From fc028e703abb07ccf4ffabcf482b1c144f103b0b Mon Sep 17 00:00:00 2001
From: Agniva De Sarker <agnivade@yahoo.co.in>
Date: Wed, 3 Jun 2020 13:30:32 +0530
Subject: [PATCH] MM-25641: Check if member was deleted in HasPermissionToTeam
 (#14737)

This PR adds a check to verify if a team member got deleted in HasPermissionToTeam,
and accordingly returns false.
---
 app/authorization.go      |  5 +++++
 app/authorization_test.go | 12 ++++++++++++
 app/helper_test.go        | 14 ++++++++++++++
 3 files changed, 31 insertions(+)

diff --git a/app/authorization.go b/app/authorization.go
index 5261f91a75..32604b04e8 100644
--- a/app/authorization.go
+++ b/app/authorization.go
@@ -136,6 +136,11 @@ func (a *App) HasPermissionToTeam(askingUserId string, teamId string, permission
 		return false
 	}
 
+	// If the team member has been deleted, they don't have permission.
+	if teamMember.DeleteAt != 0 {
+		return false
+	}
+
 	roles := teamMember.GetRoles()
 
 	if a.RolesGrantPermission(roles, permission.Id) {
diff --git a/app/authorization_test.go b/app/authorization_test.go
index 5955b9795f..a0969e07fc 100644
--- a/app/authorization_test.go
+++ b/app/authorization_test.go
@@ -6,6 +6,7 @@ package app
 import (
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/mattermost/mattermost-server/v5/model"
@@ -41,3 +42,14 @@ func TestChannelRolesGrantPermission(t *testing.T) {
 		require.Equal(t, testData.shouldHavePermission, th.App.RolesGrantPermission([]string{testData.channelRole.Name}, testData.permission.Id), "row: %+v\n", testData.truthTableRow)
 	})
 }
+
+func TestHasPermissionToTeam(t *testing.T) {
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	assert.True(t, th.App.HasPermissionToTeam(th.BasicUser.Id, th.BasicTeam.Id, model.PERMISSION_LIST_TEAM_CHANNELS))
+
+	th.RemoveUserFromTeam(th.BasicUser, th.BasicTeam)
+
+	assert.False(t, th.App.HasPermissionToTeam(th.BasicUser.Id, th.BasicTeam.Id, model.PERMISSION_LIST_TEAM_CHANNELS))
+}
diff --git a/app/helper_test.go b/app/helper_test.go
index c575a1600f..1c36c728c4 100644
--- a/app/helper_test.go
+++ b/app/helper_test.go
@@ -439,6 +439,20 @@ func (me *TestHelper) LinkUserToTeam(user *model.User, team *model.Team) {
 	utils.EnableDebugLogForTest()
 }
 
+func (me *TestHelper) RemoveUserFromTeam(user *model.User, team *model.Team) {
+	utils.DisableDebugLogForTest()
+
+	err := me.App.RemoveUserFromTeam(team.Id, user.Id, "")
+	if err != nil {
+		mlog.Error(err.Error())
+
+		time.Sleep(time.Second)
+		panic(err)
+	}
+
+	utils.EnableDebugLogForTest()
+}
+
 func (me *TestHelper) AddUserToChannel(user *model.User, channel *model.Channel) *model.ChannelMember {
 	utils.DisableDebugLogForTest()