diff --git a/api4/channel.go b/api4/channel.go index bb89bee9b6..e4f16e7ff2 100644 --- a/api4/channel.go +++ b/api4/channel.go @@ -1150,7 +1150,15 @@ func getChannelByNameForTeamName(c *Context, w http.ResponseWriter, r *http.Requ return } - if !c.App.SessionHasPermissionToChannel(*c.App.Session(), channel.Id, model.PERMISSION_READ_CHANNEL) { + teamOk := c.App.SessionHasPermissionToTeam(*c.App.Session(), channel.TeamId, model.PERMISSION_READ_PUBLIC_CHANNEL) + channelOk := c.App.SessionHasPermissionToChannel(*c.App.Session(), channel.Id, model.PERMISSION_READ_CHANNEL) + + if channel.Type == model.CHANNEL_OPEN { + if !teamOk && !channelOk { + c.SetPermissionError(model.PERMISSION_READ_PUBLIC_CHANNEL) + return + } + } else if !channelOk { c.Err = model.NewAppError("getChannelByNameForTeamName", "app.channel.get_by_name.missing.app_error", nil, "teamId="+channel.TeamId+", "+"name="+channel.Name+"", http.StatusNotFound) return } diff --git a/api4/channel_test.go b/api4/channel_test.go index a1cd943caa..f46c024e1a 100644 --- a/api4/channel_test.go +++ b/api4/channel_test.go @@ -1907,6 +1907,11 @@ func TestGetChannelByNameForTeamName(t *testing.T) { _, resp = Client.GetChannelByNameForTeamName(th.BasicChannel.Name, th.BasicTeam.Name, "") CheckNoError(t, resp) + require.Equal(t, th.BasicChannel.Name, channel.Name, "names did not match") + + channel, resp = Client.GetChannelByNameForTeamName(th.BasicPrivateChannel.Name, th.BasicTeam.Name, "") + CheckNoError(t, resp) + require.Equal(t, th.BasicPrivateChannel.Name, channel.Name, "names did not match") _, resp = Client.GetChannelByNameForTeamName(th.BasicDeletedChannel.Name, th.BasicTeam.Name, "") CheckNotFoundStatus(t, resp) @@ -1915,6 +1920,14 @@ func TestGetChannelByNameForTeamName(t *testing.T) { CheckNoError(t, resp) require.Equal(t, th.BasicDeletedChannel.Name, channel.Name, "names did not match") + Client.RemoveUserFromChannel(th.BasicChannel.Id, th.BasicUser.Id) + _, resp = Client.GetChannelByNameForTeamName(th.BasicChannel.Name, th.BasicTeam.Name, "") + CheckNoError(t, resp) + + Client.RemoveUserFromChannel(th.BasicPrivateChannel.Id, th.BasicUser.Id) + _, resp = Client.GetChannelByNameForTeamName(th.BasicPrivateChannel.Name, th.BasicTeam.Name, "") + CheckNotFoundStatus(t, resp) + _, resp = Client.GetChannelByNameForTeamName(th.BasicChannel.Name, model.NewRandomString(15), "") CheckNotFoundStatus(t, resp) @@ -1928,7 +1941,7 @@ func TestGetChannelByNameForTeamName(t *testing.T) { user := th.CreateUser() Client.Login(user.Email, user.Password) _, resp = Client.GetChannelByNameForTeamName(th.BasicChannel.Name, th.BasicTeam.Name, "") - CheckNotFoundStatus(t, resp) + CheckForbiddenStatus(t, resp) } func TestGetChannelMembers(t *testing.T) {