MM-10352: Add locking incoming webhooks to a single channel. (#8835)

app/webhook.go

@@ -633,6 +633,10 @@ func (a *App) HandleIncomingWebhook(hookId string, req *model.IncomingWebhookReq
 		}
 	}
 
+	if hook.ChannelLocked && hook.ChannelId != channel.Id {
+		return model.NewAppError("HandleIncomingWebhook", "web.incoming_webhook.channel_locked.app_error", nil, "", http.StatusForbidden)
+	}
+
 	if a.License() != nil && *a.Config().TeamSettings.ExperimentalTownSquareIsReadOnly &&
 		channel.Name == model.DEFAULT_CHANNEL {
 		return model.NewAppError("HandleIncomingWebhook", "api.post.create_post.town_square_read_only", nil, "", http.StatusForbidden)

i18n/en.json

@@ -6718,6 +6718,10 @@
     "id": "store.sql_role.get_by_names.app_error",
     "translation": "Unable to get roles"
   },
+  {
+    "id": "web.incoming_webhook.channel_locked.app_error",
+    "translation": "This webhook is not permitted to post to the requested channel"
+  },
   {
     "id": "store.sql_role.permanent_delete_all.app_error",
     "translation": "We could not permanently delete all the roles"

model/incoming_webhook.go

@@ -16,17 +16,18 @@ const (
 )
 
 type IncomingWebhook struct {
-	Id          string `json:"id"`
+	Id            string `json:"id"`
-	CreateAt    int64  `json:"create_at"`
+	CreateAt      int64  `json:"create_at"`
-	UpdateAt    int64  `json:"update_at"`
+	UpdateAt      int64  `json:"update_at"`
-	DeleteAt    int64  `json:"delete_at"`
+	DeleteAt      int64  `json:"delete_at"`
-	UserId      string `json:"user_id"`
+	UserId        string `json:"user_id"`
-	ChannelId   string `json:"channel_id"`
+	ChannelId     string `json:"channel_id"`
-	TeamId      string `json:"team_id"`
+	TeamId        string `json:"team_id"`
-	DisplayName string `json:"display_name"`
+	DisplayName   string `json:"display_name"`
-	Description string `json:"description"`
+	Description   string `json:"description"`
-	Username    string `json:"username"`
+	Username      string `json:"username"`
-	IconURL     string `json:"icon_url"`
+	IconURL       string `json:"icon_url"`
+	ChannelLocked bool   `json:"channel_locked"`
 }
 
 type IncomingWebhookRequest struct {

store/sqlstore/upgrade.go

@@ -427,6 +427,8 @@ func UpgradeDatabaseToVersion410(sqlStore SqlStore) {
 func UpgradeDatabaseToVersion50(sqlStore SqlStore) {
 	// TODO: Uncomment following condition when version 3.10.0 is released
 	//if shouldPerformUpgrade(sqlStore, VERSION_4_10_0, VERSION_5_0_0) {
+	sqlStore.CreateColumnIfNotExists("IncomingWebhooks", "ChannelLocked", "boolean", "boolean", "0")
+
 	//	saveSchemaVersion(sqlStore, VERSION_5_0_0)
 	//}
 }

web/webhook_test.go

@@ -182,6 +182,29 @@ func TestIncomingWebhook(t *testing.T) {
 		assert.True(t, resp.StatusCode == http.StatusOK)
 	})
 
+	t.Run("ChannelLockedWebhook", func(t *testing.T) {
+		channel, err := th.App.CreateChannel(&model.Channel{TeamId: th.BasicTeam.Id, Name: model.NewId(), DisplayName: model.NewId(), Type: model.CHANNEL_OPEN, CreatorId: th.BasicUser.Id}, true)
+		require.Nil(t, err)
+
+		hook, err := th.App.CreateIncomingWebhookForChannel(th.BasicUser.Id, th.BasicChannel, &model.IncomingWebhook{ChannelId: th.BasicChannel.Id, ChannelLocked: true})
+		require.Nil(t, err)
+
+		url := ApiClient.Url + "/hooks/" + hook.Id
+
+		payload := "payload={\"text\": \"test text\"}"
+		resp, err2 := http.Post(url, "application/x-www-form-urlencoded", strings.NewReader(payload))
+		require.Nil(t, err2)
+		assert.True(t, resp.StatusCode == http.StatusOK)
+
+		resp, err2 = http.Post(url, "application/json", strings.NewReader(fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", th.BasicChannel.Name)))
+		require.Nil(t, err2)
+		assert.True(t, resp.StatusCode == http.StatusOK)
+
+		resp, err2 = http.Post(url, "application/json", strings.NewReader(fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", channel.Name)))
+		require.Nil(t, err2)
+		assert.True(t, resp.StatusCode == http.StatusForbidden)
+	})
+
 	t.Run("DisableWebhooks", func(t *testing.T) {
 		th.App.UpdateConfig(func(cfg *model.Config) { cfg.ServiceSettings.EnableIncomingWebhooks = false })
 		resp, err := http.Post(url, "application/json", strings.NewReader("{\"text\":\"this is a test\"}"))