Merge remote-tracking branch 'origin/master' into advanced-permissions-phase-2

2018-05-15 07:45:28 -04:00
--- a/web/context.go
+++ b/web/context.go
@@ -0,0 +1,510 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See License.txt for license information.
+
+package web
+
+import (
+	"fmt"
+	"net/http"
+	"regexp"
+	"strings"
+
+	goi18n "github.com/nicksnyder/go-i18n/i18n"
+
+	"github.com/mattermost/mattermost-server/app"
+	"github.com/mattermost/mattermost-server/mlog"
+	"github.com/mattermost/mattermost-server/model"
+	"github.com/mattermost/mattermost-server/utils"
+)
+
+type Context struct {
+	App           *app.App
+	Session       model.Session
+	Params        *Params
+	Err           *model.AppError
+	T             goi18n.TranslateFunc
+	RequestId     string
+	IpAddress     string
+	Path          string
+	siteURLHeader string
+}
+
+func (c *Context) LogAudit(extraInfo string) {
+	audit := &model.Audit{UserId: c.Session.UserId, IpAddress: c.IpAddress, Action: c.Path, ExtraInfo: extraInfo, SessionId: c.Session.Id}
+	if r := <-c.App.Srv.Store.Audit().Save(audit); r.Err != nil {
+		c.LogError(r.Err)
+	}
+}
+
+func (c *Context) LogAuditWithUserId(userId, extraInfo string) {
+
+	if len(c.Session.UserId) > 0 {
+		extraInfo = strings.TrimSpace(extraInfo + " session_user=" + c.Session.UserId)
+	}
+
+	audit := &model.Audit{UserId: userId, IpAddress: c.IpAddress, Action: c.Path, ExtraInfo: extraInfo, SessionId: c.Session.Id}
+	if r := <-c.App.Srv.Store.Audit().Save(audit); r.Err != nil {
+		c.LogError(r.Err)
+	}
+}
+
+func (c *Context) LogError(err *model.AppError) {
+
+	// Filter out 404s, endless reconnects and browser compatibility errors
+	if err.StatusCode == http.StatusNotFound ||
+		(c.Path == "/api/v3/users/websocket" && err.StatusCode == 401) ||
+		err.Id == "web.check_browser_compatibility.app_error" {
+		c.LogDebug(err)
+	} else {
+		mlog.Error(fmt.Sprintf("%v:%v code=%v rid=%v uid=%v ip=%v %v [details: %v]", c.Path, err.Where, err.StatusCode,
+			c.RequestId, c.Session.UserId, c.IpAddress, err.SystemMessage(utils.TDefault), err.DetailedError), mlog.String("user_id", c.Session.UserId))
+	}
+}
+
+func (c *Context) LogInfo(err *model.AppError) {
+	mlog.Info(fmt.Sprintf("%v:%v code=%v rid=%v uid=%v ip=%v %v [details: %v]", c.Path, err.Where, err.StatusCode,
+		c.RequestId, c.Session.UserId, c.IpAddress, err.SystemMessage(utils.TDefault), err.DetailedError), mlog.String("user_id", c.Session.UserId))
+}
+
+func (c *Context) LogDebug(err *model.AppError) {
+	mlog.Debug(fmt.Sprintf("%v:%v code=%v rid=%v uid=%v ip=%v %v [details: %v]", c.Path, err.Where, err.StatusCode,
+		c.RequestId, c.Session.UserId, c.IpAddress, err.SystemMessage(utils.TDefault), err.DetailedError), mlog.String("user_id", c.Session.UserId))
+}
+
+func (c *Context) IsSystemAdmin() bool {
+	return c.App.SessionHasPermissionTo(c.Session, model.PERMISSION_MANAGE_SYSTEM)
+}
+
+func (c *Context) SessionRequired() {
+	if !*c.App.Config().ServiceSettings.EnableUserAccessTokens && c.Session.Props[model.SESSION_PROP_TYPE] == model.SESSION_TYPE_USER_ACCESS_TOKEN {
+		c.Err = model.NewAppError("", "api.context.session_expired.app_error", nil, "UserAccessToken", http.StatusUnauthorized)
+		return
+	}
+
+	if len(c.Session.UserId) == 0 {
+		c.Err = model.NewAppError("", "api.context.session_expired.app_error", nil, "UserRequired", http.StatusUnauthorized)
+		return
+	}
+}
+
+func (c *Context) MfaRequired() {
+	// Must be licensed for MFA and have it configured for enforcement
+	if license := c.App.License(); license == nil || !*license.Features.MFA || !*c.App.Config().ServiceSettings.EnableMultifactorAuthentication || !*c.App.Config().ServiceSettings.EnforceMultifactorAuthentication {
+		return
+	}
+
+	// OAuth integrations are excepted
+	if c.Session.IsOAuth {
+		return
+	}
+
+	if user, err := c.App.GetUser(c.Session.UserId); err != nil {
+		c.Err = model.NewAppError("", "api.context.session_expired.app_error", nil, "MfaRequired", http.StatusUnauthorized)
+		return
+	} else {
+		// Only required for email and ldap accounts
+		if user.AuthService != "" &&
+			user.AuthService != model.USER_AUTH_SERVICE_EMAIL &&
+			user.AuthService != model.USER_AUTH_SERVICE_LDAP {
+			return
+		}
+
+		// Special case to let user get themself
+		if c.Path == "/api/v4/users/me" {
+			return
+		}
+
+		if !user.MfaActive {
+			c.Err = model.NewAppError("", "api.context.mfa_required.app_error", nil, "MfaRequired", http.StatusForbidden)
+			return
+		}
+	}
+}
+
+func (c *Context) RemoveSessionCookie(w http.ResponseWriter, r *http.Request) {
+	cookie := &http.Cookie{
+		Name:     model.SESSION_COOKIE_TOKEN,
+		Value:    "",
+		Path:     "/",
+		MaxAge:   -1,
+		HttpOnly: true,
+	}
+
+	http.SetCookie(w, cookie)
+}
+
+func (c *Context) SetInvalidParam(parameter string) {
+	c.Err = NewInvalidParamError(parameter)
+}
+
+func (c *Context) SetInvalidUrlParam(parameter string) {
+	c.Err = NewInvalidUrlParamError(parameter)
+}
+
+func (c *Context) HandleEtag(etag string, routeName string, w http.ResponseWriter, r *http.Request) bool {
+	metrics := c.App.Metrics
+	if et := r.Header.Get(model.HEADER_ETAG_CLIENT); len(etag) > 0 {
+		if et == etag {
+			w.Header().Set(model.HEADER_ETAG_SERVER, etag)
+			w.WriteHeader(http.StatusNotModified)
+			if metrics != nil {
+				metrics.IncrementEtagHitCounter(routeName)
+			}
+			return true
+		}
+	}
+
+	if metrics != nil {
+		metrics.IncrementEtagMissCounter(routeName)
+	}
+
+	return false
+}
+
+func NewInvalidParamError(parameter string) *model.AppError {
+	err := model.NewAppError("Context", "api.context.invalid_body_param.app_error", map[string]interface{}{"Name": parameter}, "", http.StatusBadRequest)
+	return err
+}
+func NewInvalidUrlParamError(parameter string) *model.AppError {
+	err := model.NewAppError("Context", "api.context.invalid_url_param.app_error", map[string]interface{}{"Name": parameter}, "", http.StatusBadRequest)
+	return err
+}
+
+func (c *Context) SetPermissionError(permission *model.Permission) {
+	c.Err = model.NewAppError("Permissions", "api.context.permissions.app_error", nil, "userId="+c.Session.UserId+", "+"permission="+permission.Id, http.StatusForbidden)
+}
+
