Fix issue where users may not follow links to private messages they belong to (#26001)

* Fix issue where users may not follow links to private messages they belong to

* Update tests
Этот коммит содержится в:
Daniel Espino García
2024-01-24 16:10:01 +01:00
коммит произвёл GitHub
родитель a7192dba8c
Коммит 409329c3d6
2 изменённых файлов: 20 добавлений и 7 удалений

Просмотреть файл

@@ -3992,6 +3992,12 @@ func TestPostReminder(t *testing.T) {
func TestPostGetInfo(t *testing.T) {
th := Setup(t).InitBasic()
defer th.TearDown()
defer th.RestoreDefaultRolePermissions(th.SaveDefaultRolePermissions())
th.RemovePermissionFromRole(model.PermissionManagePrivateChannelMembers.Id, model.SystemUserRoleId)
th.RemovePermissionFromRole(model.PermissionManagePrivateChannelMembers.Id, model.ChannelUserRoleId)
th.RemovePermissionFromRole(model.PermissionManagePrivateChannelMembers.Id, model.TeamUserRoleId)
client := th.Client
sysadminClient := th.SystemAdminClient
sysadminClient.AddTeamMember(context.Background(), th.BasicTeam.Id, th.SystemAdminUser.Id)

Просмотреть файл

@@ -2296,20 +2296,27 @@ func (a *App) GetPostInfo(c request.CTX, postID string) (*model.PostInfo, *model
}
hasPermissionToAccessChannel := false
if channel.Type == model.ChannelTypeOpen {
_, channelMemberErr := a.GetChannelMember(c, channel.Id, userID)
if channelMemberErr == nil {
hasPermissionToAccessChannel = true
} else if channel.Type == model.ChannelTypePrivate {
hasPermissionToAccessChannel = a.HasPermissionToChannel(c, userID, channel.Id, model.PermissionManagePrivateChannelMembers)
} else if channel.Type == model.ChannelTypeDirect || channel.Type == model.ChannelTypeGroup {
hasPermissionToAccessChannel = a.HasPermissionToChannel(c, userID, channel.Id, model.PermissionReadChannelContent)
}
if !hasPermissionToAccessChannel {
if channel.Type == model.ChannelTypeOpen {
hasPermissionToAccessChannel = true
} else if channel.Type == model.ChannelTypePrivate {
hasPermissionToAccessChannel = a.HasPermissionToChannel(c, userID, channel.Id, model.PermissionManagePrivateChannelMembers)
} else if channel.Type == model.ChannelTypeDirect || channel.Type == model.ChannelTypeGroup {
hasPermissionToAccessChannel = a.HasPermissionToChannel(c, userID, channel.Id, model.PermissionReadChannelContent)
}
}
if !hasPermissionToAccessChannel {
return nil, notFoundError
}
_, channelMemberErr := a.GetChannelMember(c, channel.Id, userID)
info := model.PostInfo{
ChannelId: channel.Id,
ChannelType: channel.Type,