Skip to content

fix(threads): Restrict renaming threads to the author and moderators #15784

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nickvergessen merged 2 commits into from
Sep 3, 2025
Merged

fix(threads): Restrict renaming threads to the author and moderators #15784

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dbf9807
fix(threads): Restrict renaming threads to the author and moderators
nickvergessen Sep 3, 2025
b68e9b1
chore(assets): Recompile assets
nickvergessen Sep 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 18 additions & 3 deletions lib/Controller/ThreadController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,10 +185,11 @@ public function getThread(int $threadId): DataResponse {
* @param int $threadId The thread ID to get the info for
* @psalm-param non-negative-int $threadId
* @param string $threadTitle New thread title, must not be empty
* @return DataResponse<Http::STATUS_OK, TalkThreadInfo, array{}>|DataResponse<Http::STATUS_BAD_REQUEST, array{error: 'title'}, array{}>|DataResponse<Http::STATUS_NOT_FOUND, array{error: 'thread'}, array{}>
* @return DataResponse<Http::STATUS_OK, TalkThreadInfo, array{}>|DataResponse<Http::STATUS_BAD_REQUEST, array{error: 'title'}, array{}>|DataResponse<Http::STATUS_FORBIDDEN, array{error: 'permission'}, array{}>|DataResponse<Http::STATUS_NOT_FOUND, array{error: 'thread'}, array{}>
*
* 200: Thread renamed successfully
* 400: When the provided title is empty
* 403: Not allowed, either not the original author or not a moderator
* 404: Thread not found
*/
#[FederationSupported]
Expand All @@ -215,11 +216,25 @@ public function renameThread(int $threadId, string $threadTitle): DataResponse {
return new DataResponse(['error' => 'thread'], Http::STATUS_NOT_FOUND);
}

# FIXME Only allow for moderator and original author
$attendee = $this->participant->getAttendee();
$isOwnMessage = false;
try {
$comment = $this->chatManager->getComment($this->room, (string)$threadId);
$isOwnMessage = $comment->getActorType() === $attendee->getActorType()
&& $comment->getActorId() === $attendee->getActorId();
} catch (NotFoundException) {
// Root message expired, only moderators can edit
}

if (!$isOwnMessage
&& !$this->participant->hasModeratorPermissions(false)) {
// Actor is not a moderator or not the owner of the message
return new DataResponse(['error' => 'permission'], Http::STATUS_FORBIDDEN);
}

try {
$this->threadService->renameThread($thread, $threadTitle);
} catch (\InvalidArgumentException $e) {
} catch (\InvalidArgumentException) {
return new DataResponse(['error' => 'title'], Http::STATUS_BAD_REQUEST);
}

Expand Down
41 changes: 41 additions & 0 deletions openapi-full.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23686,6 +23686,47 @@
}
}
},
"403": {
"description": "Not allowed, either not the original author or not a moderator",
"content": {
"application/json": {
"schema": {
"type": "object",
"required": [
"ocs"
],
"properties": {
"ocs": {
"type": "object",
"required": [
"meta",
"data"
],
"properties": {
"meta": {
"$ref": "#/components/schemas/OCSMeta"
},
"data": {
"type": "object",
"required": [
"error"
],
"properties": {
"error": {
"type": "string",
"enum": [
"permission"
]
}
}
}
}
}
}
}
}
}
},
"404": {
"description": "Thread not found",
"content": {
Expand Down
41 changes: 41 additions & 0 deletions openapi.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23591,6 +23591,47 @@
}
}
},
"403": {
"description": "Not allowed, either not the original author or not a moderator",
"content": {
"application/json": {
"schema": {
"type": "object",
"required": [
"ocs"
],
"properties": {
"ocs": {
"type": "object",
"required": [
"meta",
"data"
],
"properties": {
"meta": {
"$ref": "#/components/schemas/OCSMeta"
},
"data": {
"type": "object",
"required": [
"error"
],
"properties": {
"error": {
"type": "string",
"enum": [
"permission"
]
}
}
}
}
}
}
}
}
}
},
"404": {
"description": "Thread not found",
"content": {
Expand Down
17 changes: 17 additions & 0 deletions src/types/openapi/openapi-full.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11573,6 +11573,23 @@ export interface operations {
};
};
};
/** @description Not allowed, either not the original author or not a moderator */
403: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": {
ocs: {
meta: components["schemas"]["OCSMeta"];
data: {
/** @enum {string} */
error: "permission";
};
};
};
};
};
/** @description Thread not found */
404: {
headers: {
Expand Down
17 changes: 17 additions & 0 deletions src/types/openapi/openapi.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11035,6 +11035,23 @@ export interface operations {
};
};
};
/** @description Not allowed, either not the original author or not a moderator */
403: {
headers: {
[name: string]: unknown;
};
content: {
"application/json": {
ocs: {
meta: components["schemas"]["OCSMeta"];
data: {
/** @enum {string} */
error: "permission";
};
};
};
};
};
/** @description Thread not found */
404: {
headers: {
Expand Down
24 changes: 24 additions & 0 deletions tests/integration/features/chat-4/threads.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,30 @@ Feature: chat-4/threads
| room | users | participant1 | user_added | {actor} added you | !ISSET | {"actor":{"type":"user","id":"participant1","name":"participant1-displayname","mention-id":"participant1"},"user":{"type":"user","id":"participant2","name":"participant2-displayname","mention-id":"participant2"}} |
| room | users | participant1 | conversation_created | {actor} created the conversation | !ISSET | {"actor":{"type":"user","id":"participant1","name":"participant1-displayname","mention-id":"participant1"}} |

Scenario: Non moderators can only rename their own threads
Given user "participant1" creates room "room" (v4)
| roomType | 2 |
| roomName | room |
And user "participant1" adds user "participant2" to room "room" with 200 (v4)
And user "participant1" sends thread "Thread 1" with message "Message 1" to room "room" with 201
And user "participant2" sends thread "Thread 2" with message "Message 2" to room "room" with 201
Then user "participant1" sees the following recent threads in room "room" with 200
| t.id | t.title | t.numReplies | t.lastMessage | a.notificationLevel | firstMessage | lastMessage |
| Message 2 | Thread 2 | 0 | 0 | 0 | Message 2 | NULL |
| Message 1 | Thread 1 | 0 | 0 | 0 | Message 1 | NULL |
And user "participant2" renames thread "Thread 1" to "No permissions" in room "room" with 403
And user "participant2" renames thread "Thread 2" to "My own thread" in room "room" with 200
Then user "participant1" sees the following recent threads in room "room" with 200
| t.id | t.title | t.numReplies | t.lastMessage | a.notificationLevel | firstMessage | lastMessage |
| Message 2 | My own thread | 0 | 0 | 0 | Message 2 | NULL |
| Message 1 | Thread 1 | 0 | 0 | 0 | Message 1 | NULL |
And user "participant1" renames thread "Thread 1" to "Moderator thread" in room "room" with 200
And user "participant1" renames thread "Thread 2" to "User thread" in room "room" with 200
Then user "participant1" sees the following recent threads in room "room" with 200
| t.id | t.title | t.numReplies | t.lastMessage | a.notificationLevel | firstMessage | lastMessage |
| Message 2 | User thread | 0 | 0 | 0 | Message 2 | NULL |
| Message 1 | Moderator thread | 0 | 0 | 0 | Message 1 | NULL |

Scenario: Responding without replying does not trigger a notification
Given user "participant1" creates room "room" (v4)
| roomType | 2 |
Expand Down
Loading