luisgulo/focalboard
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Update query to only allow open boards for team members (#4335)

Browse source 
* update query to only allow open boards for team members

* remove debug lines
This commit is contained in:
Scott Bishel 2022-12-14 10:56:40 -07:00 committed by GitHub
parent bfb85fd1e0
commit f20f0c6d9d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 16 additions and 42 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

58
server/services/store/mattermostauthlayer/mattermostauthlayer.go
View file

@ -676,35 +676,14 @@ func (s *MattermostAuthLayer) SearchBoardsForUser(term, userID string, includePu
// question mark placeholder here // question mark placeholder here
builder := s.getQueryBuilder().PlaceholderFormat(sq.Question) builder := s.getQueryBuilder().PlaceholderFormat(sq.Question)
var boardMembersWhere sq.Or
var channelMembersWhere sq.Or
if includePublicBoards {
boardMembersWhere = sq.Or{
sq.Eq{"b.type": model.BoardTypeOpen},
sq.Eq{"bm.user_id": userID},
}
channelMembersWhere = sq.Or{
sq.Eq{"b.type": model.BoardTypeOpen},
sq.Eq{"cm.userId": userID},
}
} else {
boardMembersWhere = sq.Or{
sq.Eq{"bm.user_id": userID},
}
channelMembersWhere = sq.Or{
sq.Eq{"cm.userId": userID},
}
}
boardMembersQ := builder. boardMembersQ := builder.
Select(boardFields("b.")...). Select(boardFields("b.")...).
From(s.tablePrefix + "boards as b"). From(s.tablePrefix + "boards as b").
Join(s.tablePrefix + "board_members as bm on b.id=bm.board_id"). Join(s.tablePrefix + "board_members as bm on b.id=bm.board_id").
Where(sq.Eq{ Where(sq.Eq{
"b.is_template": false, "b.is_template": false,
}). "bm.user_id": userID,
Where(boardMembersWhere) })
teamMembersQ := builder. teamMembersQ := builder.
Select(boardFields("b.")...). Select(boardFields("b.")...).
@ -714,6 +693,7 @@ func (s *MattermostAuthLayer) SearchBoardsForUser(term, userID string, includePu
"b.is_template": false, "b.is_template": false,
"tm.userID": userID, "tm.userID": userID,
"tm.deleteAt": 0, "tm.deleteAt": 0,
"b.type": model.BoardTypeOpen,
}) })
channelMembersQ := builder. channelMembersQ := builder.
@ -722,8 +702,8 @@ func (s *MattermostAuthLayer) SearchBoardsForUser(term, userID string, includePu
Join("ChannelMembers as cm on cm.channelId=b.channel_id"). Join("ChannelMembers as cm on cm.channelId=b.channel_id").
Where(sq.Eq{ Where(sq.Eq{
"b.is_template": false, "b.is_template": false,
}). "cm.userId": userID,
Where(channelMembersWhere) })
if term != "" { if term != "" {
// break search query into space separated words // break search query into space separated words
@ -753,30 +733,24 @@ func (s *MattermostAuthLayer) SearchBoardsForUser(term, userID string, includePu
return nil, fmt.Errorf("SearchBoardsForUser error getting channelMembersSQL: %w", err) return nil, fmt.Errorf("SearchBoardsForUser error getting channelMembersSQL: %w", err)
} }
unionQ := boardMembersQ. unionQ := boardMembersQ
Prefix("(").
Suffix(") UNION ("+teamMembersSQL, teamMembersArgs...).
Suffix(") UNION ("+channelMembersSQL+")", channelMembersArgs...)
user, err := s.GetUserByID(userID) user, err := s.GetUserByID(userID)
if err != nil { if err != nil {
return nil, err return nil, err
} }
// NOTE: theoretically, could do e.g. `isGuest := !includePublicBoards` // NOTE: theoretically, could do e.g. `isGuest := !includePublicBoards`
// but that introduces some tight coupling + fragility // but that introduces some tight coupling + fragility
if user.IsGuest { if !user.IsGuest {
var explicitMembers []*model.BoardMember unionQ = unionQ.
explicitMembers, err = s.Store.GetMembersForUser(userID) Prefix("(").
if err != nil { Suffix(") UNION ("+channelMembersSQL+")", channelMembersArgs...)
s.logger.Error(`getMembersForUser ERROR`, mlog.Err(err)) if includePublicBoards {
return nil, err unionQ = unionQ.Suffix(" UNION ("+teamMembersSQL+")", teamMembersArgs...)
} }
boardIDs := []string{} } else if includePublicBoards {
for _, m := range explicitMembers { unionQ = unionQ.
boardIDs = append(boardIDs, m.BoardID) Prefix("(").
} Suffix(") UNION ("+teamMembersSQL+")", teamMembersArgs...)
// Only explicit memberships for guests
unionQ = unionQ.Where(sq.Eq{"b.id": boardIDs})
} }
unionSQL, unionArgs, err := unionQ.ToSql() unionSQL, unionArgs, err := unionQ.ToSql()