MM-58525 Fix upload file permissions (#27298)

* tie create_post and upload_file permissions together

* update tests

* update file name

* update migration to do in batches

* Update 000122_remove_upload_file_permission.up.sql

* fix formatting

* simplify migrations, fix regex issue

* update file names for recent merge

---------

Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/db/migrations/migrations.list

@@ -242,6 +242,8 @@ channels/db/migrations/mysql/000121_remove_true_up_review_history.down.sql
 channels/db/migrations/mysql/000121_remove_true_up_review_history.up.sql
 channels/db/migrations/mysql/000122_preferences_value_length.down.sql
 channels/db/migrations/mysql/000122_preferences_value_length.up.sql
+channels/db/migrations/mysql/000123_remove_upload_file_permission.down.sql
+channels/db/migrations/mysql/000123_remove_upload_file_permission.up.sql
 channels/db/migrations/postgres/000001_create_teams.down.sql
 channels/db/migrations/postgres/000001_create_teams.up.sql
 channels/db/migrations/postgres/000002_create_team_members.down.sql
@@ -484,3 +486,5 @@ channels/db/migrations/postgres/000121_remove_true_up_review_history.down.sql
 channels/db/migrations/postgres/000121_remove_true_up_review_history.up.sql
 channels/db/migrations/postgres/000122_preferences_value_length.down.sql
 channels/db/migrations/postgres/000122_preferences_value_length.up.sql
+channels/db/migrations/postgres/000123_remove_upload_file_permission.down.sql
+channels/db/migrations/postgres/000123_remove_upload_file_permission.up.sql

server/channels/db/migrations/mysql/000123_remove_upload_file_permission.down.sql

@@ -0,0 +1 @@
+-- Skipping it because the forward migrations are destructive

server/channels/db/migrations/mysql/000123_remove_upload_file_permission.up.sql

@@ -0,0 +1,18 @@
+CREATE PROCEDURE RemoveUuploadFilePermission()
+BEGIN
+    updateRoles: LOOP
+        -- update affected rows
+        UPDATE Roles 
+            SET Permissions = REGEXP_REPLACE(Permissions, 'upload_file([[:space:]]|$)', '')
+            WHERE Permissions like '%upload_file%' and Permissions not REGEXP 'create_post([[:space:]]|$)'
+            LIMIT 100;
+
+          -- check if the loop has completed    
+          IF  ROW_COUNT() < 100 THEN
+              LEAVE updateRoles;
+          END IF;    
+    END LOOP updateRoles;
+END;
+
+CALL RemoveUuploadFilePermission();
+DROP PROCEDURE IF EXISTS RemoveUuploadFilePermission;

server/channels/db/migrations/postgres/000123_remove_upload_file_permission.down.sql

@@ -0,0 +1 @@
+-- Skipping it because the forward migrations are destructive

server/channels/db/migrations/postgres/000123_remove_upload_file_permission.up.sql

@@ -0,0 +1,18 @@
+DO $$
+<<remove_upload_file_permission>>
+DECLARE
+  rows_updated integer;
+BEGIN
+  LOOP
+    WITH table_holder AS (
+      SELECT id FROM roles
+          WHERE permissions ~~ '%upload_file%' AND permissions !~ 'create_post($|\s)'
+          ORDER BY id ASC limit 100
+    )
+
+    UPDATE Roles r set permissions = REGEXP_REPLACE(permissions, 'upload_file($|\s)', '') 
+        WHERE r.id in (SELECT id FROM table_holder);
+    GET DIAGNOSTICS rows_updated = ROW_COUNT;
+    EXIT WHEN rows_updated < 100;
+  END LOOP;
+END remove_upload_file_permission $$;