From ee007962f4ca859d0ab1329049e3f92d9b78eeef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jes=C3=BAs=20Espino?= <jespinog@gmail.com>
Date: Wed, 31 Jul 2019 18:37:28 +0200
Subject: [PATCH] Restrict the creation of dms/gms to user that you can see
 (#11695)

* Restrict the creation of dms/gms to user that you can see

* Adding tests

* Adding tests for CreateGroupChannel api endpoint
---
 api4/channel.go      |  35 ++++++++++++++
 api4/channel_test.go | 106 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 141 insertions(+)

diff --git a/api4/channel.go b/api4/channel.go
index 46ac40de74..bc7bb9c0b5 100644
--- a/api4/channel.go
+++ b/api4/channel.go
@@ -347,6 +347,22 @@ func createDirectChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	otherUserId := userIds[0]
+	if c.App.Session.UserId == otherUserId {
+		otherUserId = userIds[1]
+	}
+
+	canSee, err := c.App.UserCanSeeOtherUser(c.App.Session.UserId, otherUserId)
+	if err != nil {
+		c.Err = err
+		return
+	}
+
+	if !canSee {
+		c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
+		return
+	}
+
 	sc, err := c.App.GetOrCreateDirectChannel(userIds[0], userIds[1])
 	if err != nil {
 		c.Err = err
@@ -401,6 +417,25 @@ func createGroupChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	canSeeAll := true
+	for _, id := range userIds {
+		if c.App.Session.UserId != id {
+			canSee, err := c.App.UserCanSeeOtherUser(c.App.Session.UserId, id)
+			if err != nil {
+				c.Err = err
+				return
+			}
+			if !canSee {
+				canSeeAll = false
+			}
+		}
+	}
+
+	if !canSeeAll {
+		c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
+		return
+	}
+
 	groupChannel, err := c.App.CreateGroupChannel(userIds, c.App.Session.UserId)
 	if err != nil {
 		c.Err = err
diff --git a/api4/channel_test.go b/api4/channel_test.go
index 1f6933bd23..8473f8c587 100644
--- a/api4/channel_test.go
+++ b/api4/channel_test.go
@@ -407,6 +407,51 @@ func TestCreateDirectChannel(t *testing.T) {
 	CheckNoError(t, resp)
 }
 
+func TestCreateDirectChannelAsGuest(t *testing.T) {
+	th := Setup().InitBasic()
+	defer th.TearDown()
+	Client := th.Client
+	user1 := th.BasicUser
+
+	enableGuestAccounts := *th.App.Config().GuestAccountsSettings.Enable
+	defer func() {
+		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.GuestAccountsSettings.Enable = enableGuestAccounts })
+		th.App.RemoveLicense()
+	}()
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.GuestAccountsSettings.Enable = true })
+	th.App.SetLicense(model.NewTestLicense())
+
+	id := model.NewId()
+	guest := &model.User{
+		Email:         "success+" + id + "@simulator.amazonses.com",
+		Username:      "un_" + id,
+		Nickname:      "nn_" + id,
+		Password:      "Password1",
+		EmailVerified: true,
+	}
+	guest, err := th.App.CreateGuest(guest)
+	require.Nil(t, err)
+
+	_, resp := Client.Login(guest.Username, "Password1")
+	CheckNoError(t, resp)
+
+	t.Run("Try to created DM with not visible user", func(t *testing.T) {
+		_, resp := Client.CreateDirectChannel(guest.Id, user1.Id)
+		CheckForbiddenStatus(t, resp)
+
+		_, resp = Client.CreateDirectChannel(user1.Id, guest.Id)
+		CheckForbiddenStatus(t, resp)
+	})
+
+	t.Run("Creating DM with visible user", func(t *testing.T) {
+		th.LinkUserToTeam(guest, th.BasicTeam)
+		th.AddUserToChannel(guest, th.BasicChannel)
+
+		_, resp := Client.CreateDirectChannel(guest.Id, user1.Id)
+		CheckNoError(t, resp)
+	})
+}
+
 func TestDeleteDirectChannel(t *testing.T) {
 	th := Setup().InitBasic()
 	defer th.TearDown()
@@ -496,6 +541,67 @@ func TestCreateGroupChannel(t *testing.T) {
 	CheckNoError(t, resp)
 }
 
+func TestCreateGroupChannelAsGuest(t *testing.T) {
+	th := Setup().InitBasic()
+	defer th.TearDown()
+	Client := th.Client
+	user1 := th.BasicUser
+	user2 := th.BasicUser2
+	user3 := th.CreateUser()
+	user4 := th.CreateUser()
+	user5 := th.CreateUser()
+	th.LinkUserToTeam(user2, th.BasicTeam)
+	th.AddUserToChannel(user2, th.BasicChannel)
+	th.LinkUserToTeam(user3, th.BasicTeam)
+	th.AddUserToChannel(user3, th.BasicChannel)
+
+	enableGuestAccounts := *th.App.Config().GuestAccountsSettings.Enable
+	defer func() {
+		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.GuestAccountsSettings.Enable = enableGuestAccounts })
+		th.App.RemoveLicense()
+	}()
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.GuestAccountsSettings.Enable = true })
+	th.App.SetLicense(model.NewTestLicense())
+
+	id := model.NewId()
+	guest := &model.User{
+		Email:         "success+" + id + "@simulator.amazonses.com",
+		Username:      "un_" + id,
+		Nickname:      "nn_" + id,
+		Password:      "Password1",
+		EmailVerified: true,
+	}
+	guest, err := th.App.CreateGuest(guest)
+	require.Nil(t, err)
+
+	_, resp := Client.Login(guest.Username, "Password1")
+	CheckNoError(t, resp)
+
+	t.Run("Try to created GM with not visible users", func(t *testing.T) {
+		_, resp := Client.CreateGroupChannel([]string{guest.Id, user1.Id, user2.Id, user3.Id})
+		CheckForbiddenStatus(t, resp)
+
+		_, resp = Client.CreateGroupChannel([]string{user1.Id, user2.Id, guest.Id, user3.Id})
+		CheckForbiddenStatus(t, resp)
+	})
+
+	t.Run("Try to created GM with visible and not visible users", func(t *testing.T) {
+		th.LinkUserToTeam(guest, th.BasicTeam)
+		th.AddUserToChannel(guest, th.BasicChannel)
+
+		_, resp := Client.CreateGroupChannel([]string{guest.Id, user1.Id, user3.Id, user4.Id, user5.Id})
+		CheckForbiddenStatus(t, resp)
+
+		_, resp = Client.CreateGroupChannel([]string{user1.Id, user2.Id, guest.Id, user4.Id, user5.Id})
+		CheckForbiddenStatus(t, resp)
+	})
+
+	t.Run("Creating GM with visible users", func(t *testing.T) {
+		_, resp := Client.CreateGroupChannel([]string{guest.Id, user1.Id, user2.Id, user3.Id})
+		CheckNoError(t, resp)
+	})
+}
+
 func TestDeleteGroupChannel(t *testing.T) {
 	th := Setup().InitBasic()
 	defer th.TearDown()