From 09af44a9edfb574687ce40e636a11f7ef34f306c Mon Sep 17 00:00:00 2001 From: Denis Arh Date: Mon, 9 Sep 2019 03:16:11 +0200 Subject: [PATCH] Fix access-control on member removal --- messaging/service/channel.go | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/messaging/service/channel.go b/messaging/service/channel.go index c9a718350..28974e5e7 100644 --- a/messaging/service/channel.go +++ b/messaging/service/channel.go @@ -836,10 +836,9 @@ func (svc *channel) DeleteMember(channelID uint64, memberIDs ...uint64) (err err continue } - if memberID == userID && !svc.ac.CanJoinChannel(svc.ctx, ch) { + if memberID == userID && !svc.ac.CanLeaveChannel(svc.ctx, ch) { return ErrNoPermissions.withStack() - } - if !svc.ac.CanManageChannelMembers(svc.ctx, ch) { + } else if memberID != userID && !svc.ac.CanManageChannelMembers(svc.ctx, ch) { return ErrNoPermissions.withStack() }