paulmataruso/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2025-10-30 11:33:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

stream: Guest users cannot get metadata access to channel via groups.

Browse Source
This commit is contained in:
Shubham Padia
2025-02-12 11:43:31 +00:00
committed by Tim Abbott
parent 77d3029ec5
commit 1db2487f1c
4 changed files with 52 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
zerver/lib/streams.py
View File

@@ -574,10 +574,19 @@ def access_stream_for_delete_or_update_requiring_metadata_access(
def has_metadata_access_to_channel_via_groups(
user_profile: UserProfile,
user_recursive_group_ids: set[int],
can_administer_channel_group_id: int,
can_add_subscribers_group_id: int,
) -> bool:
for setting_name in Stream.stream_permission_group_settings_granting_metadata_access:
permission_configuration = Stream.stream_permission_group_settings[setting_name]
if not permission_configuration.allow_everyone_group and user_profile.is_guest:
return False
# It's best to just check the variables directly here since it
# becomes complicated to create an automated loop for both settings
# and values because of https://github.com/python/mypy/issues/5382.
return (
can_administer_channel_group_id in user_recursive_group_ids
or can_add_subscribers_group_id in user_recursive_group_ids
@@ -614,6 +623,7 @@ def check_basic_stream_access(
) # nocoverage
) # nocoverage
if has_metadata_access_to_channel_via_groups(
user_profile,
user_group_membership_details.user_recursive_group_ids,
stream.can_administer_channel_group_id,
stream.can_add_subscribers_group_id,