From 9ff26f7b4f6dec4dcba1c22eda4a5d41c26c4822 Mon Sep 17 00:00:00 2001
From: Elias Nahum <nahumhbl@gmail.com>
Date: Tue, 6 Feb 2024 09:34:19 +0800
Subject: [PATCH] MM-56513 Prevent deactivated users to be added as channel
 members (#25954)

* Prevent deactivated users to be added as channel members

* remove "deactivated" from error message
---
 server/channels/app/channel.go      |  4 ++++
 server/channels/app/channel_test.go | 16 ++++++++++++++++
 server/i18n/en.json                 |  4 ++++
 3 files changed, 24 insertions(+)

diff --git a/server/channels/app/channel.go b/server/channels/app/channel.go
index 29f1fda3b6..9eab610d70 100644
--- a/server/channels/app/channel.go
+++ b/server/channels/app/channel.go
@@ -1695,6 +1695,10 @@ func (a *App) AddChannelMember(c request.CTX, userID string, channel *model.Chan
 		return nil, err
 	}
 
+	if user.DeleteAt > 0 {
+		return nil, model.NewAppError("AddChannelMember", "app.channel.add_member.deleted_user.app_error", nil, "", http.StatusForbidden)
+	}
+
 	var userRequestor *model.User
 	if opts.UserRequestorID != "" {
 		if userRequestor, err = a.GetUser(opts.UserRequestorID); err != nil {
diff --git a/server/channels/app/channel_test.go b/server/channels/app/channel_test.go
index 0300cf49a3..ba918a85aa 100644
--- a/server/channels/app/channel_test.go
+++ b/server/channels/app/channel_test.go
@@ -764,6 +764,22 @@ func TestAddChannelMemberNoUserRequestor(t *testing.T) {
 	}
 }
 
+func TestAddChannelMemberDeletedUser(t *testing.T) {
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	user := th.CreateUser()
+	_, err := th.App.AddTeamMember(th.Context, th.BasicTeam.Id, user.Id)
+	require.Nil(t, err)
+
+	deactivated, err := th.App.UpdateActive(th.Context, user, false)
+	require.Greater(t, deactivated.DeleteAt, int64(0))
+
+	require.Nil(t, err)
+	_, err = th.App.AddChannelMember(th.Context, user.Id, th.BasicChannel, ChannelMemberOpts{})
+	require.NotNil(t, err)
+}
+
 func TestAppUpdateChannelScheme(t *testing.T) {
 	th := Setup(t).InitBasic()
 	defer th.TearDown()
diff --git a/server/i18n/en.json b/server/i18n/en.json
index 5dd9d8291a..af0d600445 100644
--- a/server/i18n/en.json
+++ b/server/i18n/en.json
@@ -4854,6 +4854,10 @@
     "id": "app.bot.permenent_delete.bad_id",
     "translation": "Unable to delete the bot."
   },
+  {
+    "id": "app.channel.add_member.deleted_user.app_error",
+    "translation": "Unable to add thr user as a member of the channel."
+  },
   {
     "id": "app.channel.analytics_type_count.app_error",
     "translation": "Unable to get channel type counts."