+func (c *Context) SetSiteURLHeader(url string) {
+	c.siteURLHeader = strings.TrimRight(url, "/")
+}
+
+func (c *Context) GetSiteURLHeader() string {
+	return c.siteURLHeader
+}
+
+func (c *Context) RequireUserId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if c.Params.UserId == model.ME {
+		c.Params.UserId = c.Session.UserId
+	}
+
+	if len(c.Params.UserId) != 26 {
+		c.SetInvalidUrlParam("user_id")
+	}
+	return c
+}
+
+func (c *Context) RequireTeamId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.TeamId) != 26 {
+		c.SetInvalidUrlParam("team_id")
+	}
+	return c
+}
+
+func (c *Context) RequireInviteId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.InviteId) == 0 {
+		c.SetInvalidUrlParam("invite_id")
+	}
+	return c
+}
+
+func (c *Context) RequireTokenId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.TokenId) != 26 {
+		c.SetInvalidUrlParam("token_id")
+	}
+	return c
+}
+
+func (c *Context) RequireChannelId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.ChannelId) != 26 {
+		c.SetInvalidUrlParam("channel_id")
+	}
+	return c
+}
+
+func (c *Context) RequireUsername() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if !model.IsValidUsername(c.Params.Username) {
+		c.SetInvalidParam("username")
+	}
+
+	return c
+}
+
+func (c *Context) RequirePostId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.PostId) != 26 {
+		c.SetInvalidUrlParam("post_id")
+	}
+	return c
+}
+
+func (c *Context) RequireAppId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.AppId) != 26 {
+		c.SetInvalidUrlParam("app_id")
+	}
+	return c
+}
+
+func (c *Context) RequireFileId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.FileId) != 26 {
+		c.SetInvalidUrlParam("file_id")
+	}
+
+	return c
+}
+
+func (c *Context) RequireFilename() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.Filename) == 0 {
+		c.SetInvalidUrlParam("filename")
+	}
+
+	return c
+}
+
+func (c *Context) RequirePluginId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.PluginId) == 0 {
+		c.SetInvalidUrlParam("plugin_id")
+	}
+
+	return c
+}
+
+func (c *Context) RequireReportId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.ReportId) != 26 {
+		c.SetInvalidUrlParam("report_id")
+	}
+	return c
+}
+
+func (c *Context) RequireEmojiId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.EmojiId) != 26 {
+		c.SetInvalidUrlParam("emoji_id")
+	}
+	return c
+}
+
+func (c *Context) RequireTeamName() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if !model.IsValidTeamName(c.Params.TeamName) {
+		c.SetInvalidUrlParam("team_name")
+	}
+
+	return c
+}
+
+func (c *Context) RequireChannelName() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if !model.IsValidChannelIdentifier(c.Params.ChannelName) {
+		c.SetInvalidUrlParam("channel_name")
+	}
+
+	return c
+}
+
+func (c *Context) RequireEmail() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if !model.IsValidEmail(c.Params.Email) {
+		c.SetInvalidUrlParam("email")
+	}
+
+	return c
+}
+
+func (c *Context) RequireCategory() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if !model.IsValidAlphaNumHyphenUnderscore(c.Params.Category, true) {
+		c.SetInvalidUrlParam("category")
+	}
+
+	return c
+}
+
+func (c *Context) RequireService() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.Service) == 0 {
+		c.SetInvalidUrlParam("service")
+	}
+
+	return c
+}
+
+func (c *Context) RequirePreferenceName() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if !model.IsValidAlphaNumHyphenUnderscore(c.Params.PreferenceName, true) {
+		c.SetInvalidUrlParam("preference_name")
+	}
+
+	return c
+}
+
+func (c *Context) RequireEmojiName() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	validName := regexp.MustCompile(`^[a-zA-Z0-9\-\+_]+$`)
+
+	if len(c.Params.EmojiName) == 0 || len(c.Params.EmojiName) > model.EMOJI_NAME_MAX_LENGTH || !validName.MatchString(c.Params.EmojiName) {
+		c.SetInvalidUrlParam("emoji_name")
+	}
+
+	return c
+}
+
+func (c *Context) RequireHookId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.HookId) != 26 {
+		c.SetInvalidUrlParam("hook_id")
+	}
+
+	return c
+}
+
+func (c *Context) RequireCommandId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.CommandId) != 26 {
+		c.SetInvalidUrlParam("command_id")
+	}
+	return c
+}
+
+func (c *Context) RequireJobId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.JobId) != 26 {
+		c.SetInvalidUrlParam("job_id")
+	}
+	return c
+}
+
+func (c *Context) RequireJobType() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.JobType) == 0 || len(c.Params.JobType) > 32 {
+		c.SetInvalidUrlParam("job_type")
+	}
+	return c
+}
+
+func (c *Context) RequireActionId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.ActionId) != 26 {
+		c.SetInvalidUrlParam("action_id")
+	}
+	return c
+}
+
+func (c *Context) RequireRoleId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.RoleId) != 26 {
+		c.SetInvalidUrlParam("role_id")
+	}
+	return c
+}
+
+func (c *Context) RequireSchemeId() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if len(c.Params.SchemeId) != 26 {
+		c.SetInvalidUrlParam("scheme_id")
+	}
+	return c
+}
+
+func (c *Context) RequireRoleName() *Context {
+	if c.Err != nil {
+		return c
+	}
+
+	if !model.IsValidRoleName(c.Params.RoleName) {
+		c.SetInvalidUrlParam("role_name")
+	}
+
+	return c
+}
--- a/web/context_test.go
+++ b/web/context_test.go
@@ -0,0 +1,31 @@
+package web
+
+import (
+	"net/http"
+	"testing"
+)
+
+func TestRequireHookId(t *testing.T) {
+	c := &Context{}
+	t.Run("WhenHookIdIsValid", func(t *testing.T) {
+		c.Params = &Params{HookId: "abcdefghijklmnopqrstuvwxyz"}
+		c.RequireHookId()
+
+		if c.Err != nil {
+			t.Fatal("Hook Id is Valid. Should not have set error in context")
+		}
+	})
+
+	t.Run("WhenHookIdIsInvalid", func(t *testing.T) {
+		c.Params = &Params{HookId: "abc"}
+		c.RequireHookId()
+
+		if c.Err == nil {
+			t.Fatal("Should have set Error in context")
+		}
+
+		if c.Err.StatusCode != http.StatusBadRequest {
+			t.Fatal("Should have set status as 400")
+		}
+	})
+}
--- a/web/handlers.go
+++ b/web/handlers.go
@@ -0,0 +1,158 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See License.txt for license information.
