From f6fef9362bf05491d8ec959f7dae53f4ebef79a6 Mon Sep 17 00:00:00 2001 From: Allan Guwatudde Date: Mon, 7 Mar 2022 18:58:43 +0300 Subject: [PATCH] Fix MM-42270 (#19692) * [MM-42270] - Fix MM-42270 * clean test code Co-authored-by: Mattermod --- api4/system.go | 5 +++++ api4/system_test.go | 14 ++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/api4/system.go b/api4/system.go index a1d6b10be4..398913c27d 100644 --- a/api4/system.go +++ b/api4/system.go @@ -76,6 +76,11 @@ func generateSupportPacket(c *Context, w http.ResponseWriter, r *http.Request) { const FileMime = "application/zip" const OutputDirectory = "support_packet" + if *c.App.Config().ExperimentalSettings.RestrictSystemAdmin { + c.Err = model.NewAppError("generateSupportPacket", "api.restricted_system_admin", nil, "", http.StatusForbidden) + return + } + // Checking to see if the user is a admin of any sort or not // If they are a admin, they should theoretically have access to one or more of the system console read permissions if !c.App.SessionHasPermissionToAny(*c.AppContext.Session(), model.SysconsoleReadPermissions) { diff --git a/api4/system_test.go b/api4/system_test.go index 68d502e4a7..aeddc477c6 100644 --- a/api4/system_test.go +++ b/api4/system_test.go @@ -208,6 +208,20 @@ func TestGenerateSupportPacket(t *testing.T) { require.NotZero(t, len(file)) }) + t.Run("As a System Administrator but with RestrictSystemAdmin true", func(t *testing.T) { + originalRestrictSystemAdminVal := *th.App.Config().ExperimentalSettings.RestrictSystemAdmin + th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ExperimentalSettings.RestrictSystemAdmin = true }) + defer func() { + th.App.UpdateConfig(func(cfg *model.Config) { + *cfg.ExperimentalSettings.RestrictSystemAdmin = originalRestrictSystemAdminVal + }) + }() + + _, resp, err := th.SystemAdminClient.GenerateSupportPacket() + require.Error(t, err) + CheckForbiddenStatus(t, resp) + }) + t.Run("As a Regular User", func(t *testing.T) { _, resp, err := th.Client.GenerateSupportPacket() require.Error(t, err)