From 7c4c038a9694819c22ba389098c4f3ba5646eb71 Mon Sep 17 00:00:00 2001
From: Martin Kraft <martinkraft@gmail.com>
Date: Tue, 23 Jun 2020 16:08:55 -0400
Subject: [PATCH] MM-11713: Does not require edit_own_posts to
 edit_others_posts. (#14787)

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>
---
 api4/post.go      | 20 ++++++++++----------
 api4/post_test.go | 15 +++++++++++++++
 2 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/api4/post.go b/api4/post.go
index 8d5638c6b9..8f8ccc50e4 100644
--- a/api4/post.go
+++ b/api4/post.go
@@ -595,11 +595,6 @@ func patchPost(c *Context, w http.ResponseWriter, r *http.Request) {
 	// Updating the file_ids of a post is not a supported operation and will be ignored
 	post.FileIds = nil
 
-	if !c.App.SessionHasPermissionToChannelByPost(*c.App.Session(), c.Params.PostId, model.PERMISSION_EDIT_POST) {
-		c.SetPermissionError(model.PERMISSION_EDIT_POST)
-		return
-	}
-
 	originalPost, err := c.App.GetSinglePost(c.Params.PostId)
 	if err != nil {
 		c.SetPermissionError(model.PERMISSION_EDIT_POST)
@@ -607,11 +602,16 @@ func patchPost(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 	auditRec.AddMeta("post", originalPost)
 
-	if c.App.Session().UserId != originalPost.UserId {
-		if !c.App.SessionHasPermissionToChannelByPost(*c.App.Session(), c.Params.PostId, model.PERMISSION_EDIT_OTHERS_POSTS) {
-			c.SetPermissionError(model.PERMISSION_EDIT_OTHERS_POSTS)
-			return
-		}
+	var permission *model.Permission
+	if c.App.Session().UserId == originalPost.UserId {
+		permission = model.PERMISSION_EDIT_POST
+	} else {
+		permission = model.PERMISSION_EDIT_OTHERS_POSTS
+	}
+
+	if !c.App.SessionHasPermissionToChannelByPost(*c.App.Session(), c.Params.PostId, permission) {
+		c.SetPermissionError(permission)
+		return
 	}
 
 	patchedPost, err := c.App.PatchPost(c.Params.PostId, c.App.PostPatchWithProxyRemovedFromImageURLs(post))
diff --git a/api4/post_test.go b/api4/post_test.go
index 0fbd94aa46..db916f1438 100644
--- a/api4/post_test.go
+++ b/api4/post_test.go
@@ -938,6 +938,21 @@ func TestPatchPost(t *testing.T) {
 		_, resp := th.SystemAdminClient.PatchPost(post.Id, patch)
 		CheckNoError(t, resp)
 	})
+
+	t.Run("edit others posts permission can function independently of edit own post", func(t *testing.T) {
+		th.LoginBasic2()
+		patch := &model.PostPatch{}
+		_, resp := Client.PatchPost(post.Id, patch)
+		CheckForbiddenStatus(t, resp)
+
+		// Add permission to edit others'
+		defer th.RestoreDefaultRolePermissions(th.SaveDefaultRolePermissions())
+		th.RemovePermissionFromRole(model.PERMISSION_EDIT_POST.Id, model.CHANNEL_USER_ROLE_ID)
+		th.AddPermissionToRole(model.PERMISSION_EDIT_OTHERS_POSTS.Id, model.CHANNEL_USER_ROLE_ID)
+
+		_, resp = Client.PatchPost(post.Id, patch)
+		CheckNoError(t, resp)
+	})
 }
 
 func TestPinPost(t *testing.T) {