luisgulo/focalboard
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #2716 from mattermost/gh-2712-fix-templates

Browse source 
GH-2712:Don't check team permission for GlobalTeamID
This commit is contained in:
Scott Bishel 2022-04-04 09:48:09 -06:00 committed by GitHub
commit 3757c19a6d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 13 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
server/api/api.go
View file

@ -287,7 +287,7 @@ func (a *API) handleGetBlocks(w http.ResponseWriter, r *http.Request) {
if !a.hasValidReadTokenForBoard(r, boardID) {
if board.IsTemplate {
if !a.permissions.HasPermissionToTeam(userID, board.TeamID, model.PermissionViewTeam) {
if board.TeamID != model.GlobalTeamID && !a.permissions.HasPermissionToTeam(userID, board.TeamID, model.PermissionViewTeam) {
a.errorResponse(w, r.URL.Path, http.StatusForbidden, "", PermissionError{"access denied to board template"})
return
}
@ -1879,7 +1879,7 @@ func (a *API) handleGetTemplates(w http.ResponseWriter, r *http.Request) {
teamID := mux.Vars(r)["teamID"]
userID := getUserID(r)
if teamID != "0" && !a.permissions.HasPermissionToTeam(userID, teamID, model.PermissionViewTeam) {
if teamID != model.GlobalTeamID && !a.permissions.HasPermissionToTeam(userID, teamID, model.PermissionViewTeam) {
a.errorResponse(w, r.URL.Path, http.StatusForbidden, "", PermissionError{"access denied to team"})
return
}
@ -2553,7 +2553,7 @@ func (a *API) handleDuplicateBoard(w http.ResponseWriter, r *http.Request) {
return
}
} else {
if !a.permissions.HasPermissionToTeam(userID, board.TeamID, model.PermissionViewTeam) {
if board.TeamID != model.GlobalTeamID && !a.permissions.HasPermissionToTeam(userID, board.TeamID, model.PermissionViewTeam) {
a.errorResponse(w, r.URL.Path, http.StatusForbidden, "", PermissionError{"access denied to board"})
return
}

4
server/app/onboarding.go
View file

@ -46,14 +46,14 @@ func (a *App) PrepareOnboardingTour(userID string, teamID string) (string, strin
}
func (a *App) getOnboardingBoardID() (string, error) {
boards, err := a.store.GetTemplateBoards(globalTeamID, "")
boards, err := a.store.GetTemplateBoards(model.GlobalTeamID, "")
if err != nil {
return "", err
}
var onboardingBoardID string
for _, block := range boards {
if block.Title == WelcomeBoardTitle && block.TeamID == globalTeamID {
if block.Title == WelcomeBoardTitle && block.TeamID == model.GlobalTeamID {
onboardingBoardID = block.ID
break
}

7
server/app/templates.go
View file

@ -13,7 +13,6 @@ import (
const (
defaultTemplateVersion = 2
globalTeamID = "0"
)
func (a *App) InitTemplates() error {
@ -23,7 +22,7 @@ func (a *App) InitTemplates() error {
// initializeTemplates imports default templates if the boards table is empty.
func (a *App) initializeTemplates() (bool, error) {
boards, err := a.store.GetTemplateBoards(globalTeamID, "")
boards, err := a.store.GetTemplateBoards(model.GlobalTeamID, "")
if err != nil {
return false, fmt.Errorf("cannot initialize templates: %w", err)
}
@ -49,13 +48,13 @@ func (a *App) initializeTemplates() (bool, error) {
r := bytes.NewReader(assets.DefaultTemplatesArchive)
opt := model.ImportArchiveOptions{
TeamID: globalTeamID,
TeamID: model.GlobalTeamID,
ModifiedBy: "system",
BlockModifier: fixTemplateBlock,
BoardModifier: fixTemplateBoard,
}
if err = a.ImportArchive(r, opt); err != nil {
return false, fmt.Errorf("cannot initialize global templates for team %s: %w", globalTeamID, err)
return false, fmt.Errorf("cannot initialize global templates for team %s: %w", model.GlobalTeamID, err)
}
return true, nil
}

6
server/app/templates_test.go
View file

@ -14,7 +14,7 @@ import (
func TestApp_initializeTemplates(t *testing.T) {
board := &model.Board{
ID: utils.NewID(utils.IDTypeBoard),
TeamID: globalTeamID,
TeamID: model.GlobalTeamID,
Type: model.BoardTypeOpen,
Title: "test board",
IsTemplate: true,
@ -43,7 +43,7 @@ func TestApp_initializeTemplates(t *testing.T) {
th, tearDown := SetupTestHelper(t)
defer tearDown()
th.Store.EXPECT().GetTemplateBoards(globalTeamID, "").Return([]*model.Board{}, nil)
th.Store.EXPECT().GetTemplateBoards(model.GlobalTeamID, "").Return([]*model.Board{}, nil)
th.Store.EXPECT().RemoveDefaultTemplates([]*model.Board{}).Return(nil)
th.Store.EXPECT().CreateBoardsAndBlocks(gomock.Any(), gomock.Any()).AnyTimes().Return(boardsAndBlocks, nil)
th.Store.EXPECT().GetMembersForBoard(board.ID).AnyTimes().Return([]*model.BoardMember{}, nil)
@ -61,7 +61,7 @@ func TestApp_initializeTemplates(t *testing.T) {
th, tearDown := SetupTestHelper(t)
defer tearDown()
th.Store.EXPECT().GetTemplateBoards(globalTeamID, "").Return([]*model.Board{board}, nil)
th.Store.EXPECT().GetTemplateBoards(model.GlobalTeamID, "").Return([]*model.Board{board}, nil)
done, err := th.App.initializeTemplates()
require.NoError(t, err, "initializeTemplates should not error")

3
server/model/user.go
View file

@ -6,7 +6,8 @@ import (
)
const (
SingleUser = "single-user"
SingleUser = "single-user"
GlobalTeamID = "0"
)
// User is a user