Sahil Batra ae0aba064f CVE-2024-21630: Check permission to subscribe others using invite link. ...

This commit updates the API to check the permission to subscribe other
users while creating multi-use invites. The API will raise error if
the user passes the "stream_ids" parameter (even when it contains only
default streams) and the calling user does not have permission to
subscribe others to streams.

We did not add this before as we only allowed admins to create
multiuse invites, but now we have added a setting which can be used
to allow users with other roles as well to create multiuse invites.

2024-01-24 17:41:10 -08:00

8.7 KiB

Raw Blame History

View Raw