Regression: Room Endpoint Call Issues (#25928)

RocketChat · Jun 27, 2022 · 5109cd3 · 5109cd3
1 parent 579bd81
commit 5109cd3
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 11 deletions.
diff --git a/apps/meteor/app/api/server/v1/channels.ts b/apps/meteor/app/api/server/v1/channels.ts
@@ -20,7 +20,7 @@ import {
 } from '@rocket.chat/rest-typings';
 
 import { Rooms, Subscriptions, Messages } from '../../../models/server';
-import { hasPermission, hasAllPermission } from '../../../authorization/server';
+import { hasPermission } from '../../../authorization/server';
 import { normalizeMessagesForUser } from '../../../utils/server/lib/normalizeMessagesForUser';
 import { API } from '../api';
 import { Team } from '../../../../server/sdk';
@@ -454,7 +454,7 @@ API.v1.addRoute(
 	},
 	{
 		async post() {
-			if (!hasAllPermission(this.userId, ['create-team', 'edit-room'])) {
+			if (!hasPermission(this.userId, 'create-team')) {
 				return API.v1.unauthorized();
 			}
 
@@ -464,6 +464,10 @@ API.v1.addRoute(
 				return API.v1.failure('The parameter "channelId" or "channelName" is required');
 			}
 
+			if (!hasPermission(this.userId, 'edit-room', channelId)) {
+				return API.v1.unauthorized();
+			}
+
 			const room = findChannelByIdOrName({
 				params: {
 					roomId: channelId,

diff --git a/apps/meteor/client/views/room/contextualBar/Info/RoomInfo/RoomInfoWithData.js b/apps/meteor/client/views/room/contextualBar/Info/RoomInfo/RoomInfoWithData.js
@@ -56,15 +56,15 @@ const RoomInfoWithData = ({ rid, openEditing, onClickBack, onEnterRoom, resetSta
 	const dispatchToastMessage = useToastMessageDispatch();
 	const setModal = useSetModal();
 	const closeModal = useMutableCallback(() => setModal());
-	const deleteRoom = useEndpoint('POST', room.t === 'c' ? 'channels.delete' : 'groups.delete');
+	const deleteRoom = useEndpoint('POST', room.t === 'c' ? '/v1/channels.delete' : '/v1/groups.delete');
 	const hideRoom = useMethod('hideRoom');
 	const leaveRoom = useMethod('leaveRoom');
 	const router = useRoute('home');
 
-	const moveChannelToTeam = useEndpointActionExperimental('POST', 'teams.addRooms', t('Rooms_added_successfully'));
+	const moveChannelToTeam = useEndpointActionExperimental('POST', '/v1/teams.addRooms', t('Rooms_added_successfully'));
 	const convertRoomToTeam = useEndpointActionExperimental(
 		'POST',
-		type === 'c' ? 'channels.convertToTeam' : 'groups.convertToTeam',
+		type === 'c' ? '/v1/channels.convertToTeam' : '/v1/groups.convertToTeam',
 		t('Success'),
 	);
 

diff --git a/apps/meteor/client/views/teams/contextualBar/channels/RoomActions.js b/apps/meteor/client/views/teams/contextualBar/channels/RoomActions.js
@@ -30,11 +30,11 @@ const RoomActions = ({ room, reload }) => {
 	const canEditTeamChannel = usePermission('edit-team-channel', rid);
 	const canRemoveTeamChannel = usePermission('remove-team-channel', rid);
 
-	const updateRoomEndpoint = useEndpointActionExperimental('POST', 'teams.updateRoom');
-	const removeRoomEndpoint = useEndpointActionExperimental('POST', 'teams.removeRoom', t('Room_has_been_removed'));
+	const updateRoomEndpoint = useEndpointActionExperimental('POST', '/v1/teams.updateRoom');
+	const removeRoomEndpoint = useEndpointActionExperimental('POST', '/v1/teams.removeRoom', t('Room_has_been_removed'));
 	const deleteRoomEndpoint = useEndpointActionExperimental(
 		'POST',
-		room.t === 'c' ? 'channels.delete' : 'groups.delete',
+		room.t === 'c' ? '/v1/channels.delete' : '/v1/groups.delete',
 		t('Room_has_been_deleted'),
 	);
 

diff --git a/apps/meteor/client/views/teams/contextualBar/info/TeamsInfoWithData.js b/apps/meteor/client/views/teams/contextualBar/info/TeamsInfoWithData.js
@@ -60,9 +60,9 @@ const TeamsInfoWithLogic = ({ room, openEditing }) => {
 	const setModal = useSetModal();
 	const closeModal = useMutableCallback(() => setModal());
 
-	const deleteTeam = useEndpointActionExperimental('POST', 'teams.delete');
-	const leaveTeam = useEndpointActionExperimental('POST', 'teams.leave');
-	const convertTeamToChannel = useEndpointActionExperimental('POST', 'teams.convertToChannel');
+	const deleteTeam = useEndpointActionExperimental('POST', '/v1/teams.delete');
+	const leaveTeam = useEndpointActionExperimental('POST', '/V1/teams.leave');
+	const convertTeamToChannel = useEndpointActionExperimental('POST', '/v1/teams.convertToChannel');
 
 	const hideTeam = useMethod('hideRoom');