From 817e18414e411dba3fc8fa40b7376f305d6f0b8b Mon Sep 17 00:00:00 2001
From: Scott Bishel <scott.bishel@mattermost.com>
Date: Wed, 26 Jun 2024 12:41:26 -0600
Subject: [PATCH] require regenerate invite id to have invite permission
 (#27427)

---
 server/channels/api4/team.go      | 4 ++++
 server/channels/api4/team_test.go | 5 +++++
 2 files changed, 9 insertions(+)

diff --git a/server/channels/api4/team.go b/server/channels/api4/team.go
index 9d0e2c831e..206d96dd21 100644
--- a/server/channels/api4/team.go
+++ b/server/channels/api4/team.go
@@ -398,6 +398,10 @@ func regenerateTeamInviteId(c *Context, w http.ResponseWriter, r *http.Request)
 		c.SetPermissionError(model.PermissionManageTeam)
 		return
 	}
+	if !c.App.SessionHasPermissionToTeam(*c.AppContext.Session(), c.Params.TeamId, model.PermissionInviteUser) {
+		c.SetPermissionError(model.PermissionInviteUser)
+		return
+	}
 
 	auditRec := c.MakeAuditRecord("regenerateTeamInviteId", audit.Fail)
 	audit.AddEventParameter(auditRec, "team_id", c.Params.TeamId)
diff --git a/server/channels/api4/team_test.go b/server/channels/api4/team_test.go
index 8bb0e7efa5..48436b8ec7 100644
--- a/server/channels/api4/team_test.go
+++ b/server/channels/api4/team_test.go
@@ -956,6 +956,11 @@ func TestRegenerateTeamInviteId(t *testing.T) {
 	assert.NotEqual(t, team.InviteId, rteam.InviteId)
 	assert.NotEqual(t, team.InviteId, "")
 	assert.Equal(t, rteam.Email, "")
+
+	manager := th.SystemManagerClient
+	th.RemovePermissionFromRole(model.PermissionInviteUser.Id, model.SystemManagerRoleId)
+	_, _, err = manager.RegenerateTeamInviteId(context.Background(), team.Id)
+	require.Error(t, err)
 }
 
 func TestSoftDeleteTeam(t *testing.T) {