Missing validation for visitor token in livechat:closeByVisitor

Description:

When closing the room by the method livechat:closeByVisitor Rocket.Chat does not check for token validity. That could lead to several situations:

• Wrong or missing token: The room closer will be set to the first visitor in the db
• Provide token but the visitor owns that token is not the visitor of the closed room: Room closed successfully.

Steps to reproduce:

1. Call livechat:closeByVisitor without a visitor token or invalid visitor token

Expected behavior:

An error about invalid visitor token returned

Actual behavior:

Room closed successfully

Server Setup Information:

• Version of Rocket.Chat Server: 3.12.1
• Operating System: Linux
• Deployment Method: All
• Number of Running Instances: any
• DB Replicaset Oplog: enabled
• NodeJS Version: 12.18.4
• MongoDB Version: 4

Client Setup Information

• Desktop App or Browser Version: latest
• Operating System: windows

Additional context

The file located in app/app/livechat/server/methods/closeByVisitor.js

Relevant logs:

Start with app/app/livechat/server/methods/closeByVisitor.js and reproduce livechat:closeByVisitor using a missing or invalid visitor token. Verify that an invalid token returns an error and that a token belonging to a different visitor cannot close the room; done means the room is not closed in those cases.