[FIX] Do not prevent external users from being added in channels on CE (

#26281)
RocketChat · Jul 18, 2022 · d90308d · d90308d
1 parent c680bf4
commit d90308d
Show file tree

Hide file tree

Showing 5 changed files with 30 additions and 10 deletions.
diff --git a/apps/meteor/app/federation-v2/server/application/RoomServiceSender.ts b/apps/meteor/app/federation-v2/server/application/RoomServiceSender.ts
@@ -148,18 +148,31 @@ export class FederationRoomServiceSender {
 		}
 	}
 
-	public async canAddUsersToTheRoom(internalUser: IUser | string, internalRoom: IRoom): Promise<void> {
-		const newUserBeingAdded = typeof internalUser === 'string';
-		if (newUserBeingAdded) {
+	public async canAddUsersToTheRoom(internalUser: IUser | string, internalInviter: IUser, internalRoom: IRoom): Promise<void> {
+		if (!internalRoom.federated) {
 			return;
 		}
-
-		if (!internalRoom.federated) {
+		const invitee = await this.rocketUserAdapter.getFederatedUserByInternalId((internalUser as IUser)._id);
+		const inviter = await this.rocketUserAdapter.getFederatedUserByInternalId((internalInviter as IUser)._id);
+		const externalRoom = await this.rocketRoomAdapter.getFederatedRoomByInternalId(internalRoom._id);
+		if (!externalRoom || !inviter) {
 			return;
 		}
 
-		const user = await this.rocketUserAdapter.getFederatedUserByInternalId((internalUser as IUser)._id);
-		if (user && !user.existsOnlyOnProxyServer && internalRoom.t !== RoomType.DIRECT_MESSAGE) {
+		const isARoomFromTheProxyServer = this.bridge.isRoomFromTheSameHomeserver(
+			externalRoom.externalId,
+			this.rocketSettingsAdapter.getHomeServerDomain(),
+		);
+		const isInviterFromTheProxyServer = this.bridge.isUserIdFromTheSameHomeserver(
+			inviter.externalId,
+			this.rocketSettingsAdapter.getHomeServerDomain(),
+		);
+
+		if (!isARoomFromTheProxyServer && !isInviterFromTheProxyServer) {
+			return;
+		}
+		const tryingToAddNewFederatedUser = typeof internalUser === 'string';
+		if (tryingToAddNewFederatedUser || (invitee && !invitee.existsOnlyOnProxyServer && internalRoom.t !== RoomType.DIRECT_MESSAGE)) {
 			throw new Error('error-this-is-an-ee-feature');
 		}
 	}

diff --git a/apps/meteor/app/federation-v2/server/domain/IFederationBridge.ts b/apps/meteor/app/federation-v2/server/domain/IFederationBridge.ts
@@ -9,6 +9,7 @@ export interface IFederationBridge {
 	sendMessage(externalRoomId: string, externaSenderId: string, text: string): Promise<void>;
 	createUser(username: string, name: string, domain: string): Promise<string>;
 	isUserIdFromTheSameHomeserver(externalUserId: string, domain: string): boolean;
+	isRoomFromTheSameHomeserver(externalUserId: string, domain: string): boolean;
 	leaveRoom(externalRoomId: string, externalUserId: string): Promise<void>;
 	kickUserFromRoom(externalRoomId: string, externalUserId: string, externalOwnerId: string): Promise<void>;
 }

diff --git a/apps/meteor/app/federation-v2/server/infrastructure/Factory.ts b/apps/meteor/app/federation-v2/server/infrastructure/Factory.ts
@@ -92,7 +92,9 @@ export class FederationFactory {
 			roomServiceSender.leaveRoom(FederationRoomSenderConverter.toAfterLeaveRoom(user._id, room._id, userWhoRemoved._id)),
 		);
 		FederationHooks.canAddTheUserToTheRoom((user: IUser | string, room: IRoom) => roomServiceSender.canAddThisUserToTheRoom(user, room));
-		FederationHooks.canAddUsersToTheRoom((user: IUser | string, room: IRoom) => roomServiceSender.canAddUsersToTheRoom(user, room));
+		FederationHooks.canAddUsersToTheRoom((user: IUser | string, inviter: IUser, room: IRoom) =>
+			roomServiceSender.canAddUsersToTheRoom(user, inviter, room),
+		);
 		FederationHooks.beforeCreateDirectMessage((members: (IUser | string)[]) => roomServiceSender.beforeCreateDirectMessageFromUI(members));
 	}
 

diff --git a/apps/meteor/app/federation-v2/server/infrastructure/matrix/Bridge.ts b/apps/meteor/app/federation-v2/server/infrastructure/matrix/Bridge.ts
@@ -159,6 +159,10 @@ export class MatrixBridge implements IFederationBridge {
 		this.bridgeInstance.getIntent(externalOwnerId).kick(externalRoomId, externalUserId);
 	}
 
+	public isRoomFromTheSameHomeserver(externalRoomId: string, domain: string): boolean {
+		return this.isUserIdFromTheSameHomeserver(externalRoomId, domain);
+	}
+
 	protected async createInstance(): Promise<void> {
 		bridgeLogger.info('Performing Dynamic Import of matrix-appservice-bridge');
 

diff --git a/apps/meteor/app/federation-v2/server/infrastructure/rocket-chat/hooks/index.ts b/apps/meteor/app/federation-v2/server/infrastructure/rocket-chat/hooks/index.ts
@@ -45,8 +45,8 @@ export class FederationHooks {
 	public static canAddUsersToTheRoom(callback: Function): void {
 		callbacks.add(
 			'federation.beforeAddUserAToRoom',
-			(params: { user: IUser | string }, room: IRoom): void => {
-				Promise.await(callback(params.user, room));
+			(params: { user: IUser | string; inviter: IUser }, room: IRoom): void => {
+				Promise.await(callback(params.user, params.inviter, room));
 			},
 			callbacks.priority.HIGH,
 			'federation-v2-can-add-users-to-the-room',