+
+package web
+
+import (
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/mattermost/mattermost-server/app"
+	"github.com/mattermost/mattermost-server/mlog"
+	"github.com/mattermost/mattermost-server/model"
+	"github.com/mattermost/mattermost-server/utils"
+)
+
+func (w *Web) NewHandler(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
+	return &Handler{
+		App:            w.App,
+		HandleFunc:     h,
+		RequireSession: false,
+		TrustRequester: false,
+		RequireMfa:     false,
+		IsStatic:       false,
+	}
+}
+
+func (w *Web) NewStaticHandler(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
+	return &Handler{
+		App:            w.App,
+		HandleFunc:     h,
+		RequireSession: false,
+		TrustRequester: false,
+		RequireMfa:     false,
+		IsStatic:       true,
+	}
+}
+
+type Handler struct {
+	App            *app.App
+	HandleFunc     func(*Context, http.ResponseWriter, *http.Request)
+	RequireSession bool
+	TrustRequester bool
+	RequireMfa     bool
+	IsStatic       bool
+}
+
+func (h Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	now := time.Now()
+	mlog.Debug(fmt.Sprintf("%v - %v", r.Method, r.URL.Path))
+
+	c := &Context{}
+	c.App = h.App
+	c.T, _ = utils.GetTranslationsAndLocale(w, r)
+	c.RequestId = model.NewId()
+	c.IpAddress = utils.GetIpAddress(r)
+	c.Params = ParamsFromRequest(r)
+
+	token, tokenLocation := app.ParseAuthTokenFromRequest(r)
+
+	// CSRF Check
+	if tokenLocation == app.TokenLocationCookie && h.RequireSession && !h.TrustRequester {
+		if r.Header.Get(model.HEADER_REQUESTED_WITH) != model.HEADER_REQUESTED_WITH_XML {
+			c.Err = model.NewAppError("ServeHTTP", "api.context.session_expired.app_error", nil, "token="+token+" Appears to be a CSRF attempt", http.StatusUnauthorized)
+			token = ""
+		}
+	}
+
+	c.SetSiteURLHeader(app.GetProtocol(r) + "://" + r.Host)
+
+	w.Header().Set(model.HEADER_REQUEST_ID, c.RequestId)
+	w.Header().Set(model.HEADER_VERSION_ID, fmt.Sprintf("%v.%v.%v.%v", model.CurrentVersion, model.BuildNumber, c.App.ClientConfigHash(), c.App.License() != nil))
+
+	if h.IsStatic {
+		// Instruct the browser not to display us in an iframe unless is the same origin for anti-clickjacking
+		w.Header().Set("X-Frame-Options", "SAMEORIGIN")
+		w.Header().Set("Content-Security-Policy", "frame-ancestors 'self'")
+	} else {
+		// All api response bodies will be JSON formatted by default
+		w.Header().Set("Content-Type", "application/json")
+
+		if r.Method == "GET" {
+			w.Header().Set("Expires", "0")
+		}
+	}
+
+	if len(token) != 0 {
+		session, err := c.App.GetSession(token)
+
+		if err != nil {
+			mlog.Info(fmt.Sprintf("Invalid session err=%v", err.Error()))
+			if err.StatusCode == http.StatusInternalServerError {
+				c.Err = err
+			} else if h.RequireSession {
+				c.RemoveSessionCookie(w, r)
+				c.Err = model.NewAppError("ServeHTTP", "api.context.session_expired.app_error", nil, "token="+token, http.StatusUnauthorized)
+			}
+		} else if !session.IsOAuth && tokenLocation == app.TokenLocationQueryString {
+			c.Err = model.NewAppError("ServeHTTP", "api.context.token_provided.app_error", nil, "token="+token, http.StatusUnauthorized)
+		} else {
+			c.Session = *session
+		}
+
+		// Rate limit by UserID
+		if c.App.Srv.RateLimiter != nil && c.App.Srv.RateLimiter.UserIdRateLimit(c.Session.UserId, w) {
+			return
+		}
+	}
+
+	c.Path = r.URL.Path
+
+	if c.Err == nil && h.RequireSession {
+		c.SessionRequired()
+	}
+
+	if c.Err == nil && h.RequireMfa {
+		c.MfaRequired()
+	}
+
+	if c.Err == nil {
+		h.HandleFunc(c, w, r)
+	}
+
+	// Handle errors that have occurred
+	if c.Err != nil {
+		c.Err.Translate(c.T)
+		c.Err.RequestId = c.RequestId
+
+		if c.Err.Id == "api.context.session_expired.app_error" {
+			c.LogInfo(c.Err)
+		} else {
+			c.LogError(c.Err)
+		}
+
+		c.Err.Where = r.URL.Path
+
+		// Block out detailed error when not in developer mode
+		if !*c.App.Config().ServiceSettings.EnableDeveloper {
+			c.Err.DetailedError = ""
+		}
+
+		w.WriteHeader(c.Err.StatusCode)
+		w.Write([]byte(c.Err.ToJson()))
+
+		if c.App.Metrics != nil {
+			c.App.Metrics.IncrementHttpError()
+		}
+	}
+
+	if c.App.Metrics != nil {
+		c.App.Metrics.IncrementHttpRequest()
+
+		if r.URL.Path != model.API_URL_SUFFIX+"/websocket" {
+			elapsed := float64(time.Since(now)) / float64(time.Second)
+			c.App.Metrics.ObserveHttpRequestDuration(elapsed)
+		}
+	}
+}
--- a/web/params.go
+++ b/web/params.go
@@ -0,0 +1,205 @@
+// Copyright (c) 2017-present Mattermost, Inc. All Rights Reserved.
+// See License.txt for license information.
