mirror of
https://github.com/mattermost/mattermost.git
synced 2026-11-04 21:26:49 -06:00
24ef18fda7
* MM-70812: Lock plugin-managed channel attribute values in the channel RHS The Channel Attributes panel in Channel Info decided a row was editable from permission_values alone. The server refuses every session write to a field whose values an integration owns -- attrs.protected with a source_plugin_id, or a non-empty attrs.owners list -- before permission_values is consulted, so a channel admin was offered a dropdown that could only end in "Couldn't save". Mirror that gate client-side and show the row's padlock, so the attribute reads as deliberately read-only rather than broken. Co-authored-by: mattermost-code <matty-code@mattermost.com> * Tidy comments and typing in the source-managed attribute lock Name the gate source-managed rather than plugin-managed, since it also covers ldap/saml sync, drop a comment that repeated the hook's own doc, annotate the ownership table instead of asserting its type, and wrap the new spec's objective to match the ones beside it. * Format the new channel attribute spec to prettier's liking Co-authored-by: mattermost-code <matty-code@mattermost.com> * Add the MM-70812 walkthrough artifacts and ticket link The PR description could not be amended after it was opened, so the before/after evidence and the ticket link live here instead. Ticket: https://mattermost.atlassian.net/browse/MM-70812 Reproduced on a real server against a protected channel attribute created by a purpose-built plugin (the only caller the server lets set attrs.protected), holding the value NOFORN on Town Square. Before, the value opened an option menu and the save came back 403 app.property.access_denied.app_request. After, it is a read-only chip behind a padlock. Side-by-side crop: https://cursor-plugin-pr-assets.s3.amazonaws.com/cursor/cursor/jira-bug-fix-agent-workflow-5926/before-after-comparison.png Before, save failed: https://cursor-plugin-pr-assets.s3.amazonaws.com/cursor/cursor/jira-bug-fix-agent-workflow-5926/before-save-failed.webp Before, full walkthrough: https://cursor-plugin-pr-assets.s3.amazonaws.com/cursor/cursor/jira-bug-fix-agent-workflow-5926/before-protected-attr-editable.mp4 After, locked read-only chip: https://cursor-plugin-pr-assets.s3.amazonaws.com/cursor/cursor/jira-bug-fix-agent-workflow-5926/after-readonly-chip.webp After, full walkthrough: https://cursor-plugin-pr-assets.s3.amazonaws.com/cursor/cursor/jira-bug-fix-agent-workflow-5926/after-protected-attr-readonly.mp4 Co-authored-by: mattermost-code <matty-code@mattermost.com> * e2e: set MM-T622 override flags via config patch The admin-console Save control stays disabled when the radios already match leftover Integration Management config. Patch the two override flags and store a stable hook-level icon instead. Co-authored-by: mattermost-code <matty-code@mattermost.com> * e2e: align Session Attributes type labels with String/Boolean/Enum The listing Type column is getDisplayType (String | Boolean | Enum). IP/Version labels were removed from the product. Co-authored-by: mattermost-code <matty-code@mattermost.com> * e2e: stage dirty-nav via Enable instead of the TTL submenu The nested Time-to-live submenu is racy under MUI. Staging Enable is enough to dirty the page, and enable() now waits for the menu to close. Co-authored-by: mattermost-code <matty-code@mattermost.com> * Address PR feedback: 0 answered, 2 resolved, 0 declined Revert unrelated e2e test changes flagged by reviewer: - disallow_username_profile_override_spec.js (incoming webhook icon setup) - session_attributes.spec.ts + session_attributes.ts helper (dirty-check tweak) These were unrelated to the channel-attributes locking fix (MM-70812) and are restored to their master state. * Add the translator description for the large-emoji processing error Enterprise i18n extract writes a description for every en.json entry. The new emoji processing error was missing one, so the check failed. Co-authored-by: maria.nunez <maria.nunez@mattermost.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: mattermost-code <matty-code@mattermost.com> Co-authored-by: Maria A Nunez <maria.nunez@mattermost.com> Co-authored-by: Mattermost Build <build@mattermost.com>
Mattermost is an open core, self-hosted collaboration platform that offers chat, workflow automation, voice calling, screen sharing, and AI integration. This repo is the primary source for core development on the Mattermost platform; it's written in Go and React, runs as a single Linux binary, and relies on PostgreSQL. A new compiled version is released under an MIT license every month on the 16th.
Deploy Mattermost on-premises, or try it for free in the cloud.
Learn more about the following use cases with Mattermost:
Other useful resources:
- Download and Install Mattermost - Install, setup, and configure your own Mattermost instance.
- Product documentation - Learn how to run a Mattermost instance and take advantage of all the features.
- Developer documentation - Contribute code to Mattermost or build an integration via APIs, Webhooks, slash commands, Apps, and plugins.
Table of contents
- Install Mattermost
- Native mobile and desktop apps
- Get security bulletins
- Get involved
- Learn more
- License
- Get the latest news
- Contributing
Install Mattermost
- Download and Install Mattermost Self-Hosted - Deploy a Mattermost Self-hosted instance in minutes via Docker, Ubuntu, or tar.
- Get started in the cloud to try Mattermost today.
- Developer machine setup - Follow this guide if you want to write code for Mattermost.
Other install guides:
- Deploy Mattermost on Docker
- Mattermost Omnibus
- Install Mattermost from Tar
- Ubuntu 20.04 LTS
- Kubernetes
- Helm
- More server install guides
Native mobile and desktop apps
In addition to the web interface, you can also download Mattermost clients for Android, iOS, Windows PC, macOS, and Linux.
Get security bulletins
Receive notifications of critical security updates. The sophistication of online attackers is perpetually increasing. If you're deploying Mattermost it's highly recommended you subscribe to the Mattermost Security Bulletin mailing list for updates on critical security releases.
Get involved
- Contribute to Mattermost
- Find "Help Wanted" projects
- Join Developer Discussion on a Mattermost server for contributors
- Get Help With Mattermost
Learn more
- API options - webhooks, slash commands, drivers, and web service
- See who's using Mattermost
- Browse over 700 Mattermost integrations
License
See the LICENSE file for license rights and limitations.
Get the latest news
- X - Follow Mattermost on X, formerly Twitter.
- Blog - Get the latest updates from the Mattermost blog.
- Facebook - Follow Mattermost on Facebook.
- LinkedIn - Follow Mattermost on LinkedIn.
- Email - Subscribe to our newsletter (1 or 2 per month).
- Mattermost - Join the ~contributors channel on the Mattermost Community Server.
- IRC - Join the #matterbridge channel on Freenode (thanks to matterircd).
- YouTube - Subscribe to Mattermost.
Contributing
Please see CONTRIBUTING.md. Join the Mattermost Contributors server to join community discussions about contributions, development, and more.