-
Notifications
You must be signed in to change notification settings - Fork 7.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
MM-58525 Fix upload file permissions #27298
Conversation
@sbishel: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it. I understand the commands that are listed here |
/update-branch |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Batching the data migrations is probably overkill. There would only be 2 rows per Team Schema Override, so it would take 50 schema overrides (very doubtful) and all would have to have "create_post" removed for the loop to occur.
But...the documentation provided the code sample, so it was easy enough to add.
Not triggering E2E tests: this PR is a draft. Mark this PR as ready for review, before triggering the E2E tests. |
1 similar comment
Not triggering E2E tests: this PR is a draft. Mark this PR as ready for review, before triggering the E2E tests. |
-- update affected rows | ||
UPDATE Roles | ||
SET Permissions = REGEXP_REPLACE(Permissions, 'upload_file[[:space:]|?]', '') | ||
WHERE Permissions like '%upload_file%' and Permissions not REGEXP 'create_post[[:space:]|?]' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There is a permission create_post_public
. Need to use regex, to ensure this one is not selected.
server/channels/db/migrations/postgres/000122_remove_upload_file_permission.up.sql
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @sbishel - looks good to me 👍
Test server destroyed |
/update-branch |
/cherry-pick release-9.10 |
Cherry pick is scheduled. |
Error trying doing the automated Cherry picking. Please do this manually
|
@sbishel Can you help submit a manual cherry-pick PR for |
/cherry-pick release-9.10 |
Cherry pick is scheduled. |
Error trying doing the automated Cherry picking. Please do this manually
|
@sbishel Can you help submit manual cherry-picks PR for |
* tie create_post and upload_file permissions together * update tests * update file name * update migration to do in batches * Update 000122_remove_upload_file_permission.up.sql * fix formatting * simplify migrations, fix regex issue * update file names for recent merge --------- Co-authored-by: Mattermost Build <build@mattermost.com> (cherry picked from commit 71c25fb)
* tie create_post and upload_file permissions together * update tests * update file name * update migration to do in batches * Update 000122_remove_upload_file_permission.up.sql * fix formatting * simplify migrations, fix regex issue * update file names for recent merge --------- Co-authored-by: Mattermost Build <build@mattermost.com> (cherry picked from commit 71c25fb)
* tie create_post and upload_file permissions together * update tests * update file name * update migration to do in batches * Update 000122_remove_upload_file_permission.up.sql * fix formatting * simplify migrations, fix regex issue * update file names for recent merge --------- Co-authored-by: Mattermost Build <build@mattermost.com> (cherry picked from commit 71c25fb)
* tie create_post and upload_file permissions together * update tests * update file name * update migration to do in batches * Update 000122_remove_upload_file_permission.up.sql * fix formatting * simplify migrations, fix regex issue * update file names for recent merge --------- Co-authored-by: Mattermost Build <build@mattermost.com> (cherry picked from commit 71c25fb)
Summary
Both
create_post
andupload_file
are default permissions on a ChannelUser and ChannelGuest role. Thecreate_post
permission can be removed from either a ChannelUser or a ChannelGuest in the System Console. However, there is not a way to remove theupload_file
permission.The
upload_file
is checked when a user attempts to upload a file via API. Therefore, a user withcreate_post
removed can still upload a file via API.This PR ties the two permission together for the ChannelUser and ChannelGuest roles. It also createa a database migration to remove
upload_file
where thecreate_post
permission does not exist.Ticket Link
Fixes https://mattermost.atlassian.net/browse/MM-58525
Screenshots
Release Note