+
+package web
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/gorilla/mux"
+)
+
+const (
+	PAGE_DEFAULT          = 0
+	PER_PAGE_DEFAULT      = 60
+	PER_PAGE_MAXIMUM      = 200
+	LOGS_PER_PAGE_DEFAULT = 10000
+	LOGS_PER_PAGE_MAXIMUM = 10000
+)
+
+type Params struct {
+	UserId         string
+	TeamId         string
+	InviteId       string
+	TokenId        string
+	ChannelId      string
+	PostId         string
+	FileId         string
+	Filename       string
+	PluginId       string
+	CommandId      string
+	HookId         string
+	ReportId       string
+	EmojiId        string
+	AppId          string
+	Email          string
+	Username       string
+	TeamName       string
+	ChannelName    string
+	PreferenceName string
+	EmojiName      string
+	Category       string
+	Service        string
+	JobId          string
+	JobType        string
+	ActionId       string
+	RoleId         string
+	RoleName       string
+	SchemeId       string
+	Scope          string
+	Page           int
+	PerPage        int
+	LogsPerPage    int
+	Permanent      bool
+}
+
+func ParamsFromRequest(r *http.Request) *Params {
+	params := &Params{}
+
+	props := mux.Vars(r)
+	query := r.URL.Query()
+
+	if val, ok := props["user_id"]; ok {
+		params.UserId = val
+	}
+
+	if val, ok := props["team_id"]; ok {
+		params.TeamId = val
+	}
+
+	if val, ok := props["invite_id"]; ok {
+		params.InviteId = val
+	}
+
+	if val, ok := props["token_id"]; ok {
+		params.TokenId = val
+	}
+
+	if val, ok := props["channel_id"]; ok {
+		params.ChannelId = val
+	} else {
+		params.ChannelId = query.Get("channel_id")
+	}
+
+	if val, ok := props["post_id"]; ok {
+		params.PostId = val
+	}
+
+	if val, ok := props["file_id"]; ok {
+		params.FileId = val
+	}
+
+	params.Filename = query.Get("filename")
+
+	if val, ok := props["plugin_id"]; ok {
+		params.PluginId = val
+	}
+
+	if val, ok := props["command_id"]; ok {
+		params.CommandId = val
+	}
+
+	if val, ok := props["hook_id"]; ok {
+		params.HookId = val
+	}
+
+	if val, ok := props["report_id"]; ok {
+		params.ReportId = val
+	}
+
+	if val, ok := props["emoji_id"]; ok {
+		params.EmojiId = val
+	}
+
+	if val, ok := props["app_id"]; ok {
+		params.AppId = val
+	}
+
+	if val, ok := props["email"]; ok {
+		params.Email = val
+	}
+
+	if val, ok := props["username"]; ok {
+		params.Username = val
+	}
+
+	if val, ok := props["team_name"]; ok {
+		params.TeamName = strings.ToLower(val)
+	}
+
+	if val, ok := props["channel_name"]; ok {
+		params.ChannelName = strings.ToLower(val)
+	}
+
+	if val, ok := props["category"]; ok {
+		params.Category = val
+	}
+
+	if val, ok := props["service"]; ok {
+		params.Service = val
+	}
+
+	if val, ok := props["preference_name"]; ok {
+		params.PreferenceName = val
+	}
+
+	if val, ok := props["emoji_name"]; ok {
+		params.EmojiName = val
+	}
+
+	if val, ok := props["job_id"]; ok {
+		params.JobId = val
+	}
+
+	if val, ok := props["job_type"]; ok {
+		params.JobType = val
+	}
+
+	if val, ok := props["action_id"]; ok {
+		params.ActionId = val
+	}
+
+	if val, ok := props["role_id"]; ok {
+		params.RoleId = val
+	}
+
+	if val, ok := props["role_name"]; ok {
+		params.RoleName = val
+	}
+
+	if val, ok := props["scheme_id"]; ok {
+		params.SchemeId = val
+	}
+
+	params.Scope = query.Get("scope")
+
+	if val, err := strconv.Atoi(query.Get("page")); err != nil || val < 0 {
+		params.Page = PAGE_DEFAULT
+	} else {
+		params.Page = val
+	}
+
+	if val, err := strconv.ParseBool(query.Get("permanent")); err != nil {
+		params.Permanent = val
+	}
+
+	if val, err := strconv.Atoi(query.Get("per_page")); err != nil || val < 0 {
+		params.PerPage = PER_PAGE_DEFAULT
+	} else if val > PER_PAGE_MAXIMUM {
+		params.PerPage = PER_PAGE_MAXIMUM
+	} else {
+		params.PerPage = val
+	}
+
+	if val, err := strconv.Atoi(query.Get("logs_per_page")); err != nil || val < 0 {
+		params.LogsPerPage = LOGS_PER_PAGE_DEFAULT
+	} else if val > LOGS_PER_PAGE_MAXIMUM {
+		params.LogsPerPage = LOGS_PER_PAGE_MAXIMUM
+	} else {
+		params.LogsPerPage = val
+	}
+
+	return params
+}
--- a/web/saml.go
+++ b/web/saml.go
@@ -0,0 +1,149 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See License.txt for license information.
+
+package web
+
+import (
+	b64 "encoding/base64"
+	"net/http"
+	"strings"
+
+	"github.com/mattermost/mattermost-server/app"
+	"github.com/mattermost/mattermost-server/mlog"
+	"github.com/mattermost/mattermost-server/model"
+)
+
+func (w *Web) InitSaml() {
+	w.MainRouter.Handle("/login/sso/saml", w.NewHandler(loginWithSaml)).Methods("GET")
+	w.MainRouter.Handle("/login/sso/saml", w.NewHandler(completeSaml)).Methods("POST")
+}
+
+func loginWithSaml(c *Context, w http.ResponseWriter, r *http.Request) {
+	samlInterface := c.App.Saml
+
+	if samlInterface == nil {
+		c.Err = model.NewAppError("loginWithSaml", "api.user.saml.not_available.app_error", nil, "", http.StatusFound)
+		return
+	}
+
+	teamId, err := c.App.GetTeamIdFromQuery(r.URL.Query())
+	if err != nil {
+		c.Err = err
+		return
+	}
+	action := r.URL.Query().Get("action")
+	redirectTo := r.URL.Query().Get("redirect_to")
+	relayProps := map[string]string{}
+	relayState := ""
+
+	if len(action) != 0 {
+		relayProps["team_id"] = teamId
+		relayProps["action"] = action
+		if action == model.OAUTH_ACTION_EMAIL_TO_SSO {
+			relayProps["email"] = r.URL.Query().Get("email")
+		}
+	}
+
+	if len(redirectTo) != 0 {
+		relayProps["redirect_to"] = redirectTo
+	}
+
+	if len(relayProps) > 0 {
+		relayState = b64.StdEncoding.EncodeToString([]byte(model.MapToJson(relayProps)))
+	}
+
+	if data, err := samlInterface.BuildRequest(relayState); err != nil {
+		c.Err = err
+		return
+	} else {
+		w.Header().Set("Content-Type", "application/x-www-form-urlencoded")
+		http.Redirect(w, r, data.URL, http.StatusFound)
+	}
+}
+
+func completeSaml(c *Context, w http.ResponseWriter, r *http.Request) {
+	samlInterface := c.App.Saml
+
+	if samlInterface == nil {
+		c.Err = model.NewAppError("completeSaml", "api.user.saml.not_available.app_error", nil, "", http.StatusFound)
+		return
+	}
+
+	//Validate that the user is with SAML and all that
+	encodedXML := r.FormValue("SAMLResponse")
+	relayState := r.FormValue("RelayState")
+
+	relayProps := make(map[string]string)
+	if len(relayState) > 0 {
+		stateStr := ""
+		if b, err := b64.StdEncoding.DecodeString(relayState); err != nil {
+			c.Err = model.NewAppError("completeSaml", "api.user.authorize_oauth_user.invalid_state.app_error", nil, err.Error(), http.StatusFound)
+			return
+		} else {
+			stateStr = string(b)
+		}
+		relayProps = model.MapFromJson(strings.NewReader(stateStr))
+	}
+
+	action := relayProps["action"]
+	if user, err := samlInterface.DoLogin(encodedXML, relayProps); err != nil {
