diff --git a/packages/rocketchat-lib/server/methods/filterATAllTag.js b/packages/rocketchat-lib/server/methods/filterATAllTag.js index f0469ee81a17..d4205e0c947a 100644 --- a/packages/rocketchat-lib/server/methods/filterATAllTag.js +++ b/packages/rocketchat-lib/server/methods/filterATAllTag.js @@ -5,8 +5,8 @@ RocketChat.callbacks.add('beforeSaveMessage', function(message) { if (message.mentions != null && _.pluck(message.mentions, '_id').some((item) => item === 'all')) { - // Check if the user has permissions to use @all. - if (!RocketChat.authz.hasPermission(message.u._id, 'mention-all')) { + // Check if the user has permissions to use @all in both global and room scopes. + if (!RocketChat.authz.hasPermission(message.u._id, 'mention-all') && !RocketChat.authz.hasPermission(message.u._id, 'mention-all', message.rid)) { // Get the language of the user for the error notification. const language = RocketChat.models.Users.findOneById(message.u._id).language;