IntenseWebs/mattermost
3
0
Fork 0
mirror of https://github.com/mattermost/mattermost.git synced 2025-02-25 18:55:24 -06:00
Code Issues Packages Projects Releases Wiki Activity

Verify team membership when returning command list (#11487)

Browse Source
This commit is contained in:
Daniel Schalla
2019-07-04 14:52:47 +02:00
committed by GitHub
parent cf695095d8
commit 68703f9b76
2 changed files with 39 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
api4/command.go
View File

@@ -148,6 +148,11 @@ func listCommands(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
if !c.App.SessionHasPermissionToTeam(c.App.Session, teamId, model.PERMISSION_VIEW_TEAM) {
c.SetPermissionError(model.PERMISSION_VIEW_TEAM)
return
}
var commands []*model.Command
var err *model.AppError
if customOnly {

34
api4/command_test.go
View File

@@ -294,6 +294,25 @@ func TestListCommands(t *testing.T) {
t.Fatal("Should not list the custom command")
}
})
t.Run("NoMember", func(t *testing.T) {
Client.Logout()
user := th.CreateUser()
th.SystemAdminClient.RemoveTeamMember(th.BasicTeam.Id, user.Id)
Client.Login(user.Email, user.Password)
_, resp := Client.ListCommands(th.BasicTeam.Id, false)
CheckForbiddenStatus(t, resp)
_, resp = Client.ListCommands(th.BasicTeam.Id, true)
CheckForbiddenStatus(t, resp)
})
t.Run("NotLoggedIn", func(t *testing.T) {
Client.Logout()
_, resp := Client.ListCommands(th.BasicTeam.Id, false)
CheckUnauthorizedStatus(t, resp)
_, resp = Client.ListCommands(th.BasicTeam.Id, true)
CheckUnauthorizedStatus(t, resp)
})
}
func TestListAutocompleteCommands(t *testing.T) {
@@ -354,6 +373,21 @@ func TestListAutocompleteCommands(t *testing.T) {
t.Fatal("Should not list the custom command")
}
})
t.Run("NoMember", func(t *testing.T) {
Client.Logout()
user := th.CreateUser()
th.SystemAdminClient.RemoveTeamMember(th.BasicTeam.Id, user.Id)
Client.Login(user.Email, user.Password)
_, resp := Client.ListAutocompleteCommands(th.BasicTeam.Id)
CheckForbiddenStatus(t, resp)
})
t.Run("NotLoggedIn", func(t *testing.T) {
Client.Logout()
_, resp := Client.ListAutocompleteCommands(th.BasicTeam.Id)
CheckUnauthorizedStatus(t, resp)
})
}
func TestRegenToken(t *testing.T) {