-
- Downloads
Regression: File upload via apps not working in some scenarios (#18995)
* [FIX] [Apps] Fix app user doesn't has permission to upload files
* Fix errorClass [Error]: Forbidden [forbidden]
In `app/file-upload/lib/FileUploadBase.js`, we configured `UploadFS.config.defaultStorePermissions`, which validates `insert(userId, doc)` etc. But the parameter userId cann't be always obtained by this validation method correctly (sometimes it's undefined). Meteor use the Meteor.userId() as its fallback option. So we can wrap the original call with `Meteor.runAsUser` to solve issue.
* Add a new validator into canAccessRoom
canAccessRoom (`app/authorization/server/functions/canAccessRoom.js`) is an essential validator for Rocket.Chat to check whether some user has permissions to access some room. In this PR, we added a new validator that allows app users to access any room on a Rocket.Chat server even if it is not a member of the room.
* An attempt to fix Meteor code must always run within a Fiber Error
Original Error: "Error: Meteor code must always run within a Fiber. Try wrapping callbacks that you pass to non-Meteor libraries with Meteor.bindEnvironment."
* Add support for uploading files by a livecaht visitor
* Support upload files with livechat visitors
* Reduce an unnecessary DB query - Users.findOneById
* Move the "bypass" out of canAccessRoom
Adding a bypass inside canAccessRoom can potentially allow apps to do stuff we're not prepared (yet)
* Update Apps-Engine version
* Some refactoring
* Fix a rateada
Co-authored-by:
Douglas Gubert <douglas.gubert@gmail.com>
Showing
- app/apps/server/bridges/uploads.js 29 additions, 9 deletionsapp/apps/server/bridges/uploads.js
- app/file-upload/server/lib/FileUpload.js 1 addition, 1 deletionapp/file-upload/server/lib/FileUpload.js
- app/file-upload/server/methods/sendFileMessage.js 5 additions, 3 deletionsapp/file-upload/server/methods/sendFileMessage.js
- package-lock.json 3 additions, 3 deletionspackage-lock.json
- package.json 1 addition, 1 deletionpackage.json
Loading
Please register or sign in to comment