IntenseWebs/mattermost
3
0
Fork 0
mirror of https://github.com/mattermost/mattermost.git synced 2025-02-25 18:55:24 -06:00
Code Issues Packages Projects Releases Wiki Activity

MM-15947: Prevents new user creation with invite link to group-constrained team. (#11023)

Browse Source
This commit is contained in:
Martin Kraft
2019-06-03 12:38:33 -04:00
committed by GitHub
parent 118cd02613
commit c8646eae51
2 changed files with 23 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
api4/user_test.go
View File

@@ -260,6 +260,25 @@ func TestCreateUserWithInviteId(t *testing.T) {
CheckUserSanitization(t, ruser)
})
t.Run("GroupConstrainedTeam", func(t *testing.T) {
user := model.User{Email: th.GenerateTestEmail(), Nickname: "", Password: "hello1", Username: GenerateTestUsername(), Roles: model.SYSTEM_ADMIN_ROLE_ID + " " + model.SYSTEM_USER_ROLE_ID}
th.BasicTeam.GroupConstrained = model.NewBool(true)
team, err := th.App.UpdateTeam(th.BasicTeam)
require.Nil(t, err)
defer func() {
th.BasicTeam.GroupConstrained = model.NewBool(false)
_, err = th.App.UpdateTeam(th.BasicTeam)
require.Nil(t, err)
}()
inviteID := team.InviteId
_, resp := th.Client.CreateUserWithInviteId(&user, inviteID)
require.Equal(t, "app.team.invite_id.group_constrained.error", resp.Error.Id)
})
t.Run("WrongInviteId", func(t *testing.T) {
user := model.User{Email: th.GenerateTestEmail(), Nickname: "Corey Hulen", Password: "hello1", Username: GenerateTestUsername(), Roles: model.SYSTEM_ADMIN_ROLE_ID + " " + model.SYSTEM_USER_ROLE_ID}
@@ -336,7 +355,6 @@ func TestCreateUserWithInviteId(t *testing.T) {
}
CheckUserSanitization(t, ruser)
})
}
func TestGetMe(t *testing.T) {

4
app/user.go
View File

@@ -104,6 +104,10 @@ func (a *App) CreateUserWithInviteId(user *model.User, inviteId string) (*model.
}
team := result.Data.(*model.Team)
if team.IsGroupConstrained() {
return nil, model.NewAppError("CreateUserWithInviteId", "app.team.invite_id.group_constrained.error", nil, "", http.StatusForbidden)
}
user.EmailVerified = false
ruser, err := a.CreateUser(user)