diff --git a/api_docs/roles-and-permissions.md b/api_docs/roles-and-permissions.md index efa1b0f09e..ede476dcea 100644 --- a/api_docs/roles-and-permissions.md +++ b/api_docs/roles-and-permissions.md @@ -75,9 +75,9 @@ event](/api/get-events#realm_user-add), and the Many areas of Zulip are customizable by the roles above, such as (but not limited to) [restricting message editing and -deletion](/help/restrict-message-editing-and-deletion) and -[channels permissions](/help/channel-permissions). The potential -permission levels are: +deletion](/help/restrict-message-editing-and-deletion) and various +permissions for different [channel types](/help/channel-permissions). +The potential permission levels are: * Everyone / Any user including Guests (least restrictive) diff --git a/docs/overview/changelog.md b/docs/overview/changelog.md index b3f4e42c8e..9fab0fd08d 100644 --- a/docs/overview/changelog.md +++ b/docs/overview/changelog.md @@ -1600,7 +1600,7 @@ _Released 2022-06-21_ - CVE-2022-31017: Fixed message edit event exposure in protected-history streams. Zulip allows a stream to be configured as [private with protected - history](https://zulip.com/help/channel-permissions#channel-privacy-settings), + history](https://zulip.com/help/channel-permissions#private-channels), which means that new subscribers should only see messages sent after they join. However, due to a logic bug in Zulip Server 2.1.0 through 5.2, when a message was edited, the server would incorrectly send an @@ -3303,7 +3303,7 @@ _Released 2018-11-07_ - Users can now configure email and mobile push notifications for all messages in a stream (useful for low-traffic streams/organizations), not just for messages mentioning them. -- New [stream settings](https://zulip.com/help/channel-permissions) +- New [stream settings](https://zulip.com/help/channel-permissions#private-channels) control whether private stream subscribers can access history from before they joined, and allow configuring streams to only allow administrators to post. diff --git a/docs/production/security-model.md b/docs/production/security-model.md index 5d9eec864b..b0fb667d1d 100644 --- a/docs/production/security-model.md +++ b/docs/production/security-model.md @@ -118,7 +118,8 @@ strength allowed is controlled by two settings in figure out whether a channel with that name exists, but cannot see any other details about the channel. - - See [Channel permissions](https://zulip.com/help/channel-permissions) for more details. + - See [channel types and permissions](https://zulip.com/help/channel-permissions) + for more details. - Zulip supports editing the content and topics of messages that have already been sent. As a general philosophy, our policies provide diff --git a/web/templates/start_export_modal.hbs b/web/templates/start_export_modal.hbs index df47e12ed8..236ee64b75 100644 --- a/web/templates/start_export_modal.hbs +++ b/web/templates/start_export_modal.hbs @@ -4,7 +4,7 @@ A public data export is a complete data export for your organization other than private channel messages and direct messages. - {{#*inline "z-private-channel-link"}}{{> @partial-block}}{{/inline}} + {{#*inline "z-private-channel-link"}}{{> @partial-block}}{{/inline}} {{#*inline "z-direct-messages-link"}}{{> @partial-block}}{{/inline}} {{/tr}}

diff --git a/zerver/openapi/zulip.yaml b/zerver/openapi/zulip.yaml index d02ec08f9c..b649ac9bfb 100644 --- a/zerver/openapi/zulip.yaml +++ b/zerver/openapi/zulip.yaml @@ -8566,7 +8566,7 @@ paths: a target message ID of `first_message_id_allowed_to_move`, if the user desires to move only the portion of the topic that they can. - Note that in a channel with [protected history](/help/channel-permissions), + Note that in a [private channel with protected history][private-channels], the Zulip security model requires that the above calculations only include messages the acting user has access to. So in the rare case of a user attempting to move a topic that started before the user joined a private @@ -8575,6 +8575,8 @@ paths: dialog. **Changes**: New in Zulip 7.0 (feature level 172). + + [private-channels]: /help/channel-permissions#private-channels - allOf: - $ref: "#/components/schemas/CodedError" - example: @@ -10049,12 +10051,13 @@ paths: description: | Get all topics the user has access to in a specific channel. - Note that for private channels with [protected - history](/help/channel-permissions), the user will only have access to - topics of messages sent after they [subscribed to](/api/subscribe) the - channel. Similarly, a user's [bot](/help/bots-overview#bot-type) - will only have access to messages sent after the bot was subscribed to - the channel, instead of when the user subscribed. + Note that for [private channels with + protected history](/help/channel-permissions#private-channels), + the user will only have access to topics of messages sent after they + [subscribed to](/api/subscribe) the channel. Similarly, a user's + [bot](/help/bots-overview#bot-type) will only have access to messages + sent after the bot was subscribed to the channel, instead of when the + user subscribed. parameters: - $ref: "#/components/parameters/ChannelIdInPath" responses: @@ -10212,7 +10215,8 @@ paths: by the optional parameters, like `invite_only`, detailed below. Note that the ability to subscribe oneself and/or other users to a specified - channel depends on the [channel's privacy settings](/help/channel-permissions). + channel depends on the [channel's type: private, public, or + web-public](/help/channel-permissions). **Changes**: Removed `stream_post_policy` and `is_announcement_only` parameters in Zulip 10.0 (feature level 333), as permission to post @@ -20042,8 +20046,8 @@ paths: newly subscribed members, or users can only access messages they actually received while subscribed to the channel. - Corresponds to the [shared history](/help/channel-permissions) - option in documentation. + Corresponds to the shared history option for + [private channels](/help/channel-permissions#private-channels). It's an error for this parameter to be false for a public or web-public channel and when is_private is false. @@ -24564,8 +24568,8 @@ components: newly subscribed members, or users can only access messages they actually received while subscribed to the channel. - Corresponds to the [shared history](/help/channel-permissions) - option in documentation. + Corresponds to the shared history option for + [private channels](/help/channel-permissions#private-channels). type: boolean example: false Principals: