Further restrict UserInvite action to those with TeamEdit and TeamCreate permissions

[NickJosevski]

Summary

To further reflect the intention of the power of UserInvite it will now require additional privileges to be granted.

Reasoning

By inviting a user to an existing team, the user is editing a team, and causing the creation of a user. This would allow them to invite a user to a team with greater privilege than their own. To make it clear they will now require TeamEdit which makes it more obvious the power of this action.

CVE

CVE-2017-15611

[NickJosevski]

cert PR reference was a mistake.

[octoreleasebot]

Release Note: Prevent a potential security vulnerability (CVE-2017-15611) by further restricting User Invite action to those with TeamEdit and TeamCreate permissions

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. If you think you've found a related issue, please contact our support team so we can triage your issue, and make sure it's handled appropriately.