+		if action == model.OAUTH_ACTION_MOBILE {
+			err.Translate(c.T)
+			w.Write([]byte(err.ToJson()))
+		} else {
+			c.Err = err
+			c.Err.StatusCode = http.StatusFound
+		}
+		return
+	} else {
+		if err := c.App.CheckUserAllAuthenticationCriteria(user, ""); err != nil {
+			c.Err = err
+			c.Err.StatusCode = http.StatusFound
+			return
+		}
+
+		switch action {
+		case model.OAUTH_ACTION_SIGNUP:
+			teamId := relayProps["team_id"]
+			if len(teamId) > 0 {
+				c.App.Go(func() {
+					if err := c.App.AddUserToTeamByTeamId(teamId, user); err != nil {
+						mlog.Error(err.Error())
+					} else {
+						c.App.AddDirectChannels(teamId, user)
+					}
+				})
+			}
+		case model.OAUTH_ACTION_EMAIL_TO_SSO:
+			if err := c.App.RevokeAllSessions(user.Id); err != nil {
+				c.Err = err
+				return
+			}
+			c.LogAuditWithUserId(user.Id, "Revoked all sessions for user")
+			c.App.Go(func() {
+				if err := c.App.SendSignInChangeEmail(user.Email, strings.Title(model.USER_AUTH_SERVICE_SAML)+" SSO", user.Locale, c.App.GetSiteURL()); err != nil {
+					mlog.Error(err.Error())
+				}
+			})
+		}
+
+		session, err := c.App.DoLogin(w, r, user, "")
+		if err != nil {
+			c.Err = err
+			return
+		}
+
+		c.Session = *session
+
+		if val, ok := relayProps["redirect_to"]; ok {
+			http.Redirect(w, r, c.GetSiteURLHeader()+val, http.StatusFound)
+			return
+		}
+
+		if action == model.OAUTH_ACTION_MOBILE {
+			ReturnStatusOK(w)
+		} else {
+			http.Redirect(w, r, app.GetProtocol(r)+"://"+r.Host, http.StatusFound)
+		}
+	}
+}
--- a/web/static.go
+++ b/web/static.go
@@ -0,0 +1,84 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See License.txt for license information.
+
+package web
+
+import (
+	"fmt"
+	"net/http"
+	"path/filepath"
+	"strings"
+
+	"github.com/NYTimes/gziphandler"
+
+	"github.com/mattermost/mattermost-server/mlog"
+	"github.com/mattermost/mattermost-server/model"
+	"github.com/mattermost/mattermost-server/utils"
+)
+
+func (w *Web) InitStatic() {
+	if *w.App.Config().ServiceSettings.WebserverMode != "disabled" {
+		staticDir, _ := utils.FindDir(model.CLIENT_DIR)
+		mlog.Debug(fmt.Sprintf("Using client directory at %v", staticDir))
+
+		staticHandler := staticHandler(http.StripPrefix("/static/", http.FileServer(http.Dir(staticDir))))
+		pluginHandler := pluginHandler(w.App.Config, http.StripPrefix("/static/plugins/", http.FileServer(http.Dir(*w.App.Config().PluginSettings.ClientDirectory))))
+
+		if *w.App.Config().ServiceSettings.WebserverMode == "gzip" {
+			staticHandler = gziphandler.GzipHandler(staticHandler)
+			pluginHandler = gziphandler.GzipHandler(pluginHandler)
+		}
+
+		w.MainRouter.PathPrefix("/static/plugins/").Handler(pluginHandler)
+		w.MainRouter.PathPrefix("/static/").Handler(staticHandler)
+		w.MainRouter.Handle("/{anything:.*}", w.NewStaticHandler(root)).Methods("GET")
+	}
+}
+
+func root(c *Context, w http.ResponseWriter, r *http.Request) {
+
+	if !CheckClientCompatability(r.UserAgent()) {
+		w.Header().Set("Cache-Control", "no-store")
+		page := utils.NewHTMLTemplate(c.App.HTMLTemplates(), "unsupported_browser")
+		page.Props["Title"] = c.T("web.error.unsupported_browser.title")
+		page.Props["Message"] = c.T("web.error.unsupported_browser.message")
+		page.RenderToWriter(w)
+		return
+	}
+
+	if IsApiCall(r) {
+		Handle404(c.App, w, r)
+		return
+	}
+
+	w.Header().Set("Cache-Control", "no-cache, max-age=31556926, public")
+
+	staticDir, _ := utils.FindDir(model.CLIENT_DIR)
+	http.ServeFile(w, r, filepath.Join(staticDir, "root.html"))
+}
+
+func staticHandler(handler http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "max-age=31556926, public")
+		if strings.HasSuffix(r.URL.Path, "/") {
+			http.NotFound(w, r)
+			return
+		}
+		handler.ServeHTTP(w, r)
+	})
+}
+
+func pluginHandler(config model.ConfigFunc, handler http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if *config().ServiceSettings.EnableDeveloper {
+			w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+		} else {
+			w.Header().Set("Cache-Control", "max-age=31556926, public")
+		}
+		if strings.HasSuffix(r.URL.Path, "/") {
+			http.NotFound(w, r)
+			return
+		}
+		handler.ServeHTTP(w, r)
+	})
+}
--- a/web/web.go
+++ b/web/web.go
@@ -6,69 +6,39 @@ package web
 import (
 	"fmt"
 	"net/http"
-	"path/filepath"
 	"strings"

-	"github.com/NYTimes/gziphandler"
 	"github.com/avct/uasurfer"
+	"github.com/gorilla/mux"

-	"github.com/mattermost/mattermost-server/api"
+	"github.com/mattermost/mattermost-server/app"
 	"github.com/mattermost/mattermost-server/mlog"
 	"github.com/mattermost/mattermost-server/model"
 	"github.com/mattermost/mattermost-server/utils"
 )

-func Init(api3 *api.API) {
+type Web struct {
+	App        *app.App
+	MainRouter *mux.Router
+}
+
+func NewWeb(a *app.App, root *mux.Router) *Web {
 	mlog.Debug("Initializing web routes")

-	mainrouter := api3.BaseRoutes.Root
-
-	if *api3.App.Config().ServiceSettings.WebserverMode != "disabled" {
-		staticDir, _ := utils.FindDir(model.CLIENT_DIR)
-		mlog.Debug(fmt.Sprintf("Using client directory at %v", staticDir))
-
-		staticHandler := staticHandler(http.StripPrefix("/static/", http.FileServer(http.Dir(staticDir))))
-		pluginHandler := pluginHandler(api3.App.Config, http.StripPrefix("/static/plugins/", http.FileServer(http.Dir(*api3.App.Config().PluginSettings.ClientDirectory))))
-
-		if *api3.App.Config().ServiceSettings.WebserverMode == "gzip" {
-			staticHandler = gziphandler.GzipHandler(staticHandler)
-			pluginHandler = gziphandler.GzipHandler(pluginHandler)
-		}
-
-		mainrouter.PathPrefix("/static/plugins/").Handler(pluginHandler)
-		mainrouter.PathPrefix("/static/").Handler(staticHandler)
-		mainrouter.Handle("/{anything:.*}", api3.AppHandlerIndependent(root)).Methods("GET")
+	web := &Web{
+		App:        a,
+		MainRouter: root,
 	}
+
+	web.InitStatic()
+	web.InitWebhooks()
+	web.InitSaml()
+
+	return web
 }

-func staticHandler(handler http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Cache-Control", "max-age=31556926, public")
-		if strings.HasSuffix(r.URL.Path, "/") {
-			http.NotFound(w, r)
-			return
-		}
-		handler.ServeHTTP(w, r)
-	})
-}
-
-func pluginHandler(config model.ConfigFunc, handler http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if *config().ServiceSettings.EnableDeveloper {
-			w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
-		} else {
-			w.Header().Set("Cache-Control", "max-age=31556926, public")
-		}
-		if strings.HasSuffix(r.URL.Path, "/") {
-			http.NotFound(w, r)
-			return
-		}
-		handler.ServeHTTP(w, r)
-	})
-}
-
-// Due to the complexities of UA detection and the ramifications of a misdetection only older Safari and IE browsers throw incompatibility errors.
