opensource/mattermost
3
0
Fork 0
mirror of https://github.com/mattermost/mattermost.git synced 2026-09-24 16:05:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

MM-8814: Remove implicit permission grants from post ownership. (#8391)

Browse Source
This commit is contained in:
George Goldberg
2018-05-28 09:46:52 -04:00
committed by Martin Kraft
parent be177caf5f
commit 7225abddee
2 changed files with 35 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api4/post.go
+35 -6
View File
@@ -246,11 +246,24 @@ func deletePost(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
if !c.App.SessionHasPermissionToPost(c.Session, c.Params.PostId, model.PERMISSION_DELETE_OTHERS_POSTS) {
c.SetPermissionError(model.PERMISSION_DELETE_OTHERS_POSTS)
post, err := c.App.GetSinglePost(c.Params.PostId)
if err != nil {
c.SetPermissionError(model.PERMISSION_DELETE_POST)
return
}
if c.Session.UserId == post.UserId {
if !c.App.SessionHasPermissionToChannel(c.Session, post.ChannelId, model.PERMISSION_DELETE_POST) {
c.SetPermissionError(model.PERMISSION_DELETE_POST)
return
}
} else {
if !c.App.SessionHasPermissionToChannel(c.Session, post.ChannelId, model.PERMISSION_DELETE_OTHERS_POSTS) {
c.SetPermissionError(model.PERMISSION_DELETE_OTHERS_POSTS)
return
}
}
if _, err := c.App.DeletePost(c.Params.PostId); err != nil {
c.Err = err
return
@@ -364,11 +377,19 @@ func updatePost(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
if !c.App.SessionHasPermissionToPost(c.Session, c.Params.PostId, model.PERMISSION_EDIT_OTHERS_POSTS) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHERS_POSTS)
originalPost, err := c.App.GetSinglePost(c.Params.PostId)
if err != nil {
c.SetPermissionError(model.PERMISSION_EDIT_POST)
return
}
if c.Session.UserId != originalPost.UserId {
if !c.App.SessionHasPermissionToChannelByPost(c.Session, c.Params.PostId, model.PERMISSION_EDIT_OTHERS_POSTS) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHERS_POSTS)
return
}
}
post.Id = c.Params.PostId
rpost, err := c.App.UpdatePost(c.App.PostWithProxyRemovedFromImageURLs(post), false)
@@ -398,11 +419,19 @@ func patchPost(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
if !c.App.SessionHasPermissionToPost(c.Session, c.Params.PostId, model.PERMISSION_EDIT_OTHERS_POSTS) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHERS_POSTS)
originalPost, err := c.App.GetSinglePost(c.Params.PostId)
if err != nil {
c.SetPermissionError(model.PERMISSION_EDIT_POST)
return
}
if c.Session.UserId != originalPost.UserId {
if !c.App.SessionHasPermissionToChannelByPost(c.Session, c.Params.PostId, model.PERMISSION_EDIT_OTHERS_POSTS) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHERS_POSTS)
return
}
}
patchedPost, err := c.App.PatchPost(c.Params.PostId, c.App.PostPatchWithProxyRemovedFromImageURLs(post))
if err != nil {
c.Err = err
app/authorization.go
-13
View File
@@ -94,19 +94,6 @@ func (a *App) SessionHasPermissionToUser(session model.Session, userId string) b
return false
}
func (a *App) SessionHasPermissionToPost(session model.Session, postId string, permission *model.Permission) bool {
post, err := a.GetSinglePost(postId)
if err != nil {
return false
}
if post.UserId == session.UserId {
return true
}
return a.SessionHasPermissionToChannel(session, post.ChannelId, permission)
}
func (a *App) HasPermissionTo(askingUserId string, permission *model.Permission) bool {
user, err := a.GetUser(askingUserId)
if err != nil {