Limit calling addUserToRoom to users in room and with permission.

packages/rocketchat-slashcommands-invite/server.coffee

@@ -54,7 +54,7 @@ class Invite
 					_id: Random.id()
 					rid: item.rid
 					ts: new Date
-					msg: e.error
+					msg: TAPi18n.__(e.error, null, currentUser.language)
 				}
 			return
 

server/methods/addUserToRoom.coffee

@@ -2,19 +2,22 @@ Meteor.methods
 	addUserToRoom: (data) ->
 		fromId = Meteor.userId()
 		unless Match.test data?.rid, String
-			throw new Meteor.Error 'error-invalid-room', 'Invalid room', { method: addUserToRoom }
+			throw new Meteor.Error 'error-invalid-room', 'Invalid room', { method: 'addUserToRoom' }
 
 		unless Match.test data?.username, String
-			throw new Meteor.Error 'error-invalid-username', 'Invalid username', { method: addUserToRoom }
+			throw new Meteor.Error 'error-invalid-username', 'Invalid username', { method: 'addUserToRoom' }
 
 		room = RocketChat.models.Rooms.findOneById data.rid
 
+		if room.usernames.indexOf(Meteor.user().username) is -1
+			throw new Meteor.Error 'error-not-allowed', 'Not allowed', { method: 'addUserToRoom' }
+
 		# if room.username isnt Meteor.user().username and room.t is 'c'
-		if room.t is 'c' and not RocketChat.authz.hasPermission(fromId, 'add-user-to-room', room._id)
-			throw new Meteor.Error 'error-not-allowed', 'Not allowed', { method: addUserToRoom }
+		if RocketChat.authz.hasPermission(fromId, 'add-user-to-room', room._id)
+			throw new Meteor.Error 'error-not-allowed', 'Not allowed', { method: 'addUserToRoom' }
 
 		if room.t is 'd'
-			throw new Meteor.Error 'error-cant-invite-for-direct-room', 'Can\'t invite user to direct rooms', { method: addUserToRoom }
+			throw new Meteor.Error 'error-cant-invite-for-direct-room', 'Can\'t invite user to direct rooms', { method: 'addUserToRoom' }
 
 		# verify if user is already in room
 		if room.usernames.indexOf(data.username) isnt -1