RocketChat / RocketChat/Rocket.Chat
[BUG] Annoymous Read/Write can bypass permissions
@ggazzo is already working on this.
Since Aug 15, 2019.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
Annoymous Read/Write can bypass permissions
#10685 related
Steps to reproduce:
-
Enable Anonymous Read and Anonymous Write
-
Create a public channel with join code
-
Remove preview channel permission for anonymous role
-
Click this channel as anonymous user (still be able to preview the content)
-
Enable Anonymous Read and Anonymous Write
-
Delete all public rooms
-
Registered user cannot sign-in because there is no button!
-
Enable Anonymous Read and Anonymous Write
-
Create a public channel
-
Remove all permissions for guest and anonymous user
-
Browse the website as anonymous user(you can still see all public channels. But if you click on one channel , click "join as anonymous", input anonymous name , you will find that you cannot join them or see any public channel )
Server Setup Information:
- Version of Rocket.Chat Server: 1.2.1
- Deployment Method:
- Number of Running Instances: 1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.