[IMPROVE] add permission check when adding a channel to a team (RocketChat#21689)

gabrieleiro · sampaiodiego · web-flow · commit 0136df587a96 · 2021-04-21T02:05:37.000-03:00
Co-authored-by: Diego Sampaio &lt;chinello@gmail.com&gt;
diff --git a/server/services/team/service.ts b/server/services/team/service.ts
@@ -324,6 +324,10 @@ export class TeamService extends ServiceClass implements ITeamService {
 				throw new Error('room-already-on-team');
 			}
 
+			if (room.u?._id !== uid) {
+				throw new Error('invalid-user');
+			}
+
 			room.teamId = teamId;
 		}
 

Original file line number	Diff line number	Diff line change
`@@ -324,6 +324,10 @@ export class TeamService extends ServiceClass implements ITeamService {`
`324`	`324`	`throw new Error('room-already-on-team');`
`325`	`325`	`}`
`326`	`326`
	`327`	`+ if (room.u?._id !== uid) {`
	`328`	`+ throw new Error('invalid-user');`
	`329`	`+ }`
	`330`	`+`
`327`	`331`	`room.teamId = teamId;`
`328`	`332`	`}`
`329`	`333`