MM-9999 Fix unwanted team invite_id in email invites. (#8550)
* Fix unwanted team invite_id in email invites. * Removing unused translation.
Этот коммит содержится в:
коммит произвёл
GitHub
родитель
6fcdf4abc6
Коммит
59606791a7
@@ -1367,7 +1367,6 @@ func TestAddTeamMember(t *testing.T) {
|
|||||||
dataObject := make(map[string]string)
|
dataObject := make(map[string]string)
|
||||||
dataObject["time"] = fmt.Sprintf("%v", model.GetMillis())
|
dataObject["time"] = fmt.Sprintf("%v", model.GetMillis())
|
||||||
dataObject["id"] = team.Id
|
dataObject["id"] = team.Id
|
||||||
dataObject["invite_id"] = team.InviteId
|
|
||||||
|
|
||||||
data := model.MapToJson(dataObject)
|
data := model.MapToJson(dataObject)
|
||||||
hashed := utils.HashSha256(fmt.Sprintf("%v:%v", data, th.App.Config().EmailSettings.InviteSalt))
|
hashed := utils.HashSha256(fmt.Sprintf("%v:%v", data, th.App.Config().EmailSettings.InviteSalt))
|
||||||
|
|||||||
@@ -276,7 +276,6 @@ func (a *App) SendInviteEmails(team *model.Team, senderName string, invites []st
|
|||||||
props["display_name"] = team.DisplayName
|
props["display_name"] = team.DisplayName
|
||||||
props["name"] = team.Name
|
props["name"] = team.Name
|
||||||
props["time"] = fmt.Sprintf("%v", model.GetMillis())
|
props["time"] = fmt.Sprintf("%v", model.GetMillis())
|
||||||
props["invite_id"] = team.InviteId
|
|
||||||
data := model.MapToJson(props)
|
data := model.MapToJson(props)
|
||||||
hash := utils.HashSha256(fmt.Sprintf("%v:%v", data, a.Config().EmailSettings.InviteSalt))
|
hash := utils.HashSha256(fmt.Sprintf("%v:%v", data, a.Config().EmailSettings.InviteSalt))
|
||||||
bodyPage.Props["Link"] = fmt.Sprintf("%s/signup_user_complete/?d=%s&h=%s", siteURL, url.QueryEscape(data), url.QueryEscape(hash))
|
bodyPage.Props["Link"] = fmt.Sprintf("%s/signup_user_complete/?d=%s&h=%s", siteURL, url.QueryEscape(data), url.QueryEscape(hash))
|
||||||
|
|||||||
@@ -238,11 +238,6 @@ func (a *App) AddUserToTeamByHash(userId string, hash string, data string) (*mod
|
|||||||
team = result.Data.(*model.Team)
|
team = result.Data.(*model.Team)
|
||||||
}
|
}
|
||||||
|
|
||||||
// verify that the team's invite id hasn't been changed since the invite was sent
|
|
||||||
if team.InviteId != props["invite_id"] {
|
|
||||||
return nil, model.NewAppError("JoinUserToTeamByHash", "api.user.create_user.signup_link_mismatched_invite_id.app_error", nil, "", http.StatusBadRequest)
|
|
||||||
}
|
|
||||||
|
|
||||||
var user *model.User
|
var user *model.User
|
||||||
if result := <-uchan; result.Err != nil {
|
if result := <-uchan; result.Err != nil {
|
||||||
return nil, result.Err
|
return nil, result.Err
|
||||||
|
|||||||
@@ -7,15 +7,7 @@ import (
|
|||||||
"strings"
|
"strings"
|
||||||
"testing"
|
"testing"
|
||||||
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
"sync/atomic"
|
|
||||||
|
|
||||||
"github.com/mattermost/mattermost-server/model"
|
"github.com/mattermost/mattermost-server/model"
|
||||||
"github.com/mattermost/mattermost-server/store"
|
|
||||||
"github.com/mattermost/mattermost-server/store/storetest"
|
|
||||||
"github.com/mattermost/mattermost-server/utils"
|
|
||||||
"github.com/stretchr/testify/assert"
|
|
||||||
)
|
)
|
||||||
|
|
||||||
func TestCreateTeam(t *testing.T) {
|
func TestCreateTeam(t *testing.T) {
|
||||||
@@ -402,65 +394,6 @@ func TestSanitizeTeams(t *testing.T) {
