diff --git a/apps/meteor/app/api/server/v1/misc.ts b/apps/meteor/app/api/server/v1/misc.ts index 633b0b1a3422..5c7cf193f3a8 100644 --- a/apps/meteor/app/api/server/v1/misc.ts +++ b/apps/meteor/app/api/server/v1/misc.ts @@ -13,8 +13,10 @@ import { isMethodCallProps, isMethodCallAnonProps, isMeteorCall, + validateParamsPwGetPolicyRest, } from '@rocket.chat/rest-typings'; import type { IUser } from '@rocket.chat/core-typings'; +import { Users as UsersRaw } from '@rocket.chat/models'; import { hasPermission } from '../../../authorization/server'; import { Users } from '../../../models/server'; @@ -24,6 +26,7 @@ import { getDefaultUserFields } from '../../../utils/server/functions/getDefault import { getURL } from '../../../utils/lib/getURL'; import { getLogs } from '../../../../server/stream/stdout'; import { SystemLogger } from '../../../../server/lib/logger/system'; +import { passwordPolicy } from '../../../lib/server'; /** * @openapi @@ -383,6 +386,44 @@ API.v1.addRoute( }, ); +API.v1.addRoute( + 'pw.getPolicy', + { + authRequired: true, + }, + { + get() { + return API.v1.success(passwordPolicy.getPasswordPolicy()); + }, + }, +); + +API.v1.addRoute( + 'pw.getPolicyReset', + { + authRequired: false, + validateParams: validateParamsPwGetPolicyRest, + }, + { + async get() { + check( + this.queryParams, + Match.ObjectIncluding({ + token: String, + }), + ); + const { token } = this.queryParams; + + const user = await UsersRaw.findOneByResetToken(token, { projection: { _id: 1 } }); + if (!user) { + return API.v1.unauthorized(); + } + + return API.v1.success(passwordPolicy.getPasswordPolicy()); + }, + }, +); + /** * @openapi * /api/v1/stdout.queue: diff --git a/apps/meteor/app/api/server/v1/teams.ts b/apps/meteor/app/api/server/v1/teams.ts index 0403418db6a5..6d570ae49b0f 100644 --- a/apps/meteor/app/api/server/v1/teams.ts +++ b/apps/meteor/app/api/server/v1/teams.ts @@ -15,8 +15,8 @@ import type { ITeam } from '@rocket.chat/core-typings'; import { TEAM_TYPE } from '@rocket.chat/core-typings'; import { removeUserFromRoom } from '../../../lib/server/functions/removeUserFromRoom'; -import { Users } from '../../../models/server'; -import { hasAtLeastOnePermission, hasPermission } from '../../../authorization/server'; +import { Rooms, Users } from '../../../models/server'; +import { canAccessRoom, hasAtLeastOnePermission, hasPermission } from '../../../authorization/server'; import { Team } from '../../../../server/sdk'; import { API } from '../api'; @@ -576,6 +576,18 @@ API.v1.addRoute( return API.v1.failure('Team not found'); } + const room = Rooms.findOneById(teamInfo.roomId); + + if (!room) { + return API.v1.failure('Room not found'); + } + + const canViewInfo = canAccessRoom(room, { _id: this.userId }) || hasPermission(this.userId, 'view-all-teams'); + + if (!canViewInfo) { + return API.v1.unauthorized(); + } + return API.v1.success({ teamInfo }); }, }, diff --git a/apps/meteor/client/views/login/ResetPassword/ResetPassword.tsx b/apps/meteor/client/views/login/ResetPassword/ResetPassword.tsx index ac1942afd0b4..437a0cbf39dd 100644 --- a/apps/meteor/client/views/login/ResetPassword/ResetPassword.tsx +++ b/apps/meteor/client/views/login/ResetPassword/ResetPassword.tsx @@ -8,6 +8,7 @@ import { useTranslation, TranslationKey, useToastMessageDispatch, + useEndpoint, } from '@rocket.chat/ui-contexts'; import { useQuery } from '@tanstack/react-query'; import { Meteor } from 'meteor/meteor'; @@ -27,13 +28,14 @@ const ResetPassword = (): ReactElement => { const resetPassword = useMethod('resetPassword'); const token = useRouteParameter('token'); - const getPasswordPolicy = useMethod('getPasswordPolicy'); + const getPasswordPolicy = useEndpoint('GET', '/v1/pw.getPolicy'); + const getPasswordPolicyRest = useEndpoint('GET', '/v1/pw.getPolicyReset'); const dispatchToastMessage = useToastMessageDispatch(); const { data: { enabled: policyEnabled, policy: policies } = {} } = useQuery( ['login/password-policy', token], - async () => getPasswordPolicy(token ? { token } : undefined), + async () => (user || !token ? getPasswordPolicy() : getPasswordPolicyRest({ token })), { onError: (error: any) => { dispatchToastMessage({ type: 'error', message: error }); @@ -103,7 +105,7 @@ const ResetPassword = (): ReactElement => { {policies?.map((policy, index) => ( - {t(...policy)} + {t(...(policy as unknown as [name: TranslationKey, options?: Record]))} ))} diff --git a/apps/meteor/client/views/room/Header/ToolBox/ToolBox.tsx b/apps/meteor/client/views/room/Header/ToolBox/ToolBox.tsx index b54ce28b2611..10dc9efe6b31 100644 --- a/apps/meteor/client/views/room/Header/ToolBox/ToolBox.tsx +++ b/apps/meteor/client/views/room/Header/ToolBox/ToolBox.tsx @@ -11,7 +11,7 @@ import { useToolboxContext } from '../../lib/Toolbox/ToolboxContext'; import { useTab, useTabBarOpen } from '../../providers/ToolboxProvider'; const renderMenuOption: OptionRenderer = ({ label: { title, icon }, ...props }: any): ReactNode => ( -