Check for mention-all permission in room scope (#8931)

Closes #8033
RocketChat · Dec 1, 2017 · 9c34c10 · 9c34c10
1 parent 4f4a90c
commit 9c34c10
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/packages/rocketchat-lib/server/methods/filterATAllTag.js b/packages/rocketchat-lib/server/methods/filterATAllTag.js
@@ -5,8 +5,8 @@ RocketChat.callbacks.add('beforeSaveMessage', function(message) {
 	if (message.mentions != null &&
 		_.pluck(message.mentions, '_id').some((item) => item === 'all')) {
 
-		// Check if the user has permissions to use @all.
-		if (!RocketChat.authz.hasPermission(message.u._id, 'mention-all')) {
+		// Check if the user has permissions to use @all in both global and room scopes.
+		if (!RocketChat.authz.hasPermission(message.u._id, 'mention-all') && !RocketChat.authz.hasPermission(message.u._id, 'mention-all', message.rid)) {
 
 			// Get the language of the user for the error notification.
 			const language = RocketChat.models.Users.findOneById(message.u._id).language;