|
|||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
func TestAddUserToTeamByHashMismatchedInviteId(t *testing.T) {
|
|
||||||
mockStore := &storetest.Store{}
|
|
||||||
defer mockStore.AssertExpectations(t)
|
|
||||||
|
|
||||||
teamId := model.NewId()
|
|
||||||
userId := model.NewId()
|
|
||||||
inviteSalt := model.NewId()
|
|
||||||
|
|
||||||
inviteId := model.NewId()
|
|
||||||
teamInviteId := model.NewId()
|
|
||||||
|
|
||||||
// generate a fake email invite - stolen from SendInviteEmails() in email.go
|
|
||||||
props := make(map[string]string)
|
|
||||||
props["email"] = model.NewId() + "@mattermost.com"
|
|
||||||
props["id"] = teamId
|
|
||||||
props["display_name"] = model.NewId()
|
|
||||||
props["name"] = model.NewId()
|
|
||||||
props["time"] = fmt.Sprintf("%v", model.GetMillis())
|
|
||||||
props["invite_id"] = inviteId
|
|
||||||
data := model.MapToJson(props)
|
|
||||||
hash := utils.HashSha256(fmt.Sprintf("%v:%v", data, inviteSalt))
|
|
||||||
|
|
||||||
// when the server tries to validate the invite, it will pull the user from our mock store
|
|
||||||
// this can return nil, because we'll fail before we get to trying to use it
|
|
||||||
mockStore.UserStore.On("Get", userId).Return(
|
|
||||||
storetest.NewStoreChannel(store.StoreResult{
|
|
||||||
Data: nil,
|
|
||||||
Err: nil,
|
|
||||||
}),
|
|
||||||
)
|
|
||||||
|
|
||||||
// the server will also pull the team. the one we return has a different invite id than the one in the email invite we made above
|
|
||||||
mockStore.TeamStore.On("Get", teamId).Return(
|
|
||||||
storetest.NewStoreChannel(store.StoreResult{
|
|
||||||
Data: &model.Team{
|
|
||||||
InviteId: teamInviteId,
|
|
||||||
},
|
|
||||||
Err: nil,
|
|
||||||
}),
|
|
||||||
)
|
|
||||||
|
|
||||||
app := App{
|
|
||||||
Srv: &Server{
|
|
||||||
Store: mockStore,
|
|
||||||
},
|
|
||||||
config: atomic.Value{},
|
|
||||||
}
|
|
||||||
app.config.Store(&model.Config{
|
|
||||||
EmailSettings: model.EmailSettings{
|
|
||||||
InviteSalt: inviteSalt,
|
|
||||||
},
|
|
||||||
})
|
|
||||||
|
|
||||||
// this should fail because the invite ids are mismatched
|
|
||||||
team, err := app.AddUserToTeamByHash(userId, hash, data)
|
|
||||||
assert.Nil(t, team)
|
|
||||||
assert.Equal(t, "api.user.create_user.signup_link_mismatched_invite_id.app_error", err.Id)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestJoinUserToTeam(t *testing.T) {
|
func TestJoinUserToTeam(t *testing.T) {
|
||||||
th := Setup().InitBasic()
|
th := Setup().InitBasic()
|
||||||
defer th.TearDown()
|
defer th.TearDown()
|
||||||
|
|||||||
@@ -2838,10 +2838,6 @@
|
|||||||
"id": "api.user.create_user.signup_link_invalid.app_error",
|
"id": "api.user.create_user.signup_link_invalid.app_error",
|
||||||
"translation": "The signup link does not appear to be valid"
|
"translation": "The signup link does not appear to be valid"
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "api.user.create_user.signup_link_mismatched_invite_id.app_error",
|
|
||||||
"translation": "The signup link does not appear to be valid"
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "api.user.create_user.team_name.app_error",
|
"id": "api.user.create_user.team_name.app_error",
|
||||||
"translation": "Invalid team name"
|
"translation": "Invalid team name"
|
||||||
|
|||||||
Ссылка в новой задаче
Block a user