mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

Adding new "VIEW_MEMBERS" permissions restrict the scope of users visibility (#10487)

Просмотр исходного кода 
* MM-14138: Adding new "VIEW_MEMBERS" permissions restrict the scope of users visibility

* Fixing gofmt

* Fixing broken tests

* Addressing PR review comments from Miguel de la Cruz

* Removed hack

* A bit nicer and cleaner code in the UserBelongsToChannels function

* Adding cluster cache invalidation for user team ids

* Checking in the correct order permissions to not leek existency information

* Adding restrictions to TeamMembers and User status requests

* Fixing tests

* Fixing status endpoint permissions checks

* Adding more tests

* Fixing tests

* More tests and making the restrictions query based only on joins

* Adding more tests

* Adding more tests

* fixing merge problems

* Reverting status changes to avoid performance issues

* Adding more tests

* Fixing test

* i18n extract

* Adding extra method for get restrictions for a team

* Add the new elasticsearch functions to search users with restrictions

* Add missing translation string

* Rename restrictedChannelIds to restrictedToChannels

* Remove ToDo

* Adding the permission to the SystemAdmin role during permissions migrations
Этот коммит содержится в:
Jesús Espino
2019-04-29 16:56:56 +02:00
коммит произвёл GitHub
родитель 5b70962f71
Коммит c8920588a0
41 изменённых файлов: 2785 добавлений и 259 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

