Not allowing to use team invite links by guest accounts (#12608)

* Not allowing to use team invite links by guest accounts

* Adding needed tests

* Updating error text

api4/team.go

@@ -499,6 +499,11 @@ func addUserToTeamFromInvite(c *Context, w http.ResponseWriter, r *http.Request)
 	var member *model.TeamMember
 	var err *model.AppError
 
+	if c.App.Session.Props[model.SESSION_PROP_IS_GUEST] == "true" {
+		c.Err = model.NewAppError("addUserToTeamFromInvite", "api.team.add_user_to_team_from_invite.guest.app_error", nil, "", http.StatusForbidden)
+		return
+	}
+
 	if len(tokenId) > 0 {
 		member, err = c.App.AddTeamMemberByToken(c.App.Session.UserId, tokenId)
 	} else if len(inviteId) > 0 {

api4/team_test.go

@@ -1359,13 +1359,26 @@ func TestAddTeamMember(t *testing.T) {
 	team := th.BasicTeam
 	otherUser := th.CreateUser()
 
+	th.App.SetLicense(model.NewTestLicense(""))
+	defer th.App.SetLicense(nil)
+
+	enableGuestAccounts := *th.App.Config().GuestAccountsSettings.Enable
+	defer func() {
+		th.App.UpdateConfig(func(cfg *model.Config) { cfg.GuestAccountsSettings.Enable = &enableGuestAccounts })
+	}()
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.GuestAccountsSettings.Enable = true })
+
+	guest := th.CreateUser()
+	_, resp := th.SystemAdminClient.DemoteUserToGuest(guest.Id)
+	CheckNoError(t, resp)
+
 	if err := th.App.RemoveUserFromTeam(th.BasicTeam.Id, th.BasicUser2.Id, ""); err != nil {
 		t.Fatalf(err.Error())
 	}
 
 	// Regular user can't add a member to a team they don't belong to.
 	th.LoginBasic2()
-	_, resp := Client.AddTeamMember(team.Id, otherUser.Id)
+	_, resp = Client.AddTeamMember(team.Id, otherUser.Id)
 	CheckForbiddenStatus(t, resp)
 	if resp.Error == nil {
 		t.Fatalf("Error is nil")
@@ -1506,6 +1519,15 @@ func TestAddTeamMember(t *testing.T) {
 	CheckNotFoundStatus(t, resp)
 	th.App.DeleteToken(token)
 
+	// by invite_id
+	th.App.SetLicense(model.NewTestLicense(""))
+	defer th.App.SetLicense(nil)
+	_, resp = Client.Login(guest.Email, guest.Password)
+	CheckNoError(t, resp)
+
+	tm, resp = Client.AddTeamMemberFromInvite("", team.InviteId)
+	CheckForbiddenStatus(t, resp)
+
 	// by invite_id
 	Client.Login(otherUser.Email, otherUser.Password)
 

i18n/en.json

@@ -1874,6 +1874,10 @@
     "id": "api.team.add_user_to_team.missing_parameter.app_error",
     "translation": "Parameter required to add user to team."
   },
+  {
+    "id": "api.team.add_user_to_team_from_invite.guest.app_error",
+    "translation": "Guests are restricted from joining a team with a invite link. Please request a guest email invitation to the team."
+  },
   {
     "id": "api.team.demote_user_to_guest.disabled.error",
     "translation": "Guest accounts are disabled."