From eabae5437bed3fcc14cf4f841d673050f9a0ead3 Mon Sep 17 00:00:00 2001 From: Ashish Bhate Date: Wed, 8 Jul 2020 16:59:16 +0530 Subject: [PATCH] MM-26015: ensure admin retains permissions to team after being removed from a team (#14961) Summary: Ensure admin retains permissions to team after being removed from a team Ticket Link: https://mattermost.atlassian.net/browse/MM-26015 --- app/authorization.go | 19 +++---------------- app/authorization_test.go | 6 ++++++ 2 files changed, 9 insertions(+), 16 deletions(-) diff --git a/app/authorization.go b/app/authorization.go index 63c5721460..4218823bf1 100644 --- a/app/authorization.go +++ b/app/authorization.go @@ -146,23 +146,10 @@ func (a *App) HasPermissionToTeam(askingUserId string, teamId string, permission if teamId == "" || askingUserId == "" { return false } - - teamMember, err := a.GetTeamMember(teamId, askingUserId) - if err != nil { - return false + teamMember, _ := a.GetTeamMember(teamId, askingUserId) + if teamMember != nil && teamMember.DeleteAt == 0 { + return a.RolesGrantPermission(teamMember.GetRoles(), permission.Id) } - - // If the team member has been deleted, they don't have permission. - if teamMember.DeleteAt != 0 { - return false - } - - roles := teamMember.GetRoles() - - if a.RolesGrantPermission(roles, permission.Id) { - return true - } - return a.HasPermissionTo(askingUserId, permission) } diff --git a/app/authorization_test.go b/app/authorization_test.go index a0969e07fc..23af424d72 100644 --- a/app/authorization_test.go +++ b/app/authorization_test.go @@ -52,4 +52,10 @@ func TestHasPermissionToTeam(t *testing.T) { th.RemoveUserFromTeam(th.BasicUser, th.BasicTeam) assert.False(t, th.App.HasPermissionToTeam(th.BasicUser.Id, th.BasicTeam.Id, model.PERMISSION_LIST_TEAM_CHANNELS)) + + th.LinkUserToTeam(th.SystemAdminUser, th.BasicTeam) + assert.True(t, th.App.HasPermissionToTeam(th.SystemAdminUser.Id, th.BasicTeam.Id, model.PERMISSION_LIST_TEAM_CHANNELS)) + th.RemoveUserFromTeam(th.SystemAdminUser, th.BasicTeam) + // This used to fail before MM-26015 + assert.True(t, th.App.HasPermissionToTeam(th.SystemAdminUser.Id, th.BasicTeam.Id, model.PERMISSION_LIST_TEAM_CHANNELS)) }