From 80e0d01fe5aea9451d0c364cdc0e3826c296407e Mon Sep 17 00:00:00 2001
From: Miguel de la Cruz <mgdelacroix@gmail.com>
Date: Tue, 5 Mar 2019 10:52:33 +0000
Subject: [PATCH] [MM-14300] Return 400 if a post is created with a child post
 as root (#10403)

---
 app/post.go      |  5 +++++
 app/post_test.go | 53 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 58 insertions(+)

diff --git a/app/post.go b/app/post.go
index 7d277e4456..ca06a04f70 100644
--- a/app/post.go
+++ b/app/post.go
@@ -189,6 +189,11 @@ func (a *App) CreatePost(post *model.Post, channel *model.Channel, triggerWebhoo
 			return nil, model.NewAppError("createPost", "api.post.create_post.channel_root_id.app_error", nil, "", http.StatusInternalServerError)
 		}
 
+		rootPost := parentPostList.Posts[post.RootId]
+		if len(rootPost.RootId) > 0 {
+			return nil, model.NewAppError("createPost", "api.post.create_post.root_id.app_error", nil, "", http.StatusBadRequest)
+		}
+
 		if post.ParentId == "" {
 			post.ParentId = post.RootId
 		}
diff --git a/app/post_test.go b/app/post_test.go
index 8233160d30..022658ee9e 100644
--- a/app/post_test.go
+++ b/app/post_test.go
@@ -342,6 +342,59 @@ func TestPostReplyToPostWhereRootPosterLeftChannel(t *testing.T) {
 	}
 }
 
+func TestPostAttachPostToChildPost(t *testing.T) {
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	channel := th.BasicChannel
+	user := th.BasicUser
+	rootPost := th.BasicPost
+
+	replyPost1 := model.Post{
+		Message:       "reply one",
+		ChannelId:     channel.Id,
+		RootId:        rootPost.Id,
+		ParentId:      rootPost.Id,
+		PendingPostId: model.NewId() + ":" + fmt.Sprint(model.GetMillis()),
+		UserId:        user.Id,
+		CreateAt:      0,
+	}
+
+	res1, err := th.App.CreatePostAsUser(&replyPost1, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	replyPost2 := model.Post{
+		Message:       "reply two",
+		ChannelId:     channel.Id,
+		RootId:        res1.Id,
+		ParentId:      res1.Id,
+		PendingPostId: model.NewId() + ":" + fmt.Sprint(model.GetMillis()),
+		UserId:        user.Id,
+		CreateAt:      0,
+	}
+
+	_, err = th.App.CreatePostAsUser(&replyPost2, false)
+	if err.StatusCode != http.StatusBadRequest {
+		t.Fatal(fmt.Sprintf("Expected BadRequest error, got %v", err))
+	}
+
+	replyPost3 := model.Post{
+		Message:       "reply three",
+		ChannelId:     channel.Id,
+		RootId:        rootPost.Id,
+		ParentId:      rootPost.Id,
+		PendingPostId: model.NewId() + ":" + fmt.Sprint(model.GetMillis()),
+		UserId:        user.Id,
+		CreateAt:      0,
+	}
+
+	if _, err := th.App.CreatePostAsUser(&replyPost3, false); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestPostChannelMentions(t *testing.T) {
 	th := Setup(t).InitBasic()
 	defer th.TearDown()