-
+// Due to the complexities of UA detection and the ramifications of a misdetection
+// only older Safari and IE browsers throw incompatibility errors.
 // Map should be of minimum required browser version.
 var browserMinimumSupported = map[string]int{
 	"BrowserIE":     11,
@@ -85,24 +55,26 @@ func CheckClientCompatability(agentString string) bool {
 	return true
 }

-func root(c *api.Context, w http.ResponseWriter, r *http.Request) {
+func Handle404(a *app.App, w http.ResponseWriter, r *http.Request) {
+	err := model.NewAppError("Handle404", "api.context.404.app_error", nil, "", http.StatusNotFound)

-	if !CheckClientCompatability(r.UserAgent()) {
-		w.Header().Set("Cache-Control", "no-store")
-		page := utils.NewHTMLTemplate(c.App.HTMLTemplates(), "unsupported_browser")
-		page.Props["Title"] = c.T("web.error.unsupported_browser.title")
-		page.Props["Message"] = c.T("web.error.unsupported_browser.message")
-		page.RenderToWriter(w)
-		return
+	mlog.Debug(fmt.Sprintf("%v: code=404 ip=%v", r.URL.Path, utils.GetIpAddress(r)))
+
+	if IsApiCall(r) {
+		w.WriteHeader(err.StatusCode)
+		err.DetailedError = "There doesn't appear to be an api call for the url='" + r.URL.Path + "'.  Typo? are you missing a team_id or user_id as part of the url?"
+		w.Write([]byte(err.ToJson()))
+	} else {
+		utils.RenderWebAppError(w, r, err, a.AsymmetricSigningKey())
 	}
-
-	if api.IsApiCall(r) {
-		api.Handle404(c.App, w, r)
-		return
-	}
-
-	w.Header().Set("Cache-Control", "no-cache, max-age=31556926, public")
-
-	staticDir, _ := utils.FindDir(model.CLIENT_DIR)
-	http.ServeFile(w, r, filepath.Join(staticDir, "root.html"))
+}
+
+func IsApiCall(r *http.Request) bool {
+	return strings.Index(r.URL.Path, "/api/") == 0
+}
+
+func ReturnStatusOK(w http.ResponseWriter) {
+	m := make(map[string]string)
+	m[model.STATUS] = model.STATUS_OK
+	w.Write([]byte(model.MapToJson(m)))
 }
--- a/web/web_test.go
+++ b/web/web_test.go
@@ -8,8 +8,6 @@ import (
 	"os"
 	"testing"

-	"github.com/mattermost/mattermost-server/api"
-	"github.com/mattermost/mattermost-server/api4"
 	"github.com/mattermost/mattermost-server/app"
 	"github.com/mattermost/mattermost-server/mlog"
 	"github.com/mattermost/mattermost-server/model"
@@ -38,7 +36,14 @@ func StopTestStore() {
 	}
 }

-func Setup() *app.App {
+type TestHelper struct {
+	App          *app.App
+	BasicUser    *model.User
+	BasicChannel *model.Channel
+	BasicTeam    *model.Team
+}
+
+func Setup() *TestHelper {
 	a, err := app.New(app.StoreOverride(testStore), app.DisableConfigWatch)
 	if err != nil {
 		panic(err)
@@ -50,9 +55,8 @@ func Setup() *app.App {
 		panic(serverErr)
 	}
 	a.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.ListenAddress = prevListenAddress })
-	api4.Init(a, a.Srv.Router, false)
-	api3 := api.Init(a, a.Srv.Router)
-	Init(api3)
+
+	NewWeb(a, a.Srv.Router)
 	URL = fmt.Sprintf("http://localhost:%v", a.Srv.ListenAddr.Port)
 	ApiClient = model.NewClient(URL)

@@ -65,11 +69,31 @@ func Setup() *app.App {
 		*cfg.ServiceSettings.EnableAPIv3 = true
 	})

-	return a
+	th := &TestHelper{
+		App: a,
+	}
+
+	return th
 }

-func TearDown(a *app.App) {
-	a.Shutdown()
+func (th *TestHelper) InitBasic() *TestHelper {
+	user, _ := th.App.CreateUser(&model.User{Email: model.NewId() + "success+test@simulator.amazonses.com", Nickname: "Corey Hulen", Password: "passwd1", EmailVerified: true, Roles: model.SYSTEM_ADMIN_ROLE_ID})
+
+	team, _ := th.App.CreateTeam(&model.Team{DisplayName: "Name", Name: "z-z-" + model.NewId() + "a", Email: user.Email, Type: model.TEAM_OPEN})
+
+	th.App.JoinUserToTeam(team, user, "")
+
+	channel, _ := th.App.CreateChannel(&model.Channel{DisplayName: "Test API Name", Name: "zz" + model.NewId() + "a", Type: model.CHANNEL_OPEN, TeamId: team.Id, CreatorId: user.Id}, true)
+
+	th.BasicUser = user
+	th.BasicChannel = channel
+	th.BasicTeam = team
+
+	return th
+}
+
+func (th *TestHelper) TearDown() {
+	th.App.Shutdown()
 	if err := recover(); err != nil {
 		StopTestStore()
 		panic(err)
@@ -93,63 +117,6 @@ func TestStatic(t *testing.T) {
 }
 */

-func TestIncomingWebhook(t *testing.T) {
-	a := Setup()
-	defer TearDown(a)
-
-	user := &model.User{Email: model.NewId() + "success+test@simulator.amazonses.com", Nickname: "Corey Hulen", Password: "passwd1"}
-	user = ApiClient.Must(ApiClient.CreateUser(user, "")).Data.(*model.User)
-	store.Must(a.Srv.Store.User().VerifyEmail(user.Id))
-
-	ApiClient.Login(user.Email, "passwd1")
-
-	team := &model.Team{DisplayName: "Name", Name: "z-z-" + model.NewId() + "a", Email: "test@nowhere.com", Type: model.TEAM_OPEN}
-	team = ApiClient.Must(ApiClient.CreateTeam(team)).Data.(*model.Team)
-
-	a.JoinUserToTeam(team, user, "")
-
-	a.UpdateUserRoles(user.Id, model.SYSTEM_ADMIN_ROLE_ID, false)
-	ApiClient.SetTeamId(team.Id)
-
