message_edit: Require access to messages to move between streams.

Currently, moving messages between streams is an action limited to
organization administrators. A big part of the motivation for that
restriction was to prevent users from moving messages from a private
stream without shared history as a way to access messages they should
not have access to.

Organization administrators can already just make the stream have
shared history if they want to access its messages, but allowing
non-administrators to move messages between would have
introduced a security bug without this change.
This commit is contained in:
Tim Abbott
2021-05-12 14:54:41 -07:00
committed by Tim Abbott
parent 0bfef96543
commit 41d499d44c
2 changed files with 13 additions and 3 deletions

View File

@@ -1326,7 +1326,7 @@ class EditMessageTest(ZulipTestCase):
"topic": "new topic",
},
)
self.assertEqual(len(queries), 50)
self.assertEqual(len(queries), 52)
self.assertEqual(len(cache_tries), 13)
messages = get_topic_messages(user_profile, old_stream, "test")