closes #6136

NodeBB · Nov 29, 2017 · b193100 · b193100
1 parent b639147
commit b193100
Show file tree

Hide file tree

Showing 2 changed files with 41 additions and 10 deletions.
diff --git a/src/socket.io/modules.js b/src/socket.io/modules.js
@@ -21,17 +21,31 @@ SocketModules.settings = {};
 /* Chat */
 
 SocketModules.chats.getRaw = function (socket, data, callback) {
-	if (!data || !data.hasOwnProperty('mid') || !data.hasOwnProperty('roomId')) {
+	if (!data || !data.hasOwnProperty('mid')) {
 		return callback(new Error('[[error:invalid-data]]'));
 	}
 	async.waterfall([
 		function (next) {
-			Messaging.isUserInRoom(socket.uid, data.roomId, next);
+			Messaging.getMessageField(data.mid, 'roomId', next);
 		},
-		function (inRoom, next) {
+		function (roomId, next) {
-			if (!inRoom) {
+			async.parallel({
+				isAdmin: function (next) {
+					user.isAdministrator(socket.uid, next);
+				},
+				hasMessage: function (next) {
+					db.isSortedSetMember('uid:' + socket.uid + ':chat:room:' + roomId + ':mids', data.mid, next);
+				},
+				inRoom: function (next) {
+					Messaging.isUserInRoom(socket.uid, roomId, next);
+				},
+			}, next);
+		},
+		function (results, next) {
+			if (!results.isAdmin && (!results.inRoom || !results.hasMessage)) {
 				return next(new Error('[[error:not-allowed]]'));
 			}
+
 			Messaging.getMessageField(data.mid, 'content', next);
 		},
 	], callback);

diff --git a/test/messaging.js b/test/messaging.js
@@ -243,7 +243,7 @@ describe('Messaging Library', function () {
 				assert.equal(messageData.content, 'first chat message');
 				assert(messageData.fromUser);
 				assert(messageData.roomId, roomId);
-				socketModules.chats.getRaw({ uid: fooUid }, { roomId: roomId, mid: messageData.mid }, function (err, raw) {
+				socketModules.chats.getRaw({ uid: fooUid }, { mid: messageData.mid }, function (err, raw) {
 					assert.ifError(err);
 					assert.equal(raw, 'first chat message');
 					setTimeout(done, 300);
@@ -275,13 +275,30 @@ describe('Messaging Library', function () {
 			});
 		});
 
-		it('should return not in room error', function (done) {
+		it('should return not allowed error if mid is not in room', function (done) {
-			socketModules.chats.getRaw({ uid: 0 }, { roomId: roomId, mid: 1 }, function (err) {
+			var myRoomId;
-				assert.equal(err.message, '[[error:not-allowed]]');
+			User.create({ username: 'dummy' }, function (err, uid) {
-				done();
+				assert.ifError(err);
+				socketModules.chats.newRoom({ uid: bazUid }, { touid: uid }, function (err, _roomId) {
+					myRoomId = _roomId;
+					assert.ifError(err);
+					assert(myRoomId);
+					socketModules.chats.getRaw({ uid: bazUid }, { mid: 1 }, function (err) {
+						assert.equal(err.message, '[[error:not-allowed]]');
+						socketModules.chats.send({ uid: bazUid }, { roomId: myRoomId, message: 'admin will see this' }, function (err, message) {
+							assert.ifError(err);
+							socketModules.chats.getRaw({ uid: fooUid }, { mid: message.mid }, function (err, raw) {
+								assert.ifError(err);
+								assert.equal(raw, 'admin will see this');
+								done();
+							});
+						});
+					});
+				});
 			});
 		});
 
+
 		it('should notify offline users of message', function (done) {
 			Messaging.notificationSendDelay = 100;
 
@@ -507,7 +524,7 @@ describe('Messaging Library', function () {
 		it('should edit message', function (done) {
 			socketModules.chats.edit({ uid: fooUid }, { mid: mid, roomId: roomId, message: 'message edited' }, function (err) {
 				assert.ifError(err);
-				socketModules.chats.getRaw({ uid: fooUid }, { roomId: roomId, mid: mid }, function (err, raw) {
+				socketModules.chats.getRaw({ uid: fooUid }, { mid: mid }, function (err, raw) {
 					assert.ifError(err);
 					assert.equal(raw, 'message edited');
 					done();