178
api4/user.go
Просмотреть файл

@@ -111,7 +111,16 @@ func getUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
// No permission check required
canSee, err := c.App.UserCanSeeOtherUser(c.App.Session.UserId, c.Params.UserId)
if err != nil {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
if !canSee {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
user, err := c.App.GetUser(c.Params.UserId)
if err != nil {
@@ -154,14 +163,32 @@ func getUserByUsername(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
// No permission check required
user, err := c.App.GetUserByUsername(c.Params.Username)
if err != nil {
restrictions, err2 := c.App.GetViewUsersRestrictions(c.App.Session.UserId)
if err2 != nil {
c.Err = err2
return
}
if restrictions != nil {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
c.Err = err
return
}
canSee, err := c.App.UserCanSeeOtherUser(c.App.Session.UserId, user.Id)
if err != nil {
c.Err = err
return
}
if !canSee {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
if c.IsSystemAdmin() || c.App.Session.UserId == user.Id {
userTermsOfService, err := c.App.GetUserTermsOfService(user.Id)
if err != nil && err.StatusCode != http.StatusNotFound {
@@ -196,8 +223,6 @@ func getUserByEmail(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
// No permission check required, but still prevent users who can't see another user's email address from using this
sanitizeOptions := c.App.GetSanitizeOptions(c.IsSystemAdmin())
if !sanitizeOptions["email"] {
c.Err = model.NewAppError("getUserByEmail", "api.user.get_user_by_email.permissions.app_error", nil, "userId="+c.App.Session.UserId, http.StatusForbidden)
@@ -206,10 +231,30 @@ func getUserByEmail(c *Context, w http.ResponseWriter, r *http.Request) {
user, err := c.App.GetUserByEmail(c.Params.Email)
if err != nil {
restrictions, err2 := c.App.GetViewUsersRestrictions(c.App.Session.UserId)
if err2 != nil {
c.Err = err2
return
}
if restrictions != nil {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
c.Err = err
return
}
canSee, err := c.App.UserCanSeeOtherUser(c.App.Session.UserId, user.Id)
if err != nil {
c.Err = err
return
}
if !canSee {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
etag := user.Etag(*c.App.Config().PrivacySettings.ShowFullName, *c.App.Config().PrivacySettings.ShowEmailAddress)
if c.HandleEtag(etag, "Get User", w, r) {
@@ -227,18 +272,23 @@ func getDefaultProfileImage(c *Context, w http.ResponseWriter, r *http.Request)
return
}
users, err := c.App.GetUsersByIds([]string{c.Params.UserId}, c.IsSystemAdmin())
canSee, err := c.App.UserCanSeeOtherUser(c.App.Session.UserId, c.Params.UserId)
if err != nil {
c.Err = err
return
}
if len(users) == 0 {
c.Err = model.NewAppError("getProfileImage", "api.user.get_profile_image.not_found.app_error", nil, "", http.StatusNotFound)
if !canSee {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
user, err := c.App.GetUser(c.Params.UserId)
if err != nil {
c.Err = err
return
}
user := users[0]
img, err := c.App.GetDefaultProfileImage(user)
if err != nil {
c.Err = err
@@ -256,18 +306,23 @@ func getProfileImage(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
users, err := c.App.GetUsersByIds([]string{c.Params.UserId}, c.IsSystemAdmin())
canSee, err := c.App.UserCanSeeOtherUser(c.App.Session.UserId, c.Params.UserId)
if err != nil {
c.Err = err
return
}
if len(users) == 0 {
c.Err = model.NewAppError("getProfileImage", "api.user.get_profile_image.not_found.app_error", nil, "", http.StatusNotFound)
if !canSee {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
user, err := c.App.GetUser(c.Params.UserId)
if err != nil {
c.Err = err
return
}
user := users[0]
etag := strconv.FormatInt(user.LastPictureUpdate, 10)
if c.HandleEtag(etag, "Get Profile Image", w, r) {
return
@@ -376,7 +431,13 @@ func getTotalUsersStats(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
stats, err := c.App.GetTotalUsersStats()
restrictions, err := c.App.GetViewUsersRestrictions(c.App.Session.UserId)
if err != nil {
c.Err = err
return
}
stats, err := c.App.GetTotalUsersStats(restrictions)
if err != nil {
c.Err = err
return
@@ -419,21 +480,27 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
withoutTeamBool, _ := strconv.ParseBool(withoutTeam)
inactiveBool, _ := strconv.ParseBool(inactive)
restrictions, err := c.App.GetViewUsersRestrictions(c.App.Session.UserId)
if err != nil {
c.Err = err
return
}
userGetOptions := &model.UserGetOptions{
InTeamId: inTeamId,
InChannelId: inChannelId,
NotInTeamId: notInTeamId,
NotInChannelId: notInChannelId,
WithoutTeam: withoutTeamBool,
Inactive: inactiveBool,
Role: role,
Sort: sort,
Page: c.Params.Page,
PerPage: c.Params.PerPage,
InTeamId: inTeamId,
InChannelId: inChannelId,
NotInTeamId: notInTeamId,
NotInChannelId: notInChannelId,
WithoutTeam: withoutTeamBool,
Inactive: inactiveBool,
Role: role,
Sort: sort,
Page: c.Params.Page,
PerPage: c.Params.PerPage,
ViewRestrictions: restrictions,
}
var profiles []*model.User
var err *model.AppError
etag := ""
