[FIX] Validate room access (#24534)

Co-authored-by: Pierre Lehnen <[email protected]>
RocketChat · Jul 1, 2022 · 26c310c · 26c310c
1 parent 60638b9
commit 26c310c
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 7 deletions.
diff --git a/apps/meteor/client/lib/rooms/roomTypes/direct.ts b/apps/meteor/client/lib/rooms/roomTypes/direct.ts
@@ -2,7 +2,7 @@ import type { AtLeast } from '@rocket.chat/core-typings';
 import { Meteor } from 'meteor/meteor';
 import { Session } from 'meteor/session';
 
-import { hasAtLeastOnePermission, hasPermission } from '../../../../app/authorization/client';
+import { hasAtLeastOnePermission } from '../../../../app/authorization/client';
 import { Subscriptions, Users, ChatRoom } from '../../../../app/models/client';
 import { settings } from '../../../../app/settings/client';
 import { getUserPreference } from '../../../../app/utils/client';
@@ -134,10 +134,6 @@ roomCoordinator.add(DirectMessageRoomType, {
 	},
 
 	findRoom(identifier) {
-		if (!hasPermission('view-d-room')) {
-			return;
-		}
-
 		const query = {
 			t: 'd',
 			$or: [{ name: identifier }, { rid: identifier }],

diff --git a/apps/meteor/server/services/authorization/canAccessRoom.ts b/apps/meteor/server/services/authorization/canAccessRoom.ts
@@ -56,10 +56,16 @@ const roomAccessValidators: RoomAccessValidator[] = [
 		if (!room?._id || !user?._id) {
 			return false;
 		}
-		if (await Subscriptions.countByRoomIdAndUserId(room._id, user._id)) {
+
+		if (!(await Subscriptions.countByRoomIdAndUserId(room._id, user._id))) {
+			return false;
+		}
+
+		if (await Authorization.hasPermission(user._id, 'view-joined-room')) {
 			return true;
 		}
-		return false;
+
+		return Authorization.hasPermission(user._id, `view-${room.t}-room`);
 	},
 
 	async function _validateAccessToDiscussionsParentRoom(room, user): Promise<boolean> {