fix: resetIrcConnection not requiring user logged (#33994)

RocketChat · Nov 19, 2024 · a0bdecb · a0bdecb
1 parent e5fe727
commit a0bdecb
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/.changeset/tricky-trees-destroy.md b/.changeset/tricky-trees-destroy.md
@@ -0,0 +1,4 @@
+---
+"@rocket.chat/meteor": patch
+---
+Adds login and permission validation for resetIrcConnection method
diff --git a/apps/meteor/app/irc/server/methods/resetIrcConnection.ts b/apps/meteor/app/irc/server/methods/resetIrcConnection.ts
@@ -2,6 +2,7 @@ import type { ServerMethods } from '@rocket.chat/ddp-client';
 import { Settings } from '@rocket.chat/models';
 import { Meteor } from 'meteor/meteor';
 
+import { hasPermissionAsync } from '../../../authorization/server/functions/hasPermission';
 import { notifyOnSettingChangedById } from '../../../lib/server/lib/notifyListener';
 import { settings } from '../../../settings/server';
 import Bridge from '../irc-bridge';
@@ -16,8 +17,18 @@ declare module '@rocket.chat/ddp-client' {
 Meteor.methods<ServerMethods>({
 	async resetIrcConnection() {
 		const ircEnabled = Boolean(settings.get('IRC_Enabled'));
+		const uid = Meteor.userId();
+
+		if (!uid) {
+			throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'resetIrcConnection' });
+		}
+
+		if (!(await hasPermissionAsync(uid, 'edit-privileged-setting'))) {
+			throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'resetIrcConnection' });
+		}
 
 		const updatedLastPingValue = await Settings.updateValueById('IRC_Bridge_Last_Ping', new Date(0), { upsert: true });
+
 		if (updatedLastPingValue.modifiedCount || updatedLastPingValue.upsertedCount) {
 			void notifyOnSettingChangedById('IRC_Bridge_Last_Ping');
 		}