MM-14722 - Don't let bots create other bot accounts (#10808)

api4/bot.go

@@ -36,6 +36,13 @@ func createBot(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if user, err := c.App.GetUser(c.App.Session.UserId); err == nil {
+		if user.IsBot {
+			c.SetPermissionError(model.PERMISSION_CREATE_BOT)
+			return
+		}
+	}
+
 	if !*c.App.Config().ServiceSettings.CreateBotAccounts {
 		c.Err = model.NewAppError("createBot", "api.bot.create_disabled", nil, "", http.StatusForbidden)
 		return
@@ -195,6 +202,13 @@ func assignBot(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if user, err := c.App.GetUser(userId); err == nil {
+		if user.IsBot {
+			c.SetPermissionError(model.PERMISSION_ASSIGN_BOT)
+			return
+		}
+	}
+
 	bot, err := c.App.UpdateBotOwner(botUserId, userId)
 	if err != nil {
 		c.Err = err