if withoutTeamBool, _ := strconv.ParseBool(withoutTeam); withoutTeamBool {
@@ -443,26 +510,26 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
profiles, err = c.App.GetUsersWithoutTeamPage(c.Params.Page, c.Params.PerPage, c.IsSystemAdmin())
profiles, err = c.App.GetUsersWithoutTeamPage(c.Params.Page, c.Params.PerPage, c.IsSystemAdmin(), restrictions)
} else if len(notInChannelId) > 0 {
if !c.App.SessionHasPermissionToChannel(c.App.Session, notInChannelId, model.PERMISSION_READ_CHANNEL) {
c.SetPermissionError(model.PERMISSION_READ_CHANNEL)
return
}
profiles, err = c.App.GetUsersNotInChannelPage(inTeamId, notInChannelId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin())
profiles, err = c.App.GetUsersNotInChannelPage(inTeamId, notInChannelId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin(), restrictions)
} else if len(notInTeamId) > 0 {
if !c.App.SessionHasPermissionToTeam(c.App.Session, notInTeamId, model.PERMISSION_VIEW_TEAM) {
c.SetPermissionError(model.PERMISSION_VIEW_TEAM)
return
}
etag = c.App.GetUsersNotInTeamEtag(inTeamId)
etag = c.App.GetUsersNotInTeamEtag(inTeamId, restrictions.Hash())
if c.HandleEtag(etag, "Get Users Not in Team", w, r) {
return
}
profiles, err = c.App.GetUsersNotInTeamPage(notInTeamId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin())
profiles, err = c.App.GetUsersNotInTeamPage(notInTeamId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin(), restrictions)
} else if len(inTeamId) > 0 {
if !c.App.SessionHasPermissionToTeam(c.App.Session, inTeamId, model.PERMISSION_VIEW_TEAM) {
c.SetPermissionError(model.PERMISSION_VIEW_TEAM)
@@ -470,11 +537,11 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
}
if sort == "last_activity_at" {
profiles, err = c.App.GetRecentlyActiveUsersForTeamPage(inTeamId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin())
profiles, err = c.App.GetRecentlyActiveUsersForTeamPage(inTeamId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin(), restrictions)
} else if sort == "create_at" {
profiles, err = c.App.GetNewUsersForTeamPage(inTeamId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin())
profiles, err = c.App.GetNewUsersForTeamPage(inTeamId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin(), restrictions)
} else {
etag = c.App.GetUsersInTeamEtag(inTeamId)
etag = c.App.GetUsersInTeamEtag(inTeamId, restrictions.Hash())
if c.HandleEtag(etag, "Get Users in Team", w, r) {
return
}
@@ -491,12 +558,16 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
profiles, err = c.App.GetUsersInChannelPage(inChannelId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin())
}
} else {
// No permission check required
etag = c.App.GetUsersEtag()
etag = c.App.GetUsersEtag(restrictions.Hash())
if c.HandleEtag(etag, "Get Users", w, r) {
return
}
userGetOptions, err = c.App.RestrictUsersGetByPermissions(c.App.Session.UserId, userGetOptions)
if err != nil {
c.Err = err
return
}
profiles, err = c.App.GetUsersPage(userGetOptions, c.IsSystemAdmin())
}
@@ -520,9 +591,13 @@ func getUsersByIds(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
// No permission check required
restrictions, err := c.App.GetViewUsersRestrictions(c.App.Session.UserId)
if err != nil {
c.Err = err
return
}
users, err := c.App.GetUsersByIds(userIds, c.IsSystemAdmin())
users, err := c.App.GetUsersByIds(userIds, c.IsSystemAdmin(), restrictions)
if err != nil {
c.Err = err
return
@@ -539,9 +614,13 @@ func getUsersByNames(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
// No permission check required
restrictions, err := c.App.GetViewUsersRestrictions(c.App.Session.UserId)
if err != nil {
c.Err = err
return
}
users, err := c.App.GetUsersByUsernames(usernames, c.IsSystemAdmin())
users, err := c.App.GetUsersByUsernames(usernames, c.IsSystemAdmin(), restrictions)
if err != nil {
c.Err = err
return
@@ -607,6 +686,12 @@ func searchUsers(c *Context, w http.ResponseWriter, r *http.Request) {
options.AllowFullNames = *c.App.Config().PrivacySettings.ShowFullName
}
options, err := c.App.RestrictUsersSearchByPermissions(c.App.Session.UserId, options)
if err != nil {
c.Err = err
return
}
profiles, err := c.App.SearchUsers(props, options)
if err != nil {
c.Err = err
@@ -670,6 +755,13 @@ func autocompleteUsers(c *Context, w http.ResponseWriter, r *http.Request) {
autocomplete.Users = result.InChannel
autocomplete.OutOfChannel = result.OutOfChannel
} else if len(teamId) > 0 {
var err *model.AppError
options, err = c.App.RestrictUsersSearchByPermissions(c.App.Session.UserId, options)
if err != nil {
c.Err = err
return
}
result, err := c.App.AutocompleteUsersInTeam(teamId, name, options)
if err != nil {
c.Err = err
@@ -678,7 +770,13 @@ func autocompleteUsers(c *Context, w http.ResponseWriter, r *http.Request) {
autocomplete.Users = result.InTeam
} else {
// No permission check required
var err *model.AppError
options, err = c.App.RestrictUsersSearchByPermissions(c.App.Session.UserId, options)
if err != nil {
c.Err = err
return
}
result, err := c.App.SearchUsersInTeam("", name, options)
if err != nil {
c.Err = err