-	channel1 := &model.Channel{DisplayName: "Test API Name", Name: "zz" + model.NewId() + "a", Type: model.CHANNEL_OPEN, TeamId: team.Id}
-	channel1 = ApiClient.Must(ApiClient.CreateChannel(channel1)).Data.(*model.Channel)
-
-	if a.Config().ServiceSettings.EnableIncomingWebhooks {
-		hook1 := &model.IncomingWebhook{ChannelId: channel1.Id}
-		hook1 = ApiClient.Must(ApiClient.CreateIncomingWebhook(hook1)).Data.(*model.IncomingWebhook)
-
-		payload := "payload={\"text\": \"test text\"}"
-		if _, err := ApiClient.PostToWebhook(hook1.Id, payload); err != nil {
-			t.Fatal(err)
-		}
-
-		payload = "payload={\"text\": \"\"}"
-		if _, err := ApiClient.PostToWebhook(hook1.Id, payload); err == nil {
-			t.Fatal("should have errored - no text to post")
-		}
-
-		payload = "payload={\"text\": \"test text\", \"channel\": \"junk\"}"
-		if _, err := ApiClient.PostToWebhook(hook1.Id, payload); err == nil {
-			t.Fatal("should have errored - bad channel")
-		}
-
-		payload = "payload={\"text\": \"test text\"}"
-		if _, err := ApiClient.PostToWebhook("abc123", payload); err == nil {
-			t.Fatal("should have errored - bad hook")
-		}
-
-		payloadMultiPart := "------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\nwebhook-bot\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"text\"\r\n\r\nthis is a test :tada:\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW--"
-		if _, err := ApiClient.DoPost("/hooks/"+hook1.Id, payloadMultiPart, "multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW"); err != nil {
-			t.Fatal("should have errored - bad hook")
-		}
-
-	} else {
-		if _, err := ApiClient.PostToWebhook("123", "123"); err == nil {
-			t.Fatal("should have failed - webhooks turned off")
-		}
-	}
-}
-
 func TestMain(m *testing.M) {
 	// Setup a global logger to catch tests logging outside of app context
 	// The global logger will be stomped by apps initalizing but that's fine for testing. Ideally this won't happen.
--- a/web/webhook.go
+++ b/web/webhook.go
@@ -0,0 +1,101 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See License.txt for license information.
+
+package web
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+
+	"github.com/gorilla/mux"
+	"github.com/gorilla/schema"
+
+	"github.com/mattermost/mattermost-server/mlog"
+	"github.com/mattermost/mattermost-server/model"
+)
+
+func (w *Web) InitWebhooks() {
+	w.MainRouter.Handle("/hooks/commands/{id:[A-Za-z0-9]+}", w.NewHandler(commandWebhook)).Methods("POST")
+	w.MainRouter.Handle("/hooks/{id:[A-Za-z0-9]+}", w.NewHandler(incomingWebhook)).Methods("POST")
+}
+
+func incomingWebhook(c *Context, w http.ResponseWriter, r *http.Request) {
+	params := mux.Vars(r)
+	id := params["id"]
+
+	r.ParseForm()
+
+	var err *model.AppError
+	incomingWebhookPayload := &model.IncomingWebhookRequest{}
+	contentType := r.Header.Get("Content-Type")
+	if strings.Split(contentType, "; ")[0] == "application/x-www-form-urlencoded" {
+		payload := strings.NewReader(r.FormValue("payload"))
+
+		incomingWebhookPayload, err = decodePayload(payload)
+		if err != nil {
+			c.Err = err
+			return
+		}
+	} else if strings.HasPrefix(contentType, "multipart/form-data") {
+		r.ParseMultipartForm(0)
+
+		decoder := schema.NewDecoder()
+		err := decoder.Decode(incomingWebhookPayload, r.PostForm)
+
+		if err != nil {
+			c.Err = model.NewAppError("incomingWebhook", "api.webhook.incoming.error", nil, err.Error(), http.StatusBadRequest)
+			return
+		}
+	} else {
+		incomingWebhookPayload, err = decodePayload(r.Body)
+		if err != nil {
+			c.Err = err
+			return
+		}
+	}
+
+	if c.App.Config().LogSettings.EnableWebhookDebugging {
+		mlog.Debug(fmt.Sprint("Incoming webhook received. Content=", incomingWebhookPayload.ToJson()))
+	}
+
+	err = c.App.HandleIncomingWebhook(id, incomingWebhookPayload)
+	if err != nil {
+		c.Err = err
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/plain")
+	w.Write([]byte("ok"))
+}
+
+func commandWebhook(c *Context, w http.ResponseWriter, r *http.Request) {
+	params := mux.Vars(r)
+	id := params["id"]
+
+	response, err := model.CommandResponseFromHTTPBody(r.Header.Get("Content-Type"), r.Body)
+	if err != nil {
+		c.Err = model.NewAppError("commandWebhook", "web.command_webhook.parse.app_error", nil, err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	appErr := c.App.HandleCommandWebhook(id, response)
+	if appErr != nil {
+		c.Err = appErr
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/plain")
+	w.Write([]byte("ok"))
+}
+
+func decodePayload(payload io.Reader) (*model.IncomingWebhookRequest, *model.AppError) {
+	incomingWebhookPayload, decodeError := model.IncomingWebhookRequestFromJson(payload)
+
+	if decodeError != nil {
+		return nil, decodeError
+	}
+
+	return incomingWebhookPayload, nil
+}
--- a/web/webhook_test.go
+++ b/web/webhook_test.go
@@ -0,0 +1,216 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See License.txt for license information.
