DeforaNetworks/corteza
3
0
Fork 0
Code Activity

Fix sec check for channel join/part

Browse Source
This commit is contained in:
Denis Arh
2018-11-13 16:05:26 +01:00
parent d74825b40e
commit 01dee6f85c
1 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sam/service/channel.go
+10 -8
View File
@@ -622,10 +622,6 @@ func (svc *channel) AddMember(channelID uint64, memberIDs ...uint64) (out types.
return nil, errors.New("Adding members to a group is not currently supported")
}
if !ch.CanChangeMembers {
return nil, errors.New("Not allowed to add members")
}
return out, svc.db.Transaction(func() (err error) {
if existing, err = svc.cmember.Find(&types.ChannelMemberFilter{ChannelID: channelID}); err != nil {
return
@@ -654,6 +650,11 @@ func (svc *channel) AddMember(channelID uint64, memberIDs ...uint64) (out types.
}
}
// @todo [SECURITY] implement proper checking
if !(ch.CanChangeMembers || memberID == userID && ch.Type == types.ChannelTypePublic) {
return errors.New("Not allowed to add members")
}
if !exists {
if userID == memberID {
svc.scheduleSystemMessage(ch, "<@%d> joined", memberID)
@@ -708,10 +709,6 @@ func (svc *channel) DeleteMember(channelID uint64, memberIDs ...uint64) (err err
return errors.New("Removign members from a group is not currently supported")
}
if !ch.CanChangeMembers {
return errors.New("Not allowed to remove members")
}
return svc.db.Transaction(func() (err error) {
if existing, err = svc.cmember.Find(&types.ChannelMemberFilter{ChannelID: channelID}); err != nil {
return
@@ -723,6 +720,11 @@ func (svc *channel) DeleteMember(channelID uint64, memberIDs ...uint64) (err err
continue
}
// @todo [SECURITY] implement proper checking
if !(ch.CanChangeMembers || memberID == userID && ch.Type == types.ChannelTypePublic) {
return errors.New("Not allowed to add members")
}
if userID == memberID {
svc.scheduleSystemMessage(ch, "<@%d> parted", memberID)
} else {