From 01dee6f85c70c327542cacba05f71d0f52c1d6b7 Mon Sep 17 00:00:00 2001 From: Denis Arh Date: Tue, 13 Nov 2018 16:05:26 +0100 Subject: [PATCH] Fix sec check for channel join/part --- sam/service/channel.go | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/sam/service/channel.go b/sam/service/channel.go index 9c79c8351..dbbc0b475 100644 --- a/sam/service/channel.go +++ b/sam/service/channel.go @@ -622,10 +622,6 @@ func (svc *channel) AddMember(channelID uint64, memberIDs ...uint64) (out types. return nil, errors.New("Adding members to a group is not currently supported") } - if !ch.CanChangeMembers { - return nil, errors.New("Not allowed to add members") - } - return out, svc.db.Transaction(func() (err error) { if existing, err = svc.cmember.Find(&types.ChannelMemberFilter{ChannelID: channelID}); err != nil { return @@ -654,6 +650,11 @@ func (svc *channel) AddMember(channelID uint64, memberIDs ...uint64) (out types. } } + // @todo [SECURITY] implement proper checking + if !(ch.CanChangeMembers || memberID == userID && ch.Type == types.ChannelTypePublic) { + return errors.New("Not allowed to add members") + } + if !exists { if userID == memberID { svc.scheduleSystemMessage(ch, "<@%d> joined", memberID) @@ -708,10 +709,6 @@ func (svc *channel) DeleteMember(channelID uint64, memberIDs ...uint64) (err err return errors.New("Removign members from a group is not currently supported") } - if !ch.CanChangeMembers { - return errors.New("Not allowed to remove members") - } - return svc.db.Transaction(func() (err error) { if existing, err = svc.cmember.Find(&types.ChannelMemberFilter{ChannelID: channelID}); err != nil { return @@ -723,6 +720,11 @@ func (svc *channel) DeleteMember(channelID uint64, memberIDs ...uint64) (err err continue } + // @todo [SECURITY] implement proper checking + if !(ch.CanChangeMembers || memberID == userID && ch.Type == types.ChannelTypePublic) { + return errors.New("Not allowed to add members") + } + if userID == memberID { svc.scheduleSystemMessage(ch, "<@%d> parted", memberID) } else {