MM-58577 Check remote ownership for posts and reactions (#27317)

* - ensure that posts and reactions can only be added via sync when coming from a remote that the target channel is shared with.
- ensure that posts and reactions are only modified/deleted by the remote that owns them.

* check that reaction belongs to post that belongs to channel that is shared with remote;  check that posts belong to channel shared with remote

* check for correct error type in unit test

* tweak unit test
Этот коммит содержится в:
Doug Lauder
2024-06-11 11:51:00 -04:00
коммит произвёл GitHub
родитель 6f8de3449a
Коммит 594ba6e665
10 изменённых файлов: 276 добавлений и 26 удалений

Просмотреть файл

@@ -8741,6 +8741,27 @@ func (s *RetryLayerReactionStore) GetForPostSince(postId string, since int64, ex
}
func (s *RetryLayerReactionStore) GetSingle(userID string, postID string, remoteID string, emojiName string) (*model.Reaction, error) {
tries := 0
for {
result, err := s.ReactionStore.GetSingle(userID, postID, remoteID, emojiName)
if err == nil {
return result, nil
}
if !isRepeatableError(err) {
return result, err
}
tries++
if tries >= 3 {
err = errors.Wrap(err, "giving up after 3 consecutive repeatable transaction failures")
return result, err
}
timepkg.Sleep(100 * timepkg.Millisecond)
}
}
func (s *RetryLayerReactionStore) GetUniqueCountForPost(postId string) (int, error) {
tries := 0