From 887bc0173ee7f62541a3ae4f68e509082799a4c3 Mon Sep 17 00:00:00 2001
From: Agniva De Sarker <agnivade@yahoo.co.in>
Date: Fri, 29 Jul 2022 09:58:44 +0530
Subject: [PATCH] MM-45715: Fix incorrect permissions (Round 2) (#20731)

We missed a case to return if there are no
items in the slice. Otherwise it falls through
and returns false incorrectly.

Rectified the tests to trigger the case.

https://mattermost.atlassian.net/browse/MM-45715

```release-note
NONE
```
---
 api4/resolver_team_member_test.go | 26 +++++++++++++++++++++++---
 app/authorization.go              |  8 ++++++++
 2 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/api4/resolver_team_member_test.go b/api4/resolver_team_member_test.go
index 3ec3161d64..2d740e1545 100644
--- a/api4/resolver_team_member_test.go
+++ b/api4/resolver_team_member_test.go
@@ -293,11 +293,31 @@ func TestGraphQLTeamMembers(t *testing.T) {
 func TestGraphQLTeamMembersAsGuest(t *testing.T) {
 	os.Setenv("MM_FEATUREFLAGS_GRAPHQL", "true")
 	defer os.Unsetenv("MM_FEATUREFLAGS_GRAPHQL")
-	th := Setup(t).InitBasic()
+
+	th := Setup(t)
+
+	id := model.NewId()
+	team := &model.Team{
+		DisplayName:     "dn_" + id,
+		Name:            GenerateTestTeamName(),
+		Email:           th.GenerateTestEmail(),
+		Type:            model.TeamOpen,
+		AllowOpenInvite: true,
+	}
+
+	var err error
+	team, _, err = th.Client.CreateTeam(team)
+	require.NoError(t, err)
+	th.BasicTeam = team
+
+	th.BasicChannel = th.CreatePublicChannel()
+	th.LinkUserToTeam(th.BasicUser, th.BasicTeam)
+	th.App.AddUserToChannel(th.Context, th.BasicUser, th.BasicChannel, false)
+	th.LoginBasic()
+
 	defer th.TearDown()
 
-	th.App.DemoteUserToGuest(th.Context, th.BasicUser)
-	th.BasicUser, _ = th.App.UpdateUserRoles(th.Context, th.BasicUser.Id, model.SystemGuestRoleId, false)
+	require.Nil(t, th.App.DemoteUserToGuest(th.Context, th.BasicUser))
 
 	var q struct {
 		TeamMembers []struct {
diff --git a/app/authorization.go b/app/authorization.go
index ee161ddbee..9945d5d6ce 100644
--- a/app/authorization.go
+++ b/app/authorization.go
@@ -59,6 +59,10 @@ func (a *App) SessionHasPermissionToTeam(session model.Session, teamID string, p
 
 // SessionHasPermissionToTeams returns true only if user has access to all teams.
 func (a *App) SessionHasPermissionToTeams(c request.CTX, session model.Session, teamIDs []string, permission *model.Permission) bool {
+	if len(teamIDs) == 0 {
+		return true
+	}
+
 	for _, teamID := range teamIDs {
 		if teamID == "" {
 			return false
@@ -126,6 +130,10 @@ func (a *App) SessionHasPermissionToChannel(c request.CTX, session model.Session
 
 // SessionHasPermissionToChannels returns true only if user has access to all channels.
 func (a *App) SessionHasPermissionToChannels(c request.CTX, session model.Session, channelIDs []string, permission *model.Permission) bool {
+	if len(channelIDs) == 0 {
+		return true
+	}
+
 	for _, channelID := range channelIDs {
 		if channelID == "" {
 			return false