Mirrors/Rocket.Chat
1
0
Fork 0
mirror of https://github.com/RocketChat/Rocket.Chat.git synced 2025-12-28 06:47:25 +00:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

fix: imported fixes 09-18-2025 (#37000)
Some checks failed
Code scanning - action / CodeQL-Build (push) Has been cancelled
Details

Browse Source 
Signed-off-by: Abhinav Kumar <abhinav@avitechlab.com>
Co-authored-by: Julio Araujo <julio.araujo@rocket.chat>
Co-authored-by: Abhinav Kumar <abhinav@avitechlab.com>
This commit is contained in:
dionisio-bot[bot] 2025-09-19 21:15:09 +02:00 committed by GitHub
parent d7da2c0da3
commit c8e778a64a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 59 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.changeset/grumpy-berries-arrive.md Normal file
View File

@ -0,0 +1,5 @@
---
'@rocket.chat/meteor': patch
---
Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

7
apps/meteor/app/api/server/ApiClass.ts
View File

@ -811,12 +811,15 @@ export class APIClass<
if (options.authRequired || options.authOrAnonRequired) {
const user = await api.authenticatedRoute.call(this, this.request);
this.user = user!;
this.userId = String(this.request.headers.get('x-user-id'));
this.userId = this.user?._id;
const authToken = this.request.headers.get('x-auth-token');
this.token = (authToken && Accounts._hashLoginToken(String(authToken)))!;
}
if (!this.user && options.authRequired && !options.authOrAnonRequired && !settings.get('Accounts_AllowAnonymousRead')) {
const shouldPreventAnonymousRead = !this.user && options.authOrAnonRequired && !settings.get('Accounts_AllowAnonymousRead');
const shouldPreventUserRead = !this.user && options.authRequired;
if (shouldPreventAnonymousRead || shouldPreventUserRead) {
const result = api.unauthorized('You must be logged in to do this.');
// compatibility with the old API
// TODO: MAJOR

4
apps/meteor/tests/end-to-end/api/channels.ts
View File

@ -3503,10 +3503,10 @@ describe('[Channels]', () => {
roomId: testChannel._id,
})
.expect('Content-Type', 'application/json')
.expect(400)
.expect(401)
.expect((res) => {
expect(res.body).to.have.a.property('success', false);
expect(res.body).to.have.a.property('error', 'Enable "Allow Anonymous Read" [error-not-allowed]');
expect(res.body).to.have.a.property('error', 'You must be logged in to do this.');
})
.end(done);
});

47
apps/meteor/tests/end-to-end/api/users.ts
View File

@ -681,6 +681,53 @@ describe('[Users]', () => {
]),
);
it('should fail when request is without authentication credentials', async () => {
await request
.get(api('users.info'))
.query({
userId: targetUser._id,
})
.expect('Content-Type', 'application/json')
.expect(401)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error');
});
});
describe('authentication', () => {
before(() => updateSetting('Accounts_AllowAnonymousRead', true));
after(() => updateSetting('Accounts_AllowAnonymousRead', false));
it('should fail when request is without authentication credentials and Anonymous Read is enabled', async () => {
await request
.get(api('users.info'))
.query({
userId: targetUser._id,
})
.expect('Content-Type', 'application/json')
.expect(401)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error');
});
});
it('should fail when request is without token and Anonymous Read is enabled', async () => {
await request
.get(api('users.info'))
.query({
userId: targetUser._id,
})
.set({ 'X-User-Id': credentials['X-User-Id'] })
.expect('Content-Type', 'application/json')
.expect(401)
.expect((res) => {
expect(res.body).to.have.property('success', false);
expect(res.body).to.have.property('error');
});
});
});
it('should return an error when the user does not exist', (done) => {
void request
.get(api('users.info'))