+
+package web
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/mattermost/mattermost-server/model"
+)
+
+func TestIncomingWebhook(t *testing.T) {
+	th := Setup().InitBasic()
+	defer th.TearDown()
+
+	if !th.App.Config().ServiceSettings.EnableIncomingWebhooks {
+		_, err := ApiClient.PostToWebhook("123", "123")
+		assert.NotNil(t, err, "should have errored - webhooks turned off")
+		return
+	}
+
+	hook, err := th.App.CreateIncomingWebhookForChannel(th.BasicUser.Id, th.BasicChannel, &model.IncomingWebhook{ChannelId: th.BasicChannel.Id})
+	require.Nil(t, err)
+
+	url := "/hooks/" + hook.Id
+
+	tooLongText := ""
+	for i := 0; i < 8200; i++ {
+		tooLongText += "a"
+	}
+
+	t.Run("WebhookBasics", func(t *testing.T) {
+		payload := "payload={\"text\": \"test text\"}"
+		_, err := ApiClient.DoPost(url, payload, "application/x-www-form-urlencoded")
+		assert.Nil(t, err)
+
+		payload = "payload={\"text\": \"\"}"
+		_, err = ApiClient.DoPost(url, payload, "application/x-www-form-urlencoded")
+		assert.NotNil(t, err, "should have errored - no text to post")
+
+		payload = "payload={\"text\": \"test text\", \"channel\": \"junk\"}"
+		_, err = ApiClient.DoPost(url, payload, "application/x-www-form-urlencoded")
+		assert.NotNil(t, err, "should have errored - bad channel")
+
+		payload = "payload={\"text\": \"test text\"}"
+		_, err = ApiClient.DoPost("/hooks/abc123", payload, "application/x-www-form-urlencoded")
+		assert.NotNil(t, err, "should have errored - bad hook")
+
+		_, err = ApiClient.DoPost(url, "{\"text\":\"this is a test\"}", "application/json")
+		assert.Nil(t, err)
+
+		text := `this is a \"test\"
+	that contains a newline and a tab`
+		_, err = ApiClient.DoPost(url, "{\"text\":\""+text+"\"}", "application/json")
+		assert.Nil(t, err)
+
+		_, err = ApiClient.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", th.BasicChannel.Name), "application/json")
+		assert.Nil(t, err)
+
+		_, err = ApiClient.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"#%s\"}", th.BasicChannel.Name), "application/json")
+		assert.Nil(t, err)
+
+		_, err = ApiClient.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"@%s\"}", th.BasicUser.Username), "application/json")
+		assert.Nil(t, err)
+
+		_, err = ApiClient.DoPost(url, "payload={\"text\":\"this is a test\"}", "application/x-www-form-urlencoded")
+		assert.Nil(t, err)
+
+		_, err = ApiClient.DoPost(url, "payload={\"text\":\""+text+"\"}", "application/x-www-form-urlencoded")
+		assert.Nil(t, err)
+
+		_, err = ApiClient.DoPost(url, "{\"text\":\""+tooLongText+"\"}", "application/json")
+		assert.Nil(t, err)
+
+		payloadMultiPart := "------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\nwebhook-bot\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"text\"\r\n\r\nthis is a test :tada:\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW--"
+		_, err = ApiClient.DoPost("/hooks/"+hook.Id, payloadMultiPart, "multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW")
+		assert.Nil(t, err)
+	})
+
+	t.Run("WebhookExperimentReadOnly", func(t *testing.T) {
+		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = false })
+		_, err := ApiClient.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", model.DEFAULT_CHANNEL), "application/json")
+		assert.Nil(t, err, "Not read only")
+
+		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = true })
+		th.App.SetLicense(model.NewTestLicense())
+	})
+
+	t.Run("WebhookAttachments", func(t *testing.T) {
+		attachmentPayload := `{
+	       "text": "this is a test",
+	       "attachments": [
+	           {
+	               "fallback": "Required plain-text summary of the attachment.",
+
+	               "color": "#36a64f",
+
+	               "pretext": "Optional text that appears above the attachment block",
+
+	               "author_name": "Bobby Tables",
+	               "author_link": "http://flickr.com/bobby/",
+	               "author_icon": "http://flickr.com/icons/bobby.jpg",
+
+	               "title": "Slack API Documentation",
+	               "title_link": "https://api.slack.com/",
+
+	               "text": "Optional text that appears within the attachment",
+
+	               "fields": [
+	                   {
+	                       "title": "Priority",
+	                       "value": "High",
+	                       "short": false
+	                   }
+	               ],
+
+	               "image_url": "http://my-website.com/path/to/image.jpg",
+	               "thumb_url": "http://example.com/path/to/thumb.png"
+	           }
+	       ]
+	   }`
+
+		_, err := ApiClient.DoPost(url, attachmentPayload, "application/json")
+		assert.Nil(t, err)
+
+		attachmentPayload = `{
+	       "text": "this is a test",
+	       "attachments": [
+	           {
+	               "fallback": "Required plain-text summary of the attachment.",
+
+	               "color": "#36a64f",
+
+	               "pretext": "Optional text that appears above the attachment block",
+
+	               "author_name": "Bobby Tables",
+	               "author_link": "http://flickr.com/bobby/",
+	               "author_icon": "http://flickr.com/icons/bobby.jpg",
+
+	               "title": "Slack API Documentation",
+	               "title_link": "https://api.slack.com/",
+
+	               "text": "` + tooLongText + `",
+
+	               "fields": [
+	                   {
+	                       "title": "Priority",
+	                       "value": "High",
+	                       "short": false
+	                   }
+	               ],
+
+	               "image_url": "http://my-website.com/path/to/image.jpg",
+	               "thumb_url": "http://example.com/path/to/thumb.png"
+	           }
+	       ]
+	   }`
+
+		_, err = ApiClient.DoPost(url, attachmentPayload, "application/json")
+		assert.Nil(t, err)
+	})
+
+	t.Run("DisableWebhooks", func(t *testing.T) {
+		th.App.UpdateConfig(func(cfg *model.Config) { cfg.ServiceSettings.EnableIncomingWebhooks = false })
+		_, err := ApiClient.DoPost(url, "{\"text\":\"this is a test\"}", "application/json")
+		assert.NotNil(t, err)
+	})
+}
+
+func TestCommandWebhooks(t *testing.T) {
+	th := Setup().InitBasic()
+	defer th.TearDown()
+
+	cmd, err := th.App.CreateCommand(&model.Command{
+		CreatorId: th.BasicUser.Id,
+		TeamId:    th.BasicTeam.Id,
+		URL:       "http://nowhere.com",
+		Method:    model.COMMAND_METHOD_POST,
+		Trigger:   "delayed"})
+	require.Nil(t, err)
+
+	args := &model.CommandArgs{
+		TeamId:    th.BasicTeam.Id,
+		UserId:    th.BasicUser.Id,
+		ChannelId: th.BasicChannel.Id,
+	}
+
+	hook, err := th.App.CreateCommandWebhook(cmd.Id, args)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if resp, _ := http.Post(ApiClient.Url+"/hooks/commands/123123123123", "application/json", bytes.NewBufferString(`{"text":"this is a test"}`)); resp.StatusCode != http.StatusNotFound {
+		t.Fatal("expected not-found for non-existent hook")
+	}
+
+	if resp, err := http.Post(ApiClient.Url+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"invalid`)); err != nil || resp.StatusCode != http.StatusBadRequest {
+		t.Fatal(err)
+	}
+
+	for i := 0; i < 5; i++ {
+		if resp, err := http.Post(ApiClient.Url+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"this is a test"}`)); err != nil || resp.StatusCode != http.StatusOK {
+			t.Fatal(err)
+		}
+	}
+
+	if resp, _ := http.Post(ApiClient.Url+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"this is a test"}`)); resp.StatusCode != http.StatusBadRequest {
+		t.Fatal("expected error for sixth usage")
+	}
+}