IntenseWebs/mattermost
3
0
Fork 0
mirror of https://github.com/mattermost/mattermost.git synced 2025-02-25 18:55:24 -06:00
Code Issues Packages Projects Releases Wiki Activity

MM-56822 Update logic around permissions and sanitization (#26227)

Browse Source 
* update logic around permissions and sanitization

* add test

* add comments

* fix test

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
This commit is contained in:
Scott Bishel 2024-02-21 15:19:11 -07:00 committed by GitHub
parent 01e1eebc07
commit f90b3d4141
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 40 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
server/channels/api4/team_test.go
View File

@ -326,7 +326,19 @@ func TestGetTeamSanitization(t *testing.T) {
require.Empty(t, rteam.InviteId, "should have sanitized inviteid") require.Empty(t, rteam.InviteId, "should have sanitized inviteid")
}) })
t.Run("team admin", func(t *testing.T) { t.Run("team admin default removed", func(t *testing.T) {
// the above test removes PermissionInviteUser from TeamUser,
// which also removes it from TeamAdmin. By default, TeamAdmin
// permission is inherited from TeamUser.
rteam, _, err := th.Client.GetTeam(context.Background(), team.Id, "")
require.NoError(t, err)
require.NotEmpty(t, rteam.Email, "should not have sanitized email")
require.Empty(t, rteam.InviteId, "should have sanitized inviteid")
})
t.Run("team admin permission re-added", func(t *testing.T) {
th.AddPermissionToRole(model.PermissionInviteUser.Id, model.TeamAdminRoleId)
rteam, _, err := th.Client.GetTeam(context.Background(), team.Id, "") rteam, _, err := th.Client.GetTeam(context.Background(), team.Id, "")
require.NoError(t, err) require.NoError(t, err)
@ -1452,7 +1464,19 @@ func TestGetTeamByNameSanitization(t *testing.T) {
require.Empty(t, rteam.InviteId, "should have sanitized inviteid") require.Empty(t, rteam.InviteId, "should have sanitized inviteid")
}) })
t.Run("team admin/non-admin", func(t *testing.T) { t.Run("team admin/non-admin without invite permission", func(t *testing.T) {
// the above test removes PermissionInviteUser from TeamUser,
// which also removes it from TeamAdmin. By default, TeamAdmin
// permission is inherited from TeamUser.
rteam, _, err := th.Client.GetTeamByName(context.Background(), team.Name, "")
require.NoError(t, err)
require.NotEmpty(t, rteam.Email, "should not have sanitized email")
require.Empty(t, rteam.InviteId, "should have sanitized inviteid")
})
t.Run("team admin/non-admin with invite permission", func(t *testing.T) {
th.AddPermissionToRole(model.PermissionInviteUser.Id, model.TeamAdminRoleId)
rteam, _, err := th.Client.GetTeamByName(context.Background(), team.Name, "") rteam, _, err := th.Client.GetTeamByName(context.Background(), team.Name, "")
require.NoError(t, err) require.NoError(t, err)
@ -1861,6 +1885,8 @@ func TestGetTeamsForUserSanitization(t *testing.T) {
client := th.CreateClient() client := th.CreateClient()
th.RemovePermissionFromRole(model.PermissionInviteUser.Id, model.TeamUserRoleId) th.RemovePermissionFromRole(model.PermissionInviteUser.Id, model.TeamUserRoleId)
defer th.AddPermissionToRole(model.PermissionInviteUser.Id, model.TeamUserRoleId)
th.LoginBasic2WithClient(client) th.LoginBasic2WithClient(client)
rteams, _, err := client.GetTeamsForUser(context.Background(), th.BasicUser2.Id, "") rteams, _, err := client.GetTeamsForUser(context.Background(), th.BasicUser2.Id, "")

21
server/channels/app/team.go
View File

@ -1906,19 +1906,22 @@ func (a *App) GetTeamIdFromQuery(query url.Values) (string, *model.AppError) {
} }
func (a *App) SanitizeTeam(session model.Session, team *model.Team) *model.Team { func (a *App) SanitizeTeam(session model.Session, team *model.Team) *model.Team {
if a.SessionHasPermissionToTeam(session, team.Id, model.PermissionManageTeam) { manageTeamPermission := a.SessionHasPermissionToTeam(session, team.Id, model.PermissionManageTeam)
inviteUserPermission := a.SessionHasPermissionToTeam(session, team.Id, model.PermissionInviteUser)
if manageTeamPermission && inviteUserPermission {
return team return team
} }
email := team.Email
if a.SessionHasPermissionToTeam(session, team.Id, model.PermissionInviteUser) { inviteId := team.InviteId
inviteId := team.InviteId
team.Sanitize()
team.InviteId = inviteId
return team
}
team.Sanitize() team.Sanitize()
if manageTeamPermission {
team.Email = email
}
if inviteUserPermission {
team.InviteId = inviteId
}
return team return team
} }