Fix channel actions modal

mattermost · Nov 20, 2024 · 4e3e0a2 · 4e3e0a2
1 parent 3b2ab9f
commit 4e3e0a2
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 4 deletions.
diff --git a/server/api/actions.go b/server/api/actions.go
@@ -272,6 +272,12 @@ func (a *ActionsHandler) updateChannelAction(c *Context, w http.ResponseWriter,
 		return
 	}
 
+	// Ensure that the action ID in both the URL and the body of the request are the same as well
+	if newChannelAction.ID != vars["action_id"] {
+		a.HandleErrorWithCode(w, c.logger, http.StatusBadRequest, "action ID in request body must match action ID in URL", nil)
+		return
+	}
+
 	// Validate the new action type and payload
 	if err := a.ValidateChannelAction(c, w, &newChannelAction, userID); err != nil {
 		a.HandleErrorWithCode(w, c.logger, http.StatusBadRequest, "invalid action", err)

diff --git a/webapp/src/components/channel_actions_modal.tsx b/webapp/src/components/channel_actions_modal.tsx
@@ -7,9 +7,17 @@ import {useIntl} from 'react-intl';
 
 import {getCurrentChannelId} from 'mattermost-webapp/packages/mattermost-redux/src/selectors/entities/common';
 
+import Permissions from 'mattermost-redux/constants/permissions';
+
+import {getCurrentTeamId} from 'mattermost-webapp/packages/mattermost-redux/src/selectors/entities/teams';
+
+import {getChannel} from 'mattermost-webapp/packages/mattermost-redux/src/selectors/entities/channels';
+
+import {GlobalState} from 'mattermost-webapp/packages/types/src/store';
+
 import {fetchChannelActions, saveChannelAction} from 'src/client';
 import {hideChannelActionsModal} from 'src/actions';
-import {isChannelActionsModalVisible, isCurrentUserAdmin, isCurrentUserChannelAdmin} from 'src/selectors';
+import {isChannelActionsModalVisible} from 'src/selectors';
 import Action from 'src/components/actions_modal_action';
 import Trigger, {TriggerKeywords} from 'src/components/actions_modal_trigger';
 import {
@@ -23,6 +31,7 @@ import {
 
 import ActionsModal, {ActionsContainer, TriggersContainer} from 'src/components/actions_modal';
 import {CategorizeChannelChildren, RunPlaybookChildren, WelcomeActionChildren} from 'src/components/actions_modal_action_children';
+import {useHasChannelPermission} from 'src/hooks/permissions';
 
 interface ActionState<T extends PayloadType> {
     id: string | undefined,
@@ -70,14 +79,16 @@ const ChannelActionsModal = () => {
     const dispatch = useDispatch();
     const show = useSelector(isChannelActionsModalVisible);
     const channelID = useSelector(getCurrentChannelId);
-    const isChannelAdmin = useSelector(isCurrentUserChannelAdmin);
-    const isSysAdmin = useSelector(isCurrentUserAdmin);
+    const channel = useSelector((state: GlobalState) => getChannel(state, channelID));
+    const teamID = useSelector(getCurrentTeamId);
+    const publicChannelPermission = useHasChannelPermission(teamID, channelID, Permissions.MANAGE_PUBLIC_CHANNEL_PROPERTIES);
+    const privateChannelPermission = useHasChannelPermission(teamID, channelID, Permissions.MANAGE_PRIVATE_CHANNEL_PROPERTIES);
 
     const [welcomeMsg, setWelcomeMsg, welcomeMsgInit, welcomeMsgReset, welcomeMsgOverwrite] = useActionState(welcomeMsgEmptyState);
     const [categorization, setCategorization, categorizationInit, categorizationReset, categorizationOverwrite] = useActionState(categorizationEmptyState);
     const [prompt, setPrompt, promptInit, promptReset, promptOverwrite] = useActionState(promptEmptyState);
 
-    const editable = isChannelAdmin || isSysAdmin;
+    const editable = channel?.type === 'O' ? publicChannelPermission : privateChannelPermission;
 
     useEffect(() => {
         const getActions = async (id: string) => {