DeforaNetworks/corteza
3
0
Fork 0
Code Activity

Fix access-control on member removal

Browse Source
This commit is contained in:
Denis Arh
2019-09-09 03:16:11 +02:00
parent 42be30587f
commit 09af44a9ed
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
messaging/service/channel.go
+2 -3
View File
@@ -836,10 +836,9 @@ func (svc *channel) DeleteMember(channelID uint64, memberIDs ...uint64) (err err
continue
}
if memberID == userID && !svc.ac.CanJoinChannel(svc.ctx, ch) {
if memberID == userID && !svc.ac.CanLeaveChannel(svc.ctx, ch) {
return ErrNoPermissions.withStack()
}
if !svc.ac.CanManageChannelMembers(svc.ctx, ch) {
} else if memberID != userID && !svc.ac.CanManageChannelMembers(svc.ctx, ch) {
return ErrNoPermissions.withStack()
}