Merge pull request #7690 from RocketChat/master-0.57.3

Sync Master with 0.57.3

.docker/Dockerfile

@@ -1,6 +1,6 @@
 FROM rocketchat/base:4
 
-ENV RC_VERSION 0.57.2
+ENV RC_VERSION 0.57.3
 
 MAINTAINER buildmaster@rocket.chat
 

.sandstorm/sandstorm-pkgdef.capnp

@@ -21,7 +21,7 @@ const pkgdef :Spk.PackageDefinition = (
 
 		appVersion = 62,  # Increment this for every release.
 
-		appMarketingVersion = (defaultText = "0.57.2"),
+		appMarketingVersion = (defaultText = "0.57.3"),
 		# Human-readable representation of appVersion. Should match the way you
 		# identify versions of your app in documentation and marketing.
 

.travis/snap.sh

@@ -17,7 +17,7 @@ elif [[ $TRAVIS_TAG ]]; then
     RC_VERSION=$TRAVIS_TAG
 else
     CHANNEL=edge
-    RC_VERSION=0.57.2
+    RC_VERSION=0.57.3
 fi
 
 echo "Preparing to trigger a snap release for $CHANNEL channel"

HISTORY.md

@@ -1,3 +1,21 @@
+<a name="0.57.3"></a>
+## 0.57.3 (2017-08-08)
+
+
+### Bug Fixes
+
+- [#7390](https://github.com/RocketChat/Rocket.Chat/pull/7390) custom soundEdit.html
+- [#7395](https://github.com/RocketChat/Rocket.Chat/pull/7395) file upload broken when running in subdirectory https://github.com…
+- [#7444](https://github.com/RocketChat/Rocket.Chat/pull/7444) Fix Anonymous User
+- [#7535](https://github.com/RocketChat/Rocket.Chat/pull/7535) Fix Join Channel Without Preview Room Permission
+- [#7555](https://github.com/RocketChat/Rocket.Chat/pull/7555) Improve build script example
+- [#7533](https://github.com/RocketChat/Rocket.Chat/pull/7533) Missing eventName in unUser
+- [#7325](https://github.com/RocketChat/Rocket.Chat/pull/7325) Modernize rate limiting of sendMessage
+- [#7394](https://github.com/RocketChat/Rocket.Chat/pull/7394) Use UTF8 setting for /create command
+- [#7212](https://github.com/RocketChat/Rocket.Chat/pull/7212) Users and Channels list not respecting permissions
+
+
+
 <a name="0.57.2"></a>
 ## 0.57.2 (2017-07-14)
 

example-build-run.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+set -x
+set -euvo pipefail
+IFS=$'\n\t'
+
+# Requies Node.js version 4.x
+# Do not run as root
+
+DEPLOY_DIR=/var/www/rocket.chat
+
+### BUILD
+meteor npm install
+
+# on the very first build, meteor build command should fail due to a bug on emojione package (related to phantomjs installation)
+# the command below forces the error to happen before build command (not needed on subsequent builds)
+set +e
+meteor add rocketchat:lib
+set -e
+
+meteor build --server-only --directory $DEPLOY_DIR
+
+### RUN
+cd $DEPLOY_DIR/bundle/programs/server
+npm install
+
+cd $DEPLOY_DIR/bundle
+NODE_ENV=production \
+PORT=3000 \
+ROOT_URL=http://localhost:3000 \
+MONGO_URL=mongodb://localhost:27017/rocketchat \
+MONGO_OPLOG_URL=mongodb://localhost:27017/local \
+node main.js

package.json

@@ -1,7 +1,7 @@
 {
 	"name": "Rocket.Chat",
 	"description": "The Ultimate Open Source WebChat Platform",
-	"version": "0.57.2",
+	"version": "0.57.3",
 	"author": {
 		"name": "Rocket.Chat",
 		"url": "https://rocket.chat/"

packages/rocketchat-api/server/v1/channels.js

@@ -332,13 +332,22 @@ RocketChat.API.v1.addRoute('channels.leave', { authRequired: true }, {
 
 RocketChat.API.v1.addRoute('channels.list', { authRequired: true }, {
 	get: {
-		//This is like this only to provide an example of how we routes can be defined :X
+		//This is defined as such only to provide an example of how the routes can be defined :X
 		action() {
 			const { offset, count } = this.getPaginationItems();
 			const { sort, fields, query } = this.parseJsonQuery();
 
 			const ourQuery = Object.assign({}, query, { t: 'c' });
 
+			//Special check for the permissions
+			if (RocketChat.authz.hasPermission(this.userId, 'