diff --git a/apps/meteor/app/api/server/v1/channels.ts b/apps/meteor/app/api/server/v1/channels.ts index 484c2a077081..e77826fd14fc 100644 --- a/apps/meteor/app/api/server/v1/channels.ts +++ b/apps/meteor/app/api/server/v1/channels.ts @@ -20,7 +20,7 @@ import { } from '@rocket.chat/rest-typings'; import { Rooms, Subscriptions, Messages } from '../../../models/server'; -import { hasPermission, hasAllPermission } from '../../../authorization/server'; +import { hasPermission } from '../../../authorization/server'; import { normalizeMessagesForUser } from '../../../utils/server/lib/normalizeMessagesForUser'; import { API } from '../api'; import { Team } from '../../../../server/sdk'; @@ -454,7 +454,7 @@ API.v1.addRoute( }, { async post() { - if (!hasAllPermission(this.userId, ['create-team', 'edit-room'])) { + if (!hasPermission(this.userId, 'create-team')) { return API.v1.unauthorized(); } @@ -464,6 +464,10 @@ API.v1.addRoute( return API.v1.failure('The parameter "channelId" or "channelName" is required'); } + if (!hasPermission(this.userId, 'edit-room', channelId)) { + return API.v1.unauthorized(); + } + const room = findChannelByIdOrName({ params: { roomId: channelId, diff --git a/apps/meteor/client/views/room/contextualBar/Info/RoomInfo/RoomInfoWithData.js b/apps/meteor/client/views/room/contextualBar/Info/RoomInfo/RoomInfoWithData.js index adf20054512c..55ba60e259cf 100644 --- a/apps/meteor/client/views/room/contextualBar/Info/RoomInfo/RoomInfoWithData.js +++ b/apps/meteor/client/views/room/contextualBar/Info/RoomInfo/RoomInfoWithData.js @@ -56,15 +56,15 @@ const RoomInfoWithData = ({ rid, openEditing, onClickBack, onEnterRoom, resetSta const dispatchToastMessage = useToastMessageDispatch(); const setModal = useSetModal(); const closeModal = useMutableCallback(() => setModal()); - const deleteRoom = useEndpoint('POST', room.t === 'c' ? 'channels.delete' : 'groups.delete'); + const deleteRoom = useEndpoint('POST', room.t === 'c' ? '/v1/channels.delete' : '/v1/groups.delete'); const hideRoom = useMethod('hideRoom'); const leaveRoom = useMethod('leaveRoom'); const router = useRoute('home'); - const moveChannelToTeam = useEndpointActionExperimental('POST', 'teams.addRooms', t('Rooms_added_successfully')); + const moveChannelToTeam = useEndpointActionExperimental('POST', '/v1/teams.addRooms', t('Rooms_added_successfully')); const convertRoomToTeam = useEndpointActionExperimental( 'POST', - type === 'c' ? 'channels.convertToTeam' : 'groups.convertToTeam', + type === 'c' ? '/v1/channels.convertToTeam' : '/v1/groups.convertToTeam', t('Success'), ); diff --git a/apps/meteor/client/views/teams/contextualBar/channels/RoomActions.js b/apps/meteor/client/views/teams/contextualBar/channels/RoomActions.js index c47f2b9bab2f..4f332441ccad 100644 --- a/apps/meteor/client/views/teams/contextualBar/channels/RoomActions.js +++ b/apps/meteor/client/views/teams/contextualBar/channels/RoomActions.js @@ -30,11 +30,11 @@ const RoomActions = ({ room, reload }) => { const canEditTeamChannel = usePermission('edit-team-channel', rid); const canRemoveTeamChannel = usePermission('remove-team-channel', rid); - const updateRoomEndpoint = useEndpointActionExperimental('POST', 'teams.updateRoom'); - const removeRoomEndpoint = useEndpointActionExperimental('POST', 'teams.removeRoom', t('Room_has_been_removed')); + const updateRoomEndpoint = useEndpointActionExperimental('POST', '/v1/teams.updateRoom'); + const removeRoomEndpoint = useEndpointActionExperimental('POST', '/v1/teams.removeRoom', t('Room_has_been_removed')); const deleteRoomEndpoint = useEndpointActionExperimental( 'POST', - room.t === 'c' ? 'channels.delete' : 'groups.delete', + room.t === 'c' ? '/v1/channels.delete' : '/v1/groups.delete', t('Room_has_been_deleted'), ); diff --git a/apps/meteor/client/views/teams/contextualBar/info/TeamsInfoWithData.js b/apps/meteor/client/views/teams/contextualBar/info/TeamsInfoWithData.js index de4d72d14e0e..c49d310543e4 100644 --- a/apps/meteor/client/views/teams/contextualBar/info/TeamsInfoWithData.js +++ b/apps/meteor/client/views/teams/contextualBar/info/TeamsInfoWithData.js @@ -60,9 +60,9 @@ const TeamsInfoWithLogic = ({ room, openEditing }) => { const setModal = useSetModal(); const closeModal = useMutableCallback(() => setModal()); - const deleteTeam = useEndpointActionExperimental('POST', 'teams.delete'); - const leaveTeam = useEndpointActionExperimental('POST', 'teams.leave'); - const convertTeamToChannel = useEndpointActionExperimental('POST', 'teams.convertToChannel'); + const deleteTeam = useEndpointActionExperimental('POST', '/v1/teams.delete'); + const leaveTeam = useEndpointActionExperimental('POST', '/V1/teams.leave'); + const convertTeamToChannel = useEndpointActionExperimental('POST', '/v1/teams.convertToChannel'); const hideTeam = useMethod('hideRoom');