diff --git a/server/channels/api4/channel.go b/server/channels/api4/channel.go index 0eb4a4c09d..c690c0920d 100644 --- a/server/channels/api4/channel.go +++ b/server/channels/api4/channel.go @@ -732,8 +732,8 @@ func getChannelsMemberCount(c *Context, w http.ResponseWriter, r *http.Request) } for _, channel := range channels { - if !c.App.HasPermissionToReadChannel(c.AppContext, c.AppContext.Session().UserId, channel) { - c.SetPermissionError(model.PermissionReadChannel) + if !c.App.HasPermissionToChannelMemberCount(c.AppContext, c.AppContext.Session().UserId, channel) { + c.SetPermissionError(model.PermissionListTeamChannels) return } } diff --git a/server/channels/app/app_iface.go b/server/channels/app/app_iface.go index 8a8d1aa1fc..57c2826340 100644 --- a/server/channels/app/app_iface.go +++ b/server/channels/app/app_iface.go @@ -909,6 +909,7 @@ type AppIface interface { HasPermissionTo(askingUserId string, permission *model.Permission) bool HasPermissionToChannel(c request.CTX, askingUserId string, channelID string, permission *model.Permission) bool HasPermissionToChannelByPost(c request.CTX, askingUserId string, postID string, permission *model.Permission) bool + HasPermissionToChannelMemberCount(c request.CTX, userID string, channel *model.Channel) bool HasPermissionToReadChannel(c request.CTX, userID string, channel *model.Channel) bool HasPermissionToTeam(c request.CTX, askingUserId string, teamID string, permission *model.Permission) bool HasPermissionToUser(askingUserId string, userID string) bool diff --git a/server/channels/app/authorization.go b/server/channels/app/authorization.go index 6ad4119fa2..1614b44ef9 100644 --- a/server/channels/app/authorization.go +++ b/server/channels/app/authorization.go @@ -385,3 +385,18 @@ func (a *App) HasPermissionToReadChannel(c request.CTX, userID string, channel * return false } + +func (a *App) HasPermissionToChannelMemberCount(c request.CTX, userID string, channel *model.Channel) bool { + if !*a.Config().TeamSettings.ExperimentalViewArchivedChannels && channel.DeleteAt != 0 { + return false + } + if a.HasPermissionToChannel(c, userID, channel.Id, model.PermissionReadChannelContent) { + return true + } + + if channel.Type == model.ChannelTypeOpen { + return a.HasPermissionToTeam(c, userID, channel.TeamId, model.PermissionListTeamChannels) + } + + return false +} diff --git a/server/channels/app/opentracing/opentracing_layer.go b/server/channels/app/opentracing/opentracing_layer.go index 73e9d11ec2..ed579014c7 100644 --- a/server/channels/app/opentracing/opentracing_layer.go +++ b/server/channels/app/opentracing/opentracing_layer.go @@ -11776,6 +11776,23 @@ func (a *OpenTracingAppLayer) HasPermissionToChannelByPost(c request.CTX, asking return resultVar0 } +func (a *OpenTracingAppLayer) HasPermissionToChannelMemberCount(c request.CTX, userID string, channel *model.Channel) bool { + origCtx := a.ctx + span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.HasPermissionToChannelMemberCount") + + a.ctx = newCtx + a.app.Srv().Store().SetContext(newCtx) + defer func() { + a.app.Srv().Store().SetContext(origCtx) + a.ctx = origCtx + }() + + defer span.Finish() + resultVar0 := a.app.HasPermissionToChannelMemberCount(c, userID, channel) + + return resultVar0 +} + func (a *OpenTracingAppLayer) HasPermissionToReadChannel(c request.CTX, userID string, channel *model.Channel) bool { origCtx := a.ctx span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.HasPermissionToReadChannel")