spacebarchat / spacebarchat/server
Embed Links and Attach File Permissions Not Functional
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 2.2k
- Forks
- 323
- Avg merge
- 14h 48m
- Merged PRs (30d)
- 4
Description
Describe the bug
Denying the permissions Embed Links and Attach Files do not correctly prevent these actions. Regardless of if a channel specifically denies the permissions, or a role has the permission denied entirely, users can always embed links and attach files. Permissions are being reported together since they both must function to control a user's ability to post images.
To Reproduce
Steps to reproduce the behavior:
- Create a channel.
- Deny the permissions Embed Links and Attach Files in any way (by user, by role, or by channel)
- Post a link.
- Attach a file.
Expected behavior
Users who can not embed links should not be have links embed.
Users who can not attach files should not have their files attached.
Env and Software info
Encountered on the live instance of spacebar.chat
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue on the live instance or a local setup using the listed channel, role, and user permission cases. Trace the permission checks used when posting links and attaching files. Done means denying Embed Links prevents link embedding and denying Attach Files prevents file attachments in each described scenario.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authorization, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100