mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

[MM-42421] Prevent guests from seeing users through groups API (#21151)

Просмотр исходного кода
Этот коммит содержится в:
cyrilzhang-mm
2022-10-25 11:54:51 -04:00
коммит произвёл GitHub
родитель c5f4882f0a
Коммит a648ced221
17 изменённых файлов: 406 добавлений и 178 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

10
app/app_iface.go
Просмотреть файл

@@ -639,16 +639,16 @@ type AppIface interface {
GetFlaggedPostsForChannel(userID, channelID string, offset int, limit int) (*model.PostList, *model.AppError)
GetFlaggedPostsForTeam(userID, teamID string, offset int, limit int) (*model.PostList, *model.AppError)
GetGlobalRetentionPolicy() (*model.GlobalRetentionPolicy, *model.AppError)
GetGroup(id string, opts *model.GetGroupOpts) (*model.Group, *model.AppError)
GetGroup(id string, opts *model.GetGroupOpts, viewRestrictions *model.ViewUsersRestrictions) (*model.Group, *model.AppError)
GetGroupByName(name string, opts model.GroupSearchOpts) (*model.Group, *model.AppError)
GetGroupByRemoteID(remoteID string, groupSource model.GroupSource) (*model.Group, *model.AppError)
GetGroupChannel(c request.CTX, userIDs []string) (*model.Channel, *model.AppError)
GetGroupMemberCount(groupID string) (int64, *model.AppError)
GetGroupMemberCount(groupID string, viewRestrictions *model.ViewUsersRestrictions) (int64, *model.AppError)
GetGroupMemberUsers(groupID string) ([]*model.User, *model.AppError)
GetGroupMemberUsersPage(groupID string, page int, perPage int) ([]*model.User, int, *model.AppError)
GetGroupMemberUsersPage(groupID string, page int, perPage int, viewRestrictions *model.ViewUsersRestrictions) ([]*model.User, int, *model.AppError)
GetGroupSyncable(groupID string, syncableID string, syncableType model.GroupSyncableType) (*model.GroupSyncable, *model.AppError)
GetGroupSyncables(groupID string, syncableType model.GroupSyncableType) ([]*model.GroupSyncable, *model.AppError)
GetGroups(page, perPage int, opts model.GroupSearchOpts) ([]*model.Group, *model.AppError)
GetGroups(page, perPage int, opts model.GroupSearchOpts, viewRestrictions *model.ViewUsersRestrictions) ([]*model.Group, *model.AppError)
GetGroupsAssociatedToChannelsByTeam(teamID string, opts model.GroupSearchOpts) (map[string][]*model.GroupWithSchemeAdmin, *model.AppError)
GetGroupsByChannel(channelID string, opts model.GroupSearchOpts) ([]*model.GroupWithSchemeAdmin, int, *model.AppError)
GetGroupsByIDs(groupIDs []string) ([]*model.Group, *model.AppError)
@@ -831,7 +831,7 @@ type AppIface interface {
GetUsersNotInChannel(teamID string, channelID string, groupConstrained bool, offset int, limit int, viewRestrictions *model.ViewUsersRestrictions) ([]*model.User, *model.AppError)
GetUsersNotInChannelMap(teamID string, channelID string, groupConstrained bool, offset int, limit int, asAdmin bool, viewRestrictions *model.ViewUsersRestrictions) (map[string]*model.User, *model.AppError)
GetUsersNotInChannelPage(teamID string, channelID string, groupConstrained bool, page int, perPage int, asAdmin bool, viewRestrictions *model.ViewUsersRestrictions) ([]*model.User, *model.AppError)
GetUsersNotInGroupPage(groupID string, page int, perPage int) ([]*model.User, *model.AppError)
GetUsersNotInGroupPage(groupID string, page int, perPage int, viewRestrictions *model.ViewUsersRestrictions) ([]*model.User, *model.AppError)
GetUsersNotInTeam(teamID string, groupConstrained bool, offset int, limit int, viewRestrictions *model.ViewUsersRestrictions) ([]*model.User, *model.AppError)
GetUsersNotInTeamEtag(teamID string, restrictionsHash string) string
GetUsersNotInTeamPage(teamID string, groupConstrained bool, page int, perPage int, asAdmin bool, viewRestrictions *model.ViewUsersRestrictions) ([]*model.User, *model.AppError)

24
app/group.go
Просмотреть файл

@@ -13,7 +13,7 @@ import (
"github.com/mattermost/mattermost-server/v6/store"
)
func (a *App) GetGroup(id string, opts *model.GetGroupOpts) (*model.Group, *model.AppError) {
func (a *App) GetGroup(id string, opts *model.GetGroupOpts, viewRestrictions *model.ViewUsersRestrictions) (*model.Group, *model.AppError) {
group, err := a.Srv().Store().Group().Get(id)
if err != nil {
var nfErr *store.ErrNotFound
@@ -26,7 +26,7 @@ func (a *App) GetGroup(id string, opts *model.GetGroupOpts) (*model.Group, *mode
}
if opts != nil && opts.IncludeMemberCount {
memberCount, err := a.Srv().Store().Group().GetMemberCount(id)
memberCount, err := a.Srv().Store().Group().GetMemberCountWithRestrictions(id, viewRestrictions)
if err != nil {
return nil, model.NewAppError("GetGroup", "app.member_count", nil, "", http.StatusInternalServerError).Wrap(err)
}
@@ -147,7 +147,6 @@ func (a *App) CreateGroupWithUserIds(group *model.GroupWithUserIds) (*model.Grou
messageWs := model.NewWebSocketEvent(model.WebsocketEventReceivedGroup, "", "", "", nil, "")
count, err := a.Srv().Store().Group().GetMemberCount(newGroup.Id)
if err != nil {
return nil, model.NewAppError("CreateGroupWithUserIds", "app.group.id.app_error", nil, "", http.StatusBadRequest).Wrap(err)
}
@@ -218,8 +217,8 @@ func (a *App) DeleteGroup(groupID string) (*model.Group, *model.AppError) {
return deletedGroup, nil
}
func (a *App) GetGroupMemberCount(groupID string) (int64, *model.AppError) {
count, err := a.Srv().Store().Group().GetMemberCount(groupID)
func (a *App) GetGroupMemberCount(groupID string, viewRestrictions *model.ViewUsersRestrictions) (int64, *model.AppError) {
count, err := a.Srv().Store().Group().GetMemberCountWithRestrictions(groupID, viewRestrictions)
if err != nil {
return 0, model.NewAppError("GetGroupMemberCount", "app.select_error", nil, "", http.StatusInternalServerError).Wrap(err)
}
@@ -236,20 +235,21 @@ func (a *App) GetGroupMemberUsers(groupID string) ([]*model.User, *model.AppErro
return users, nil
}
func (a *App) GetGroupMemberUsersPage(groupID string, page int, perPage int) ([]*model.User, int, *model.AppError) {
members, err := a.Srv().Store().Group().GetMemberUsersPage(groupID, page, perPage)
func (a *App) GetGroupMemberUsersPage(groupID string, page int, perPage int, viewRestrictions *model.ViewUsersRestrictions) ([]*model.User, int, *model.AppError) {
members, err := a.Srv().Store().Group().GetMemberUsersPage(groupID, page, perPage, viewRestrictions)
if err != nil {
return nil, 0, model.NewAppError("GetGroupMemberUsersPage", "app.select_error", nil, "", http.StatusInternalServerError).Wrap(err)
}
count, appErr := a.GetGroupMemberCount(groupID)
count, appErr := a.GetGroupMemberCount(groupID, viewRestrictions)
if appErr != nil {
return nil, 0, appErr
}
return a.sanitizeProfiles(members, false), int(count), nil
}
func (a *App) GetUsersNotInGroupPage(groupID string, page int, perPage int) ([]*model.User, *model.AppError) {
members, err := a.Srv().Store().Group().GetNonMemberUsersPage(groupID, page, perPage)
func (a *App) GetUsersNotInGroupPage(groupID string, page int, perPage int, viewRestrictions *model.ViewUsersRestrictions) ([]*model.User, *model.AppError) {
members, err := a.Srv().Store().Group().GetNonMemberUsersPage(groupID, page, perPage, viewRestrictions)
if err != nil {
return nil, model.NewAppError("GetUsersNotInGroupPage", "app.select_error", nil, "", http.StatusInternalServerError).Wrap(err)
}
@@ -580,8 +580,8 @@ func (a *App) GetGroupsAssociatedToChannelsByTeam(teamID string, opts model.Grou
return groupsAssociatedByChannelId, nil
}
func (a *App) GetGroups(page, perPage int, opts model.GroupSearchOpts) ([]*model.Group, *model.AppError) {
groups, err := a.Srv().Store().Group().GetGroups(page, perPage, opts)
func (a *App) GetGroups(page, perPage int, opts model.GroupSearchOpts, viewRestrictions *model.ViewUsersRestrictions) ([]*model.Group, *model.AppError) {
groups, err := a.Srv().Store().Group().GetGroups(page, perPage, opts, viewRestrictions)
if err != nil {
return nil, model.NewAppError("GetGroups", "app.select_error", nil, "", http.StatusInternalServerError).Wrap(err)
}

10
app/group_test.go
Просмотреть файл

@@ -17,19 +17,19 @@ func TestGetGroup(t *testing.T) {
defer th.TearDown()
group := th.CreateGroup()
group, err := th.App.GetGroup(group.Id, nil)
group, err := th.App.GetGroup(group.Id, nil, nil)
require.Nil(t, err)
require.NotNil(t, group)
nilGroup, err := th.App.GetGroup(model.NewId(), nil)
nilGroup, err := th.App.GetGroup(model.NewId(), nil, nil)
require.NotNil(t, err)
require.Nil(t, nilGroup)
group, err = th.App.GetGroup(group.Id, &model.GetGroupOpts{IncludeMemberCount: false})
group, err = th.App.GetGroup(group.Id, &model.GetGroupOpts{IncludeMemberCount: false}, nil)
require.Nil(t, err)
require.Nil(t, group.MemberCount)
group, err = th.App.GetGroup(group.Id, &model.GetGroupOpts{IncludeMemberCount: true})
group, err = th.App.GetGroup(group.Id, &model.GetGroupOpts{IncludeMemberCount: true}, nil)
require.Nil(t, err)
require.NotNil(t, group.MemberCount)
}
@@ -369,7 +369,7 @@ func TestGetGroups(t *testing.T) {
defer th.TearDown()
group := th.CreateGroup()
groups, err := th.App.GetGroups(0, 60, model.GroupSearchOpts{})
groups, err := th.App.GetGroups(0, 60, model.GroupSearchOpts{}, nil)
require.Nil(t, err)
require.ElementsMatch(t, []*model.Group{group}, groups)
}

2
app/notification.go
Просмотреть файл

@@ -1082,7 +1082,7 @@ func (a *App) getGroupsAllowedForReferenceInChannel(channel *model.Channel, team
return groupsMap, nil
}
groups, err := a.Srv().Store().Group().GetGroups(0, 0, opts)
groups, err := a.Srv().Store().Group().GetGroups(0, 0, opts, nil)
if err != nil {
return nil, errors.Wrap(err, "unable to get groups")
}

20
app/opentracing/opentracing_layer.go
Просмотреть файл

@@ -6151,7 +6151,7 @@ func (a *OpenTracingAppLayer) GetGlobalRetentionPolicy() (*model.GlobalRetention
return resultVar0, resultVar1
}
func (a *OpenTracingAppLayer) GetGroup(id string, opts *model.GetGroupOpts) (*model.Group, *model.AppError) {
func (a *OpenTracingAppLayer) GetGroup(id string, opts *model.GetGroupOpts, viewRestrictions *model.ViewUsersRestrictions) (*model.Group, *model.AppError) {
origCtx := a.ctx
span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.GetGroup")
@@ -6163,7 +6163,7 @@ func (a *OpenTracingAppLayer) GetGroup(id string, opts *model.GetGroupOpts) (*mo
}()
defer span.Finish()
resultVar0, resultVar1 := a.app.GetGroup(id, opts)
resultVar0, resultVar1 := a.app.GetGroup(id, opts, viewRestrictions)
if resultVar1 != nil {
span.LogFields(spanlog.Error(resultVar1))
@@ -6239,7 +6239,7 @@ func (a *OpenTracingAppLayer) GetGroupChannel(c request.CTX, userIDs []string) (
return resultVar0, resultVar1
}
func (a *OpenTracingAppLayer) GetGroupMemberCount(groupID string) (int64, *model.AppError) {
func (a *OpenTracingAppLayer) GetGroupMemberCount(groupID string, viewRestrictions *model.ViewUsersRestrictions) (int64, *model.AppError) {
origCtx := a.ctx
span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.GetGroupMemberCount")
@@ -6251,7 +6251,7 @@ func (a *OpenTracingAppLayer) GetGroupMemberCount(groupID string) (int64, *model
}()
defer span.Finish()
resultVar0, resultVar1 := a.app.GetGroupMemberCount(groupID)
resultVar0, resultVar1 := a.app.GetGroupMemberCount(groupID, viewRestrictions)
if resultVar1 != nil {
span.LogFields(spanlog.Error(resultVar1))
@@ -6283,7 +6283,7 @@ func (a *OpenTracingAppLayer) GetGroupMemberUsers(groupID string) ([]*model.User
return resultVar0, resultVar1
}
func (a *OpenTracingAppLayer) GetGroupMemberUsersPage(groupID string, page int, perPage int) ([]*model.User, int, *model.AppError) {
func (a *OpenTracingAppLayer) GetGroupMemberUsersPage(groupID string, page int, perPage int, viewRestrictions *model.ViewUsersRestrictions) ([]*model.User, int, *model.AppError) {
origCtx := a.ctx
span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.GetGroupMemberUsersPage")
@@ -6295,7 +6295,7 @@ func (a *OpenTracingAppLayer) GetGroupMemberUsersPage(groupID string, page int,
}()
defer span.Finish()
resultVar0, resultVar1, resultVar2 := a.app.GetGroupMemberUsersPage(groupID, page, perPage)
resultVar0, resultVar1, resultVar2 := a.app.GetGroupMemberUsersPage(groupID, page, perPage, viewRestrictions)
if resultVar2 != nil {
span.LogFields(spanlog.Error(resultVar2))
@@ -6349,7 +6349,7 @@ func (a *OpenTracingAppLayer) GetGroupSyncables(groupID string, syncableType mod
return resultVar0, resultVar1
}
func (a *OpenTracingAppLayer) GetGroups(page int, perPage int, opts model.GroupSearchOpts) ([]*model.Group, *model.AppError) {
func (a *OpenTracingAppLayer) GetGroups(page int, perPage int, opts model.GroupSearchOpts, viewRestrictions *model.ViewUsersRestrictions) ([]*model.Group, *model.AppError) {
origCtx := a.ctx
span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.GetGroups")
@@ -6361,7 +6361,7 @@ func (a *OpenTracingAppLayer) GetGroups(page int, perPage int, opts model.GroupS
}()
defer span.Finish()
resultVar0, resultVar1 := a.app.GetGroups(page, perPage, opts)
resultVar0, resultVar1 := a.app.GetGroups(page, perPage, opts, viewRestrictions)
if resultVar1 != nil {
span.LogFields(spanlog.Error(resultVar1))
@@ -10801,7 +10801,7 @@ func (a *OpenTracingAppLayer) GetUsersNotInChannelPage(teamID string, channelID
return resultVar0, resultVar1
}
func (a *OpenTracingAppLayer) GetUsersNotInGroupPage(groupID string, page int, perPage int) ([]*model.User, *model.AppError) {
func (a *OpenTracingAppLayer) GetUsersNotInGroupPage(groupID string, page int, perPage int, viewRestrictions *model.ViewUsersRestrictions) ([]*model.User, *model.AppError) {
origCtx := a.ctx
span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.GetUsersNotInGroupPage")
@@ -10813,7 +10813,7 @@ func (a *OpenTracingAppLayer) GetUsersNotInGroupPage(groupID string, page int, p
}()
defer span.Finish()
resultVar0, resultVar1 := a.app.GetUsersNotInGroupPage(groupID, page, perPage)
resultVar0, resultVar1 := a.app.GetUsersNotInGroupPage(groupID, page, perPage, viewRestrictions)
if resultVar1 != nil {
span.LogFields(spanlog.Error(resultVar1))

4
app/plugin_api.go
Просмотреть файл

@@ -608,7 +608,7 @@ func (api *PluginAPI) DeleteChannelMember(channelID, userID string) *model.AppEr
}
func (api *PluginAPI) GetGroup(groupId string) (*model.Group, *model.AppError) {
return api.app.GetGroup(groupId, nil)
return api.app.GetGroup(groupId, nil, nil)
}
func (api *PluginAPI) GetGroupByName(name string) (*model.Group, *model.AppError) {
@@ -616,7 +616,7 @@ func (api *PluginAPI) GetGroupByName(name string) (*model.Group, *model.AppError
}
func (api *PluginAPI) GetGroupMemberUsers(groupID string, page, perPage int) ([]*model.User, *model.AppError) {
users, _, err := api.app.GetGroupMemberUsersPage(groupID, page, perPage)
users, _, err := api.app.GetGroupMemberUsersPage(groupID, page, perPage, nil)
return users, err
}