[FIX] Revoked view-d-room permission logics (#11522)

packages/rocketchat-i18n/i18n/en.i18n.json

@@ -2432,6 +2432,7 @@
   "Take_it": "Take it!",
   "TargetRoom": "Target Room",
   "TargetRoom_Description": "The room where messages will be sent which are a result of this event being fired. Only one target room is allowed and it must exist.",
+  "Target user not allowed to receive messages": "Target user not allowed to receive messages",
   "Team": "Team",
   "Technology_Provider": "Technology Provider",
   "Technology_Services": "Technology Services",

packages/rocketchat-lib/client/lib/openRoom.js

@@ -26,20 +26,20 @@ function openRoom(type, name) {
 			const room = RocketChat.roomTypes.findRoom(type, name, user);
 			if (room == null) {
 				if (type === 'd') {
-					Meteor.call('createDirectMessage', name, function(err) {
-						if (!err) {
+					Meteor.call('createDirectMessage', name, function(error) {
+						if (!error) {
 							RoomManager.close(type + name);
 							return openRoom('d', name);
 						} else {
-							Session.set('roomNotFound', { type, name });
+							Session.set('roomNotFound', { type, name, error });
 							BlazeLayout.render('main', { center: 'roomNotFound' });
 							return;
 						}
 					});
 				} else {
-					Meteor.call('getRoomByTypeAndName', type, name, function(err, record) {
-						if (err) {
-							Session.set('roomNotFound', { type, name });
+					Meteor.call('getRoomByTypeAndName', type, name, function(error, record) {
+						if (error) {
+							Session.set('roomNotFound', { type, name, error });
 							return BlazeLayout.render('main', { center: 'roomNotFound' });
 						} else {
 							RocketChat.models.Rooms.upsert({ _id: record._id }, _.omit(record, '_id'));

packages/rocketchat-lib/lib/roomTypes/direct.js

@@ -29,6 +29,10 @@ export class DirectMessageRoomType extends RoomTypeConfig {
 	}
 
 	findRoom(identifier) {
+		if (!RocketChat.authz.hasAtLeastOnePermission('view-d-room')) {
+			return null;
+		}
+
 		const query = {
 			t: 'd',
 			name: identifier,

packages/rocketchat-lib/server/lib/sendNotificationsOnMessage.js

@@ -46,11 +46,16 @@ const sendNotification = ({
 		return;
 	}
 
+	const roomType = room.t;
+	// If the user doesn't have permission to view direct messages, don't send notification of direct messages.
+	if (roomType === 'd' && !RocketChat.authz.hasPermission(subscription.u._id, 'view-d-room')) {
+		return;
+	}
+
 	notificationMessage = parseMessageTextPerUser(notificationMessage, message, receiver);
 
 	const isHighlighted = messageContainsHighlight(message, subscription.userHighlights);
 
-	const roomType = room.t;
 
 	const {
 		audioNotifications,

packages/rocketchat-ui/client/views/404/roomNotFound.html

@@ -12,10 +12,14 @@
 						{{{_ 'No_group_with_name_%s_was_found' name}}}
 					{{/if}}
 					{{#if $eq type 'd'}}
-						{{#if sameUser }}
-							{{{_ 'Cannot_open_conversation_with_yourself' }}}
+						{{#if hasCustomErrorData }}
+							{{{_ customErrorMessage }}}
 						{{else}}
-							{{{_ 'No_user_with_username_%s_was_found' name}}}
+							{{#if sameUser}}
+								{{{_ 'Cannot_open_conversation_with_yourself' }}}
+							{{else}}
+								{{{_ 'No_user_with_username_%s_was_found' name}}}
+							{{/if}}
 						{{/if}}
 					{{/if}}
 				{{/with}}

packages/rocketchat-ui/client/views/404/roomNotFound.js

@@ -9,4 +9,10 @@ Template.roomNotFound.helpers({
 		const user = Meteor.user();
 		return user && user.username === this.name;
 	},
+	hasCustomErrorData() {
+		return this.error && this.error.error && this.error.reason && this.error.error !== 'error-invalid-user';
+	},
+	customErrorMessage() {
+		return this.error.reason;
+	},
 });

server/methods/createDirectMessage.js

@@ -36,6 +36,12 @@ Meteor.methods({
 			});
 		}
 
+		if (!RocketChat.authz.hasPermission(to._id, 'view-d-room')) {
+			throw new Meteor.Error('error-not-allowed', 'Target user not allowed to receive messages', {
+				method: 'createDirectMessage',
+			});
+		}
+
 		const rid = [me._id, to._id].sort().join('');
 
 		const now = new Date();