Merge pull request #7917 from nextcloud/bugfix/7476/flow-and-chat-permissionsv15.0.0-beta.4

Fix flow and chat permissions

2 files changed, 13 insertions, 1 deletions

diff --git a/lib/Flow/Operation.php b/lib/Flow/Operation.php
index cf95d3ada..0555e78e8 100644
--- a/lib/Flow/Operation.php
+++ b/lib/Flow/Operation.php
@@ -29,6 +29,7 @@ use OCA\Talk\Chat\ChatManager;
 use OCA\Talk\Exceptions\ParticipantNotFoundException;
 use OCA\Talk\Exceptions\RoomNotFoundException;
 use OCA\Talk\Manager as TalkManager;
+use OCA\Talk\Model\Attendee;
 use OCA\Talk\Participant;
 use OCA\Talk\Room;
 use OCP\EventDispatcher\Event;
@@ -116,7 +117,17 @@ class Operation implements IOperation {
 				}
 
 				$room = $this->getRoom($token, $uid);
+				if ($room->getReadOnly() !== Room::READ_WRITE) {
+					// Ignore conversation because it is locked
+					continue;
+				}
+
 				$participant = $this->getParticipant($uid, $room);
+				if (!($participant->getPermissions() & Attendee::PERMISSIONS_CHAT)) {
+					// Ignore conversation because the user has no permissions
+					continue;
+				}
+
 				$this->chatManager->sendMessage(
 					$room,
 					$participant,
diff --git a/src/views/FlowPostToConversation.vue b/src/views/FlowPostToConversation.vue
index 179e88ff0..754a4157d 100644
--- a/src/views/FlowPostToConversation.vue
+++ b/src/views/FlowPostToConversation.vue
@@ -18,7 +18,7 @@
 import NcMultiselect from '@nextcloud/vue/dist/Components/NcMultiselect.js'
 import axios from '@nextcloud/axios'
 import { generateOcsUrl } from '@nextcloud/router'
-import { FLOW, CONVERSATION } from '../constants.js'
+import { FLOW, CONVERSATION, PARTICIPANT } from '../constants.js'
 
 export default {
 	name: 'FlowPostToConversation',
@@ -80,6 +80,7 @@ export default {
 			axios.get(generateOcsUrl('/apps/spreed/api/v4/room')).then((response) => {
 				this.roomOptions = response.data.ocs.data.filter(function(room) {
 					return room.readOnly === CONVERSATION.STATE.READ_WRITE
+						&& (room.permissions & PARTICIPANT.PERMISSIONS.CHAT) !== 0
 				})
 			})
 		},