diff --git a/api4/role.go b/api4/role.go index 06a0929817..25dd6ab0dc 100644 --- a/api4/role.go +++ b/api4/role.go @@ -10,18 +10,6 @@ import ( "github.com/mattermost/mattermost-server/v5/model" ) -var allowedPermissions = []string{ - model.PermissionCreateTeam.Id, - model.PermissionManageIncomingWebhooks.Id, - model.PermissionManageOutgoingWebhooks.Id, - model.PermissionManageSlashCommands.Id, - model.PermissionManageOAuth.Id, - model.PermissionManageSystemWideOAuth.Id, - model.PermissionCreateEmojis.Id, - model.PermissionDeleteEmojis.Id, - model.PermissionEditOthersPosts.Id, -} - var notAllowedPermissions = []string{ model.PermissionSysconsoleWriteUserManagementSystemRoles.Id, model.PermissionSysconsoleReadUserManagementSystemRoles.Id, @@ -129,23 +117,9 @@ func patchRole(c *Context, w http.ResponseWriter, r *http.Request) { c.Err = model.NewAppError("Api4.PatchRoles", "api.roles.patch_roles.license.error", nil, "", http.StatusNotImplemented) return } - - changedPermissions := model.PermissionsChangedByPatch(oldRole, patch) - for _, permission := range changedPermissions { - allowed := false - for _, allowedPermission := range allowedPermissions { - if permission == allowedPermission { - allowed = true - } - } - - if !allowed { - c.Err = model.NewAppError("Api4.PatchRoles", "api.roles.patch_roles.license.error", nil, "", http.StatusNotImplemented) - return - } - } } + // Licensed instances can not change permissions in the blacklist set. if patch.Permissions != nil { deltaPermissions := model.PermissionsChangedByPatch(oldRole, patch) diff --git a/api4/role_test.go b/api4/role_test.go index b1c4e417c6..ba95a48a3a 100644 --- a/api4/role_test.go +++ b/api4/role_test.go @@ -240,22 +240,10 @@ func TestPatchRole(t *testing.T) { _, resp = th.Client.PatchRole(role.Id, patch) CheckForbiddenStatus(t, resp) - // Check a change that the license would not allow. patch = &model.RolePatch{ Permissions: &[]string{"manage_system", "manage_incoming_webhooks", "manage_outgoing_webhooks"}, } - th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) { - _, resp := client.PatchRole(role.Id, patch) - CheckNotImplementedStatus(t, resp) - }) - - // Add a license. - license := model.NewTestLicense() - license.Features.GuestAccountsPermissions = model.NewBool(false) - th.App.Srv().SetLicense(license) - - // Try again, should succeed th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) { received, resp := client.PatchRole(role.Id, patch) CheckNoError(t, resp)