paulmataruso/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2025-11-06 06:53:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

user_groups: Check can_leave_group when removing members.

Browse Source
This commit is contained in:
Shubham Padia
2024-10-14 11:12:21 +00:00
committed by Tim Abbott
parent 060156fca4
commit bf46747735
2 changed files with 141 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
zerver/views/user_groups.py
View File

@@ -345,9 +345,22 @@ def remove_members_from_group_backend(
members: list[int],
) -> HttpResponse:
user_profiles = user_ids_to_users(members, user_profile.realm, allow_deactivated=False)
user_group = access_user_group_for_update(
user_group_id, user_profile, permission_setting="can_manage_group"
)
if len(members) == 1 and user_profile.id == members[0]:
try:
user_group = access_user_group_for_update(
user_group_id, user_profile, permission_setting="can_leave_group"
)
except JsonableError:
# User can leave the group if user has the permission to
# manage the group.
user_group = access_user_group_for_update(
user_group_id, user_profile, permission_setting="can_manage_group"
)
else:
user_group = access_user_group_for_update(
user_group_id, user_profile, permission_setting="can_manage_group"
)
group_member_ids = get_user_group_direct_member_ids(user_group)
for member in members:
if member not in group_member_ids: