +338,14 @@ type ServiceSettings struct { EnableUserStatuses *bool `access:"write_restrictable,cloud_restrictable"` ExperimentalEnableAuthenticationTransfer *bool `access:"experimental_features,write_restrictable,cloud_restrictable"` ClusterLogTimeoutMilliseconds *int `access:"write_restrictable,cloud_restrictable"` - CloseUnusedDirectMessages *bool `access:"experimental_features"` EnablePreviewFeatures *bool `access:"experimental_features"` EnableTutorial *bool `access:"experimental_features"` EnableOnboardingFlow *bool `access:"experimental_features"` ExperimentalEnableDefaultChannelLeaveJoinMessages *bool `access:"experimental_features"` ExperimentalGroupUnreadChannels *string `access:"experimental_features"` - ExperimentalChannelOrganization *bool `access:"experimental_features"` - DEPRECATED_DO_NOT_USE_ImageProxyType *string `json:"ImageProxyType" mapstructure:"ImageProxyType"` // Deprecated: do not use - DEPRECATED_DO_NOT_USE_ImageProxyURL *string `json:"ImageProxyURL" mapstructure:"ImageProxyURL"` // Deprecated: do not use - DEPRECATED_DO_NOT_USE_ImageProxyOptions *string `json:"ImageProxyOptions" mapstructure:"ImageProxyOptions"` // Deprecated: do not use EnableAPITeamDeletion *bool EnableAPIUserDeletion *bool ExperimentalEnableHardenedMode *bool `access:"experimental_features"` - DisableLegacyMFA *bool `access:"write_restrictable,cloud_restrictable"` ExperimentalStrictCSRFEnforcement *bool `access:"experimental_features,write_restrictable,cloud_restrictable"` EnableEmailInvitations *bool `access:"authentication_signup"` DisableBotsWhenOwnerIsDeactivated *bool `access:"integrations_bot_accounts,write_restrictable,cloud_restrictable"` @@ -377,7 +363,6 @@ type ServiceSettings struct { ThreadAutoFollow *bool `access:"experimental_features"` CollapsedThreads *string `access:"experimental_features"` ManagedResourcePaths *string `access:"environment_web_server,write_restrictable,cloud_restrictable"` - EnableLegacySidebar *bool `access:"experimental_features"` EnableReliableWebSockets *bool `access:"experimental_features"` // telemetry: none } @@ -577,10 +562,6 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) { s.ClusterLogTimeoutMilliseconds = NewInt(2000) } - if s.CloseUnusedDirectMessages == nil { - s.CloseUnusedDirectMessages = NewBool(false) - } - if s.EnableTutorial == nil { s.EnableTutorial = NewBool(true) } @@ -626,10 +607,6 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) { s.EnableCommands = NewBool(true) } - if s.DEPRECATED_DO_NOT_USE_EnableOnlyAdminIntegrations == nil { - s.DEPRECATED_DO_NOT_USE_EnableOnlyAdminIntegrations = NewBool(true) - } - if s.EnablePostUsernameOverride == nil { s.EnablePostUsernameOverride = NewBool(false) } @@ -692,18 +669,6 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) { s.GfycatAPISecret = NewString(ServiceSettingsDefaultGfycatAPISecret) } - if s.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation == nil { - s.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation = NewString(RestrictEmojiCreationAll) - } - - if s.DEPRECATED_DO_NOT_USE_RestrictPostDelete == nil { - s.DEPRECATED_DO_NOT_USE_RestrictPostDelete = NewString(PermissionsDeletePostAll) - } - - if s.DEPRECATED_DO_NOT_USE_AllowEditPost == nil { - s.DEPRECATED_DO_NOT_USE_AllowEditPost = NewString(AllowEditPostAlways) - } - if s.ExperimentalEnableAuthenticationTransfer == nil { s.ExperimentalEnableAuthenticationTransfer = NewBool(true) } @@ -728,23 +693,6 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) { s.ExperimentalGroupUnreadChannels = NewString(GroupUnreadChannelsDefaultOn) } - if s.ExperimentalChannelOrganization == nil { - experimentalUnreadEnabled := *s.ExperimentalGroupUnreadChannels != GroupUnreadChannelsDisabled - s.ExperimentalChannelOrganization = NewBool(experimentalUnreadEnabled) - } - - if s.DEPRECATED_DO_NOT_USE_ImageProxyType == nil { - s.DEPRECATED_DO_NOT_USE_ImageProxyType = NewString("") - } - - if s.DEPRECATED_DO_NOT_USE_ImageProxyURL == nil { - s.DEPRECATED_DO_NOT_USE_ImageProxyURL = NewString("") - } - - if s.DEPRECATED_DO_NOT_USE_ImageProxyOptions == nil { - s.DEPRECATED_DO_NOT_USE_ImageProxyOptions = NewString("") - } - if s.EnableAPITeamDeletion == nil { s.EnableAPITeamDeletion = NewBool(false) } @@ -761,10 +709,6 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) { s.ExperimentalEnableHardenedMode = NewBool(false) } - if s.DisableLegacyMFA == nil { - s.DisableLegacyMFA = NewBool(!isUpdate) - } - if s.ExperimentalStrictCSRFEnforcement == nil { s.ExperimentalStrictCSRFEnforcement = NewBool(false) } @@ -833,32 +777,27 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) { s.ManagedResourcePaths = NewString("") } - if s.EnableLegacySidebar == nil { - s.EnableLegacySidebar = NewBool(false) - } - if s.EnableReliableWebSockets == nil { s.EnableReliableWebSockets = NewBool(true) } } type ClusterSettings struct { - Enable *bool `access:"environment_high_availability,write_restrictable"` - ClusterName *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none - OverrideHostname *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none - NetworkInterface *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` - BindAddress *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` - AdvertiseAddress *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` - UseIPAddress *bool `access:"environment_high_availability,write_restrictable,cloud_restrictable"` - DEPRECATED_DO_NOT_USE_UseExperimentalGossip *bool `json:"UseExperimentalGossip" access:"environment_high_availability,write_restrictable,cloud_restrictable"` // Deprecated: do not use - EnableGossipCompression *bool `access:"environment_high_availability,write_restrictable,cloud_restrictable"` - EnableExperimentalGossipEncryption *bool `access:"environment_high_availability,write_restrictable,cloud_restrictable"` - ReadOnlyConfig *bool `access:"environment_high_availability,write_restrictable,cloud_restrictable"` - GossipPort *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none - StreamingPort *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none - MaxIdleConns *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none - MaxIdleConnsPerHost *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none - IdleConnTimeoutMilliseconds *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none + Enable *bool `access:"environment_high_availability,write_restrictable"` + ClusterName *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none + OverrideHostname *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none + NetworkInterface *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` + BindAddress *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` + AdvertiseAddress *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` + UseIPAddress *bool `access:"environment_high_availability,write_restrictable,cloud_restrictable"` + EnableGossipCompression *bool `access:"environment_high_availability,write_restrictable,cloud_restrictable"` + EnableExperimentalGossipEncryption *bool `access:"environment_high_availability,write_restrictable,cloud_restrictable"` + ReadOnlyConfig *bool `access:"environment_high_availability,write_restrictable,cloud_restrictable"` + GossipPort *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none + StreamingPort *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none + MaxIdleConns *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none + MaxIdleConnsPerHost *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none + IdleConnTimeoutMilliseconds *int `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none } func (s *ClusterSettings) SetDefaults() { @@ -890,10 +829,6 @@ func (s *ClusterSettings) SetDefaults() { s.UseIPAddress = NewBool(true) } - if s.DEPRECATED_DO_NOT_USE_UseExperimentalGossip == nil { - s.DEPRECATED_DO_NOT_USE_UseExperimentalGossip = NewBool(true) - } - if s.EnableExperimentalGossipEncryption == nil { s.EnableExperimentalGossipEncryption = NewBool(false) } @@ -1930,39 +1865,27 @@ func (s *ThemeSettings) SetDefaults() { } type TeamSettings struct { - SiteName *string `access:"site_customization"` - MaxUsersPerTeam *int `access:"site_users_and_teams"` - DEPRECATED_DO_NOT_USE_EnableTeamCreation *bool `json:"EnableTeamCreation" mapstructure:"EnableTeamCreation"` // Deprecated: do not use - EnableUserCreation *bool `access:"authentication_signup"` - EnableOpenServer *bool `access:"authentication_signup"` - EnableUserDeactivation *bool `access:"experimental_features"` - RestrictCreationToDomains *string `access:"authentication_signup"` // telemetry: none - EnableCustomUserStatuses *bool `access:"site_users_and_teams"` - EnableCustomBrand *bool `access:"site_customization"` - CustomBrandText *string `access:"site_customization"` - CustomDescriptionText *string `access:"site_customization"` - RestrictDirectMessage *string `access:"site_users_and_teams"` - DEPRECATED_DO_NOT_USE_RestrictTeamInvite *string `json:"RestrictTeamInvite" mapstructure:"RestrictTeamInvite"` // Deprecated: do not use - DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement *string `json:"RestrictPublicChannelManagement" mapstructure:"RestrictPublicChannelManagement"` // Deprecated: do not use - DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement *string `json:"RestrictPrivateChannelManagement" mapstructure:"RestrictPrivateChannelManagement"` // Deprecated: do not use - DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation *string `json:"RestrictPublicChannelCreation" mapstructure:"RestrictPublicChannelCreation"` // Deprecated: do not use - DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation *string `json:"RestrictPrivateChannelCreation" mapstructure:"RestrictPrivateChannelCreation"` // Deprecated: do not use - DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion *string `json:"RestrictPublicChannelDeletion" mapstructure:"RestrictPublicChannelDeletion"` // Deprecated: do not use - DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion *string `json:"RestrictPrivateChannelDeletion" mapstructure:"RestrictPrivateChannelDeletion"` // Deprecated: do not use - DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManageMembers *string `json:"RestrictPrivateChannelManageMembers" mapstructure:"RestrictPrivateChannelManageMembers"` // Deprecated: do not use - EnableXToLeaveChannelsFromLHS *bool `access:"experimental_features"` - UserStatusAwayTimeout *int64 `access:"experimental_features"` - MaxChannelsPerTeam *int64 `access:"site_users_and_teams"` - MaxNotificationsPerChannel *int64 `access:"environment_push_notification_server"` - EnableConfirmNotificationsToChannel *bool `access:"site_notifications"` - TeammateNameDisplay *string `access:"site_users_and_teams"` - ExperimentalViewArchivedChannels *bool `access:"experimental_features,site_users_and_teams"` - ExperimentalEnableAutomaticReplies *bool `access:"experimental_features"` - ExperimentalHideTownSquareinLHS *bool `access:"experimental_features"` - ExperimentalTownSquareIsReadOnly *bool `access:"experimental_features"` - LockTeammateNameDisplay *bool `access:"site_users_and_teams"` - ExperimentalPrimaryTeam *string `access:"experimental_features"` - ExperimentalDefaultChannels []string `access:"experimental_features"` + SiteName *string `access:"site_customization"` + MaxUsersPerTeam *int `access:"site_users_and_teams"` + EnableUserCreation *bool `access:"authentication_signup"` + EnableOpenServer *bool `access:"authentication_signup"` + EnableUserDeactivation *bool `access:"experimental_features"` + RestrictCreationToDomains *string `access:"authentication_signup"` // telemetry: none + EnableCustomUserStatuses *bool `access:"site_users_and_teams"` + EnableCustomBrand *bool `access:"site_customization"` + CustomBrandText *string `access:"site_customization"` + CustomDescriptionText *string `access:"site_customization"` + RestrictDirectMessage *string `access:"site_users_and_teams"` + UserStatusAwayTimeout *int64 `access:"experimental_features"` + MaxChannelsPerTeam *int64 `access:"site_users_and_teams"` + MaxNotificationsPerChannel *int64 `access:"environment_push_notification_server"` + EnableConfirmNotificationsToChannel *bool `access:"site_notifications"` + TeammateNameDisplay *string `access:"site_users_and_teams"` + ExperimentalViewArchivedChannels *bool `access:"experimental_features,site_users_and_teams"` + ExperimentalEnableAutomaticReplies *bool `access:"experimental_features"` + LockTeammateNameDisplay *bool `access:"site_users_and_teams"` + ExperimentalPrimaryTeam *string `access:"experimental_features"` + ExperimentalDefaultChannels []string `access:"experimental_features"` } func (s *TeamSettings) SetDefaults() { @@ -1975,10 +1898,6 @@ func (s *TeamSettings) SetDefaults() { s.MaxUsersPerTeam = NewInt(TeamSettingsDefaultMaxUsersPerTeam) } - if s.DEPRECATED_DO_NOT_USE_EnableTeamCreation == nil { - s.DEPRECATED_DO_NOT_USE_EnableTeamCreation = NewBool(true) - } - if s.EnableUserCreation == nil { s.EnableUserCreation = NewBool(true) } @@ -2015,55 +1934,6 @@ func (s *TeamSettings) SetDefaults() { s.RestrictDirectMessage = NewString(DirectMessageAny) } - if s.DEPRECATED_DO_NOT_USE_RestrictTeamInvite == nil { - s.DEPRECATED_DO_NOT_USE_RestrictTeamInvite = NewString(PermissionsAll) - } - - if s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement == nil { - s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement = NewString(PermissionsAll) - } - - if s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement == nil { - s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement = NewString(PermissionsAll) - } - - if s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation == nil { - s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation = new(string) - // If this setting does not exist, assume migration from <3.6, so use management setting as default. - if *s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement == PermissionsChannelAdmin { - *s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation = PermissionsTeamAdmin - } else { - *s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation = *s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement - } - } - - if s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation == nil { - // If this setting does not exist, assume migration from <3.6, so use management setting as default. - if *s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement == PermissionsChannelAdmin { - s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation = NewString(PermissionsTeamAdmin) - } else { - s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation = NewString(*s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement) - } - } - - if s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion == nil { - // If this setting does not exist, assume migration from <3.6, so use management setting as default. - s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion = NewString(*s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement) - } - - if s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion == nil { - // If this setting does not exist, assume migration from <3.6, so use management setting as default. - s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion = NewString(*s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement) - } - - if s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManageMembers == nil { - s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManageMembers = NewString(PermissionsAll) - } - - if s.EnableXToLeaveChannelsFromLHS == nil { - s.EnableXToLeaveChannelsFromLHS = NewBool(false) - } - if s.UserStatusAwayTimeout == nil { s.UserStatusAwayTimeout = NewInt64(TeamSettingsDefaultUserStatusAwayTimeout) } @@ -2084,14 +1954,6 @@ func (s *TeamSettings) SetDefaults() { s.ExperimentalEnableAutomaticReplies = NewBool(false) } - if s.ExperimentalHideTownSquareinLHS == nil { - s.ExperimentalHideTownSquareinLHS = NewBool(false) - } - - if s.ExperimentalTownSquareIsReadOnly == nil { - s.ExperimentalTownSquareIsReadOnly = NewBool(false) - } - if s.ExperimentalPrimaryTeam == nil { s.ExperimentalPrimaryTeam = NewString("") } @@ -2100,10 +1962,6 @@ func (s *TeamSettings) SetDefaults() { s.ExperimentalDefaultChannels = []string{} } - if s.DEPRECATED_DO_NOT_USE_EnableTeamCreation == nil { - s.DEPRECATED_DO_NOT_USE_EnableTeamCreation = NewBool(true) - } - if s.EnableUserCreation == nil { s.EnableUserCreation = NewBool(true) } @@ -3001,37 +2859,21 @@ type ImageProxySettings struct { RemoteImageProxyOptions *string `access:"environment_image_proxy"` } -func (s *ImageProxySettings) SetDefaults(ss ServiceSettings) { +func (s *ImageProxySettings) SetDefaults() { if s.Enable == nil { - if ss.DEPRECATED_DO_NOT_USE_ImageProxyType == nil || *ss.DEPRECATED_DO_NOT_USE_ImageProxyType == "" { - s.Enable = NewBool(false) - } else { - s.Enable = NewBool(true) - } + s.Enable = NewBool(false) } if s.ImageProxyType == nil { - if ss.DEPRECATED_DO_NOT_USE_ImageProxyType == nil || *ss.DEPRECATED_DO_NOT_USE_ImageProxyType == "" { - s.ImageProxyType = NewString(ImageProxyTypeLocal) - } else { - s.ImageProxyType = ss.DEPRECATED_DO_NOT_USE_ImageProxyType - } + s.ImageProxyType = NewString(ImageProxyTypeLocal) } if s.RemoteImageProxyURL == nil { - if ss.DEPRECATED_DO_NOT_USE_ImageProxyURL == nil { - s.RemoteImageProxyURL = NewString("") - } else { - s.RemoteImageProxyURL = ss.DEPRECATED_DO_NOT_USE_ImageProxyURL - } + s.RemoteImageProxyURL = NewString("") } if s.RemoteImageProxyOptions == nil { - if ss.DEPRECATED_DO_NOT_USE_ImageProxyOptions == nil { - s.RemoteImageProxyOptions = NewString("") - } else { - s.RemoteImageProxyOptions = ss.DEPRECATED_DO_NOT_USE_ImageProxyOptions - } + s.RemoteImageProxyOptions = NewString("") } } @@ -3282,7 +3124,7 @@ func (o *Config) SetDefaults() { o.MessageExportSettings.SetDefaults() o.DisplaySettings.SetDefaults() o.GuestAccountsSettings.SetDefaults() - o.ImageProxySettings.SetDefaults(o.ServiceSettings) + o.ImageProxySettings.SetDefaults() o.CloudSettings.SetDefaults() if o.FeatureFlags == nil { o.FeatureFlags = &FeatureFlags{} diff --git a/model/config_test.go b/model/config_test.go index bf200c7557..aff185b5c8 100644 --- a/model/config_test.go +++ b/model/config_test.go @@ -814,49 +814,15 @@ func TestListenAddressIsValidated(t *testing.T) { } func TestImageProxySettingsSetDefaults(t *testing.T) { - ss := ServiceSettings{ - DEPRECATED_DO_NOT_USE_ImageProxyType: NewString(ImageProxyTypeAtmosCamo), - DEPRECATED_DO_NOT_USE_ImageProxyURL: NewString("http://images.example.com"), - DEPRECATED_DO_NOT_USE_ImageProxyOptions: NewString("1234abcd"), - } - - t.Run("default, no old settings", func(t *testing.T) { + t.Run("default settings", func(t *testing.T) { ips := ImageProxySettings{} - ips.SetDefaults(ServiceSettings{}) + ips.SetDefaults() assert.Equal(t, false, *ips.Enable) assert.Equal(t, ImageProxyTypeLocal, *ips.ImageProxyType) assert.Equal(t, "", *ips.RemoteImageProxyURL) assert.Equal(t, "", *ips.RemoteImageProxyOptions) }) - - t.Run("default, old settings", func(t *testing.T) { - ips := ImageProxySettings{} - ips.SetDefaults(ss) - - assert.Equal(t, true, *ips.Enable) - assert.Equal(t, *ss.DEPRECATED_DO_NOT_USE_ImageProxyType, *ips.ImageProxyType) - assert.Equal(t, *ss.DEPRECATED_DO_NOT_USE_ImageProxyURL, *ips.RemoteImageProxyURL) - assert.Equal(t, *ss.DEPRECATED_DO_NOT_USE_ImageProxyOptions, *ips.RemoteImageProxyOptions) - }) - - t.Run("not default, old settings", func(t *testing.T) { - url := "http://images.mattermost.com" - options := "aaaaaaaa" - - ips := ImageProxySettings{ - Enable: NewBool(false), - ImageProxyType: NewString(ImageProxyTypeLocal), - RemoteImageProxyURL: &url, - RemoteImageProxyOptions: &options, - } - ips.SetDefaults(ss) - - assert.Equal(t, false, *ips.Enable) - assert.Equal(t, ImageProxyTypeLocal, *ips.ImageProxyType) - assert.Equal(t, url, *ips.RemoteImageProxyURL) - assert.Equal(t, options, *ips.RemoteImageProxyOptions) - }) } func TestImageProxySettingsIsValid(t *testing.T) { diff --git a/model/role.go b/model/role.go index 55c22b910f..68697838f7 100644 --- a/model/role.go +++ b/model/role.go @@ -705,6 +705,13 @@ func MakeDefaultRoles() map[string]*Role { PermissionCreatePost.Id, PermissionUseChannelMentions.Id, PermissionUseSlashCommands.Id, + PermissionManagePublicChannelProperties.Id, + PermissionDeletePublicChannel.Id, + PermissionManagePrivateChannelProperties.Id, + PermissionDeletePrivateChannel.Id, + PermissionManagePrivateChannelMembers.Id, + PermissionDeletePost.Id, + PermissionEditPost.Id, }, SchemeManaged: true, BuiltIn: true, @@ -742,6 +749,10 @@ func MakeDefaultRoles() map[string]*Role { PermissionJoinPublicChannels.Id, PermissionReadPublicChannel.Id, PermissionViewTeam.Id, + PermissionCreatePublicChannel.Id, + PermissionCreatePrivateChannel.Id, + PermissionInviteUser.Id, + PermissionAddUserToTeam.Id, }, SchemeManaged: true, BuiltIn: true, @@ -789,6 +800,8 @@ func MakeDefaultRoles() map[string]*Role { PermissionManageOutgoingWebhooks.Id, PermissionConvertPublicChannelToPrivate.Id, PermissionConvertPrivateChannelToPublic.Id, + PermissionDeletePost.Id, + PermissionDeleteOthersPosts.Id, }, SchemeManaged: true, BuiltIn: true, @@ -816,6 +829,7 @@ func MakeDefaultRoles() map[string]*Role { PermissionCreateDirectChannel.Id, PermissionCreateGroupChannel.Id, PermissionViewMembers.Id, + PermissionCreateTeam.Id, }, SchemeManaged: true, BuiltIn: true, diff --git a/scripts/config_generator/main_test.go b/scripts/config_generator/main_test.go index be54cf5936..e0afc34d04 100644 --- a/scripts/config_generator/main_test.go +++ b/scripts/config_generator/main_test.go @@ -25,7 +25,6 @@ func TestDefaultsGenerator(t *testing.T) { b, err := ioutil.ReadFile(tmpFile.Name()) require.NoError(t, err) require.NoError(t, json.Unmarshal(b, &config)) - require.True(t, *config.ServiceSettings.DisableLegacyMFA) require.Equal(t, *config.SqlSettings.AtRestEncryptKey, "") require.Equal(t, *config.FileSettings.PublicLinkSalt, "") diff --git a/services/telemetry/telemetry.go b/services/telemetry/telemetry.go index 4f95fb84dd..cdfdfff3c6 100644 --- a/services/telemetry/telemetry.go +++ b/services/telemetry/telemetry.go @@ -366,7 +366,6 @@ func (ts *TelemetryService) trackConfig() { "enable_incoming_webhooks": cfg.ServiceSettings.EnableIncomingWebhooks, "enable_outgoing_webhooks": cfg.ServiceSettings.EnableOutgoingWebhooks, "enable_commands": *cfg.ServiceSettings.EnableCommands, - "enable_only_admin_integrations": *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_EnableOnlyAdminIntegrations, "enable_post_username_override": cfg.ServiceSettings.EnablePostUsernameOverride, "enable_post_icon_override": cfg.ServiceSettings.EnablePostIconOverride, "enable_user_access_tokens": *cfg.ServiceSettings.EnableUserAccessTokens, @@ -376,7 +375,6 @@ func (ts *TelemetryService) trackConfig() { "gfycat_api_key": isDefault(*cfg.ServiceSettings.GfycatAPIKey, model.ServiceSettingsDefaultGfycatAPIKey), "gfycat_api_secret": isDefault(*cfg.ServiceSettings.GfycatAPISecret, model.ServiceSettingsDefaultGfycatAPISecret), "experimental_enable_authentication_transfer": *cfg.ServiceSettings.ExperimentalEnableAuthenticationTransfer, - "restrict_custom_emoji_creation": *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation, "enable_testing": cfg.ServiceSettings.EnableTesting, "enable_developer": *cfg.ServiceSettings.EnableDeveloper, "enable_multifactor_authentication": *cfg.ServiceSettings.EnableMultifactorAuthentication, @@ -405,8 +403,6 @@ func (ts *TelemetryService) trackConfig() { "cors_allow_credentials": *cfg.ServiceSettings.CorsAllowCredentials, "cors_debug": *cfg.ServiceSettings.CorsDebug, "isdefault_allowed_untrusted_internal_connections": isDefault(*cfg.ServiceSettings.AllowedUntrustedInternalConnections, ""), - "restrict_post_delete": *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictPostDelete, - "allow_edit_post": *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost, "post_edit_time_limit": *cfg.ServiceSettings.PostEditTimeLimit, "enable_user_typing_messages": *cfg.ServiceSettings.EnableUserTypingMessages, "enable_channel_viewed_messages": *cfg.ServiceSettings.EnableChannelViewedMessages, @@ -415,7 +411,6 @@ func (ts *TelemetryService) trackConfig() { "enable_post_search": *cfg.ServiceSettings.EnablePostSearch, "minimum_hashtag_length": *cfg.ServiceSettings.MinimumHashtagLength, "enable_user_statuses": *cfg.ServiceSettings.EnableUserStatuses, - "close_unused_direct_messages": *cfg.ServiceSettings.CloseUnusedDirectMessages, "enable_preview_features": *cfg.ServiceSettings.EnablePreviewFeatures, "enable_tutorial": *cfg.ServiceSettings.EnableTutorial, "enable_onboarding_flow": *cfg.ServiceSettings.EnableOnboardingFlow, @@ -428,10 +423,8 @@ func (ts *TelemetryService) trackConfig() { "enable_api_user_deletion": *cfg.ServiceSettings.EnableAPIUserDeletion, "enable_api_channel_deletion": *cfg.ServiceSettings.EnableAPIChannelDeletion, "experimental_enable_hardened_mode": *cfg.ServiceSettings.ExperimentalEnableHardenedMode, - "disable_legacy_mfa": *cfg.ServiceSettings.DisableLegacyMFA, "experimental_strict_csrf_enforcement": *cfg.ServiceSettings.ExperimentalStrictCSRFEnforcement, "enable_email_invitations": *cfg.ServiceSettings.EnableEmailInvitations, - "experimental_channel_organization": *cfg.ServiceSettings.ExperimentalChannelOrganization, "disable_bots_when_owner_is_deactivated": *cfg.ServiceSettings.DisableBotsWhenOwnerIsDeactivated, "enable_bot_account_creation": *cfg.ServiceSettings.EnableBotAccountCreation, "enable_svgs": *cfg.ServiceSettings.EnableSVGs, @@ -440,7 +433,6 @@ func (ts *TelemetryService) trackConfig() { "enable_opentracing": *cfg.ServiceSettings.EnableOpenTracing, "enable_local_mode": *cfg.ServiceSettings.EnableLocalMode, "managed_resource_paths": isDefault(*cfg.ServiceSettings.ManagedResourcePaths, ""), - "enable_legacy_sidebar": *cfg.ServiceSettings.EnableLegacySidebar, "thread_auto_follow": *cfg.ServiceSettings.ThreadAutoFollow, "enable_link_previews": *cfg.ServiceSettings.EnableLinkPreviews, "enable_permalink_previews": *cfg.ServiceSettings.EnablePermalinkPreviews, @@ -449,38 +441,26 @@ func (ts *TelemetryService) trackConfig() { }) ts.sendTelemetry(TrackConfigTeam, map[string]interface{}{ - "enable_user_creation": cfg.TeamSettings.EnableUserCreation, - "enable_team_creation": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_EnableTeamCreation, - "restrict_team_invite": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictTeamInvite, - "restrict_public_channel_creation": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation, - "restrict_private_channel_creation": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation, - "restrict_public_channel_management": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement, - "restrict_private_channel_management": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement, - "restrict_public_channel_deletion": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion, - "restrict_private_channel_deletion": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion, - "enable_open_server": *cfg.TeamSettings.EnableOpenServer, - "enable_user_deactivation": *cfg.TeamSettings.EnableUserDeactivation, - "enable_custom_user_statuses": *cfg.TeamSettings.EnableCustomUserStatuses, - "enable_custom_brand": *cfg.TeamSettings.EnableCustomBrand, - "restrict_direct_message": *cfg.TeamSettings.RestrictDirectMessage, - "max_notifications_per_channel": *cfg.TeamSettings.MaxNotificationsPerChannel, - "enable_confirm_notifications_to_channel": *cfg.TeamSettings.EnableConfirmNotificationsToChannel, - "max_users_per_team": *cfg.TeamSettings.MaxUsersPerTeam, - "max_channels_per_team": *cfg.TeamSettings.MaxChannelsPerTeam, - "teammate_name_display": *cfg.TeamSettings.TeammateNameDisplay, - "experimental_view_archived_channels": *cfg.TeamSettings.ExperimentalViewArchivedChannels, - "lock_teammate_name_display": *cfg.TeamSettings.LockTeammateNameDisplay, - "isdefault_site_name": isDefault(cfg.TeamSettings.SiteName, "Mattermost"), - "isdefault_custom_brand_text": isDefault(*cfg.TeamSettings.CustomBrandText, model.TeamSettingsDefaultCustomBrandText), - "isdefault_custom_description_text": isDefault(*cfg.TeamSettings.CustomDescriptionText, model.TeamSettingsDefaultCustomDescriptionText), - "isdefault_user_status_away_timeout": isDefault(*cfg.TeamSettings.UserStatusAwayTimeout, model.TeamSettingsDefaultUserStatusAwayTimeout), - "restrict_private_channel_manage_members": *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManageMembers, - "enable_X_to_leave_channels_from_LHS": *cfg.TeamSettings.EnableXToLeaveChannelsFromLHS, - "experimental_enable_automatic_replies": *cfg.TeamSettings.ExperimentalEnableAutomaticReplies, - "experimental_town_square_is_hidden_in_lhs": *cfg.TeamSettings.ExperimentalHideTownSquareinLHS, - "experimental_town_square_is_read_only": *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly, - "experimental_primary_team": isDefault(*cfg.TeamSettings.ExperimentalPrimaryTeam, ""), - "experimental_default_channels": len(cfg.TeamSettings.ExperimentalDefaultChannels), + "enable_user_creation": cfg.TeamSettings.EnableUserCreation, + "enable_open_server": *cfg.TeamSettings.EnableOpenServer, + "enable_user_deactivation": *cfg.TeamSettings.EnableUserDeactivation, + "enable_custom_user_statuses": *cfg.TeamSettings.EnableCustomUserStatuses, + "enable_custom_brand": *cfg.TeamSettings.EnableCustomBrand, + "restrict_direct_message": *cfg.TeamSettings.RestrictDirectMessage, + "max_notifications_per_channel": *cfg.TeamSettings.MaxNotificationsPerChannel, + "enable_confirm_notifications_to_channel": *cfg.TeamSettings.EnableConfirmNotificationsToChannel, + "max_users_per_team": *cfg.TeamSettings.MaxUsersPerTeam, + "max_channels_per_team": *cfg.TeamSettings.MaxChannelsPerTeam, + "teammate_name_display": *cfg.TeamSettings.TeammateNameDisplay, + "experimental_view_archived_channels": *cfg.TeamSettings.ExperimentalViewArchivedChannels, + "lock_teammate_name_display": *cfg.TeamSettings.LockTeammateNameDisplay, + "isdefault_site_name": isDefault(cfg.TeamSettings.SiteName, "Mattermost"), + "isdefault_custom_brand_text": isDefault(*cfg.TeamSettings.CustomBrandText, model.TeamSettingsDefaultCustomBrandText), + "isdefault_custom_description_text": isDefault(*cfg.TeamSettings.CustomDescriptionText, model.TeamSettingsDefaultCustomDescriptionText), + "isdefault_user_status_away_timeout": isDefault(*cfg.TeamSettings.UserStatusAwayTimeout, model.TeamSettingsDefaultUserStatusAwayTimeout), + "experimental_enable_automatic_replies": *cfg.TeamSettings.ExperimentalEnableAutomaticReplies, + "experimental_primary_team": isDefault(*cfg.TeamSettings.ExperimentalPrimaryTeam, ""), + "experimental_default_channels": len(cfg.TeamSettings.ExperimentalDefaultChannels), }) ts.sendTelemetry(TrackConfigClientReq, map[string]interface{}{ diff --git a/tests/test-config.json b/tests/test-config.json index 42161e36ef..0d7d9e07b1 100644 --- a/tests/test-config.json +++ b/tests/test-config.json @@ -19,7 +19,6 @@ "EnableIncomingWebhooks": true, "EnableOutgoingWebhooks": true, "EnableCommands": true, - "EnableOnlyAdminIntegrations": true, "EnablePostUsernameOverride": false, "EnablePostIconOverride": false, "EnableLinkPreviews": false, @@ -45,9 +44,6 @@ "WebserverMode": "gzip", "EnableCustomEmoji": false, "EnableEmojiPicker": true, - "RestrictCustomEmojiCreation": "all", - "RestrictPostDelete": "all", - "AllowEditPost": "always", "PostEditTimeLimit": -1, "TimeBetweenUserTypingUpdatesMilliseconds": 5000, "EnablePostSearch": true, @@ -57,22 +53,17 @@ "EnableUserStatuses": true, "ExperimentalEnableAuthenticationTransfer": true, "ClusterLogTimeoutMilliseconds": 2000, - "CloseUnusedDirectMessages": false, "EnablePreviewFeatures": true, "EnableTutorial": true, "EnableOnboardingFlow": true, "ExperimentalEnableDefaultChannelLeaveJoinMessages": true, "ExperimentalGroupUnreadChannels": "disabled", - "ImageProxyType": "", - "ImageProxyURL": "", - "ImageProxyOptions": "", "EnableAPITeamDeletion": false, - "ExperimentalEnableHardenedMode": false, + "ExperimentalEnableHardenedMode": false }, "TeamSettings": { "SiteName": "Mattermost", "MaxUsersPerTeam": 50, - "EnableTeamCreation": true, "EnableUserCreation": true, "EnableOpenServer": false, "EnableUserDeactivation": false, @@ -81,23 +72,12 @@ "CustomBrandText": "", "CustomDescriptionText": "", "RestrictDirectMessage": "any", - "RestrictTeamInvite": "all", - "RestrictPublicChannelManagement": "all", - "RestrictPrivateChannelManagement": "all", - "RestrictPublicChannelCreation": "all", - "RestrictPrivateChannelCreation": "all", - "RestrictPublicChannelDeletion": "all", - "RestrictPrivateChannelDeletion": "all", - "RestrictPrivateChannelManageMembers": "all", - "EnableXToLeaveChannelsFromLHS": false, "UserStatusAwayTimeout": 300, "MaxChannelsPerTeam": 2000, "MaxNotificationsPerChannel": 1000, "EnableConfirmNotificationsToChannel": true, "TeammateNameDisplay": "username", "ExperimentalEnableAutomaticReplies": false, - "ExperimentalHideTownSquareinLHS": false, - "ExperimentalTownSquareIsReadOnly": false, "ExperimentalPrimaryTeam": "" }, "ClientRequirements": { diff --git a/utils/authorization.go b/utils/authorization.go deleted file mode 100644 index a0b6727e5e..0000000000 --- a/utils/authorization.go +++ /dev/null @@ -1,295 +0,0 @@ -// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved. -// See LICENSE.txt for license information. - -package utils - -import ( - "github.com/mattermost/mattermost-server/v6/model" -) - -func SetRolePermissionsFromConfig(roles map[string]*model.Role, cfg *model.Config, isLicensed bool) map[string]*model.Role { - if isLicensed { - switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation { - case model.PermissionsAll: - roles[model.TeamUserRoleId].Permissions = append( - roles[model.TeamUserRoleId].Permissions, - model.PermissionCreatePublicChannel.Id, - ) - case model.PermissionsTeamAdmin: - roles[model.TeamAdminRoleId].Permissions = append( - roles[model.TeamAdminRoleId].Permissions, - model.PermissionCreatePublicChannel.Id, - ) - } - } else { - roles[model.TeamUserRoleId].Permissions = append( - roles[model.TeamUserRoleId].Permissions, - model.PermissionCreatePublicChannel.Id, - ) - } - - if isLicensed { - switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement { - case model.PermissionsAll: - roles[model.ChannelUserRoleId].Permissions = append( - roles[model.ChannelUserRoleId].Permissions, - model.PermissionManagePublicChannelProperties.Id, - ) - case model.PermissionsChannelAdmin: - roles[model.TeamAdminRoleId].Permissions = append( - roles[model.TeamAdminRoleId].Permissions, - model.PermissionManagePublicChannelProperties.Id, - ) - roles[model.ChannelAdminRoleId].Permissions = append( - roles[model.ChannelAdminRoleId].Permissions, - model.PermissionManagePublicChannelProperties.Id, - ) - case model.PermissionsTeamAdmin: - roles[model.TeamAdminRoleId].Permissions = append( - roles[model.TeamAdminRoleId].Permissions, - model.PermissionManagePublicChannelProperties.Id, - ) - } - } else { - roles[model.ChannelUserRoleId].Permissions = append( - roles[model.ChannelUserRoleId].Permissions, - model.PermissionManagePublicChannelProperties.Id, - ) - } - - if isLicensed { - switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion { - case model.PermissionsAll: - roles[model.ChannelUserRoleId].Permissions = append( - roles[model.ChannelUserRoleId].Permissions, - model.PermissionDeletePublicChannel.Id, - ) - case model.PermissionsChannelAdmin: - roles[model.TeamAdminRoleId].Permissions = append( - roles[model.TeamAdminRoleId].Permissions, - model.PermissionDeletePublicChannel.Id, - ) - roles[model.ChannelAdminRoleId].Permissions = append( - roles[model.ChannelAdminRoleId].Permissions, - model.PermissionDeletePublicChannel.Id, - ) - case model.PermissionsTeamAdmin: - roles[model.TeamAdminRoleId].Permissions = append( - roles[model.TeamAdminRoleId].Permissions, - model.PermissionDeletePublicChannel.Id, - ) - } - } else { - roles[model.ChannelUserRoleId].Permissions = append( - roles[model.ChannelUserRoleId].Permissions, - model.PermissionDeletePublicChannel.Id, - ) - } - - if isLicensed { - switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation { - case model.PermissionsAll: - roles[model.TeamUserRoleId].Permissions = append( - roles[model.TeamUserRoleId].Permissions, - model.PermissionCreatePrivateChannel.Id, - ) - case model.PermissionsTeamAdmin: - roles[model.TeamAdminRoleId].Permissions = append( - roles[model.TeamAdminRoleId].Permissions, - model.PermissionCreatePrivateChannel.Id, - ) - } - } else { - roles[model.TeamUserRoleId].Permissions = append( - roles[model.TeamUserRoleId].Permissions, - model.PermissionCreatePrivateChannel.Id, - ) - } - - if isLicensed { - switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement { - case model.PermissionsAll: - roles[model.ChannelUserRoleId].Permissions = append( - roles[model.ChannelUserRoleId].Permissions, - model.PermissionManagePrivateChannelProperties.Id, - ) - case model.PermissionsChannelAdmin: - roles[model.TeamAdminRoleId].Permissions = append( - roles[model.TeamAdminRoleId].Permissions, - model.PermissionManagePrivateChannelProperties.Id, - ) - roles[model.ChannelAdminRoleId].Permissions = append( - roles[model.ChannelAdminRoleId].Permissions, - model.PermissionManagePrivateChannelProperties.Id, - ) - case model.PermissionsTeamAdmin: - roles[model.TeamAdminRoleId].Permissions = append( - roles[model.TeamAdminRoleId].Permissions, - model.PermissionManagePrivateChannelProperties.Id, - ) - } - } else { - roles[model.ChannelUserRoleId].Permissions = append( - roles[model.ChannelUserRoleId].Permissions, - model.PermissionManagePrivateChannelProperties.Id, - ) - } - - if isLicensed { - switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion { - case model.PermissionsAll: - roles[model.ChannelUserRoleId].Permissions = append( - roles[model.ChannelUserRoleId].Permissions, - model.PermissionDeletePrivateChannel.Id, - ) - case model.PermissionsChannelAdmin: - roles[model.TeamAdminRoleId].Permissions = append( - roles[model.TeamAdminRoleId].Permissions, - model.PermissionDeletePrivateChannel.Id, - ) - roles[model.ChannelAdminRoleId].Permissions = append( - roles[model.ChannelAdminRoleId].Permissions, - model.PermissionDeletePrivateChannel.Id, - ) - case model.PermissionsTeamAdmin: - roles[model.TeamAdminRoleId].Permissions = append( - roles[model.TeamAdminRoleId].Permissions, - model.PermissionDeletePrivateChannel.Id, - ) - } - } else { - roles[model.ChannelUserRoleId].Permissions = append( - roles[model.ChannelUserRoleId].Permissions, - model.PermissionDeletePrivateChannel.Id, - ) - } - - // Restrict permissions for Private Channel Manage Members - if isLicensed { - switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManageMembers { - case model.PermissionsAll: - roles[model.ChannelUserRoleId].Permissions = append( - roles[model.ChannelUserRoleId].Permissions, - model.PermissionManagePrivateChannelMembers.Id, - ) - case model.PermissionsChannelAdmin: - roles[model.TeamAdminRoleId].Permissions = append( - roles[model.TeamAdminRoleId].Permissions, - model.PermissionManagePrivateChannelMembers.Id, - ) - roles[model.ChannelAdminRoleId].Permissions = append( - roles[model.ChannelAdminRoleId].Permissions, - model.PermissionManagePrivateChannelMembers.Id, - ) - case model.PermissionsTeamAdmin: - roles[model.TeamAdminRoleId].Permissions = append( - roles[model.TeamAdminRoleId].Permissions, - model.PermissionManagePrivateChannelMembers.Id, - ) - } - } else { - roles[model.ChannelUserRoleId].Permissions = append( - roles[model.ChannelUserRoleId].Permissions, - model.PermissionManagePrivateChannelMembers.Id, - ) - } - - if !*cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_EnableOnlyAdminIntegrations { - roles[model.TeamUserRoleId].Permissions = append( - roles[model.TeamUserRoleId].Permissions, - model.PermissionManageIncomingWebhooks.Id, - model.PermissionManageOutgoingWebhooks.Id, - model.PermissionManageSlashCommands.Id, - ) - roles[model.SystemUserRoleId].Permissions = append( - roles[model.SystemUserRoleId].Permissions, - model.PermissionManageOAuth.Id, - ) - } - - // Grant permissions for inviting and adding users to a team. - if isLicensed { - if *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictTeamInvite == model.PermissionsTeamAdmin { - roles[model.TeamAdminRoleId].Permissions = append( - roles[model.TeamAdminRoleId].Permissions, - model.PermissionInviteUser.Id, - model.PermissionAddUserToTeam.Id, - ) - } else if *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictTeamInvite == model.PermissionsAll { - roles[model.TeamUserRoleId].Permissions = append( - roles[model.TeamUserRoleId].Permissions, - model.PermissionInviteUser.Id, - model.PermissionAddUserToTeam.Id, - ) - } - } else { - roles[model.TeamUserRoleId].Permissions = append( - roles[model.TeamUserRoleId].Permissions, - model.PermissionInviteUser.Id, - model.PermissionAddUserToTeam.Id, - ) - } - - if isLicensed { - switch *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictPostDelete { - case model.PermissionsDeletePostAll: - roles[model.ChannelUserRoleId].Permissions = append( - roles[model.ChannelUserRoleId].Permissions, - model.PermissionDeletePost.Id, - ) - roles[model.TeamAdminRoleId].Permissions = append( - roles[model.TeamAdminRoleId].Permissions, - model.PermissionDeletePost.Id, - model.PermissionDeleteOthersPosts.Id, - ) - case model.PermissionsDeletePostTeamAdmin: - roles[model.TeamAdminRoleId].Permissions = append( - roles[model.TeamAdminRoleId].Permissions, - model.PermissionDeletePost.Id, - model.PermissionDeleteOthersPosts.Id, - ) - } - } else { - roles[model.ChannelUserRoleId].Permissions = append( - roles[model.ChannelUserRoleId].Permissions, - model.PermissionDeletePost.Id, - ) - roles[model.TeamAdminRoleId].Permissions = append( - roles[model.TeamAdminRoleId].Permissions, - model.PermissionDeletePost.Id, - model.PermissionDeleteOthersPosts.Id, - ) - } - - if *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_EnableTeamCreation { - roles[model.SystemUserRoleId].Permissions = append( - roles[model.SystemUserRoleId].Permissions, - model.PermissionCreateTeam.Id, - ) - } - - if isLicensed { - switch *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost { - case model.AllowEditPostAlways, model.AllowEditPostTimeLimit: - roles[model.ChannelUserRoleId].Permissions = append( - roles[model.ChannelUserRoleId].Permissions, - model.PermissionEditPost.Id, - ) - roles[model.SystemAdminRoleId].Permissions = append( - roles[model.SystemAdminRoleId].Permissions, - model.PermissionEditPost.Id, - ) - } - } else { - roles[model.ChannelUserRoleId].Permissions = append( - roles[model.ChannelUserRoleId].Permissions, - model.PermissionEditPost.Id, - ) - roles[model.SystemAdminRoleId].Permissions = append( - roles[model.SystemAdminRoleId].Permissions, - model.PermissionEditPost.Id, - ) - } - - return roles -} diff --git a/utils/authorization_test.go b/utils/authorization_test.go deleted file mode 100644 index f7a4abe622..0000000000 --- a/utils/authorization_test.go +++ /dev/null @@ -1,133 +0,0 @@ -// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved. -// See LICENSE.txt for license information. - -package utils - -import ( - "encoding/json" - "fmt" - "io/ioutil" - "reflect" - "strconv" - "strings" - "testing" - - "github.com/stretchr/testify/require" - - "github.com/mattermost/mattermost-server/v6/model" -) - -type RoleState struct { - RoleName string `json:"roleName"` - Permission string `json:"permission"` - ShouldHave bool `json:"shouldHave"` -} - -func mockConfig() *model.Config { - config := model.Config{} - config.SetDefaults() - return &config -} - -func mapping() (map[string]map[string][]RoleState, error) { - - policiesRolesMapping := make(map[string]map[string][]RoleState) - - raw, err := ioutil.ReadFile("./policies-roles-mapping.json") - if err != nil { - return policiesRolesMapping, err - } - - var f map[string]interface{} - err = json.Unmarshal(raw, &f) - if err != nil { - return policiesRolesMapping, err - } - - for policyName, value := range f { - - capitalizedName := fmt.Sprintf("%v%v", strings.ToUpper(policyName[:1]), policyName[1:]) - policiesRolesMapping[capitalizedName] = make(map[string][]RoleState) - - for policyValue, roleStatesMappings := range value.(map[string]interface{}) { - - var roleStates []RoleState - for _, roleStateMapping := range roleStatesMappings.([]interface{}) { - - roleStateMappingJSON, _ := json.Marshal(roleStateMapping) - var roleState RoleState - _ = json.Unmarshal(roleStateMappingJSON, &roleState) - - roleStates = append(roleStates, roleState) - - } - - policiesRolesMapping[capitalizedName][policyValue] = roleStates - - } - - } - - return policiesRolesMapping, nil -} - -func TestSetRolePermissionsFromConfig(t *testing.T) { - - mapping, err := mapping() - if err != nil { - require.NoError(t, err) - } - - for policyName, v := range mapping { - for policyValue, rolesMappings := range v { - - config := mockConfig() - updateConfig(config, "DEPRECATED_DO_NOT_USE_"+policyName, policyValue) - roles := model.MakeDefaultRoles() - SetRolePermissionsFromConfig(roles, config, true) - - for _, roleMappingItem := range rolesMappings { - role := roles[roleMappingItem.RoleName] - - permission := roleMappingItem.Permission - hasPermission := roleHasPermission(role, permission) - - if (roleMappingItem.ShouldHave && !hasPermission) || (!roleMappingItem.ShouldHave && hasPermission) { - wording := "not to" - if roleMappingItem.ShouldHave { - wording = "to" - } - t.Errorf("Expected '%v' %v have '%v' permission when '%v' is set to '%v'.", role.Name, wording, permission, policyName, policyValue) - } - - } - - } - } -} - -func updateConfig(config *model.Config, key string, value string) { - v := reflect.ValueOf(config.ServiceSettings) - field := v.FieldByName(key) - if !field.IsValid() { - v = reflect.ValueOf(config.TeamSettings) - field = v.FieldByName(key) - } - - switch value { - case "true", "false": - b, _ := strconv.ParseBool(value) - field.Elem().SetBool(b) - default: - field.Elem().SetString(value) - } -} - -func roleHasPermission(role *model.Role, permission string) bool { - for _, p := range role.Permissions { - if p == permission { - return true - } - } - return false -} diff --git a/web/webhook_test.go b/web/webhook_test.go index ebda0c7104..e0cd792c1e 100644 --- a/web/webhook_test.go +++ b/web/webhook_test.go @@ -129,32 +129,6 @@ func TestIncomingWebhook(t *testing.T) { assert.Equal(t, http.StatusOK, resp.StatusCode) }) - t.Run("WebhookExperimentalReadOnly", func(t *testing.T) { - th.App.Srv().SetLicense(model.NewTestLicense()) - th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = true }) - - // Read only default channel should fail. - resp, err := http.Post(url, "application/json", strings.NewReader(fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", model.DefaultChannelName))) - require.NoError(t, err) - assert.True(t, resp.StatusCode != http.StatusOK) - - // None-default channel should still work. - resp, err = http.Post(url, "application/json", strings.NewReader(fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", th.BasicChannel.Name))) - require.NoError(t, err) - assert.True(t, resp.StatusCode == http.StatusOK) - - // System-Admin Owned Hook - adminHook, appErr := th.App.CreateIncomingWebhookForChannel(th.SystemAdminUser.Id, th.BasicChannel, &model.IncomingWebhook{ChannelId: th.BasicChannel.Id}) - require.Nil(t, appErr) - adminURL := apiClient.URL + "/hooks/" + adminHook.Id - - resp, err = http.Post(adminURL, "application/json", strings.NewReader(fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", model.DefaultChannelName))) - require.NoError(t, err) - assert.Equal(t, http.StatusOK, resp.StatusCode) - - th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = false }) - }) - t.Run("WebhookAttachments", func(t *testing.T) { attachmentPayload := `{ "text": "this is a test",