[Fix] Voip endpoint permissions

RocketChat · Jun 8, 2022 · 95558fd · 95558fd
1 parent b021a2f
commit 95558fd
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/apps/meteor/app/api/server/v1/voip/rooms.ts b/apps/meteor/app/api/server/v1/voip/rooms.ts
@@ -82,7 +82,11 @@ const parseAndValidate = (property: string, date?: string): DateParam => {
 
 API.v1.addRoute(
 	'voip/room',
-	{ authRequired: false, rateLimiterOptions: { numRequestsAllowed: 5, intervalTimeInMS: 60000 } },
+	{
+		authRequired: true,
+		rateLimiterOptions: { numRequestsAllowed: 5, intervalTimeInMS: 60000 },
+		permissionsRequired: ['inbound-voip-calls'],
+	},
 	{
 		async get() {
 			const defaultCheckParams = {
@@ -212,7 +216,7 @@ API.v1.addRoute(
  */
 API.v1.addRoute(
 	'voip/room.close',
-	{ authRequired: true },
+	{ authRequired: true, permissionsRequired: ['inbound-voip-calls'] },
 	{
 		async post() {
 			check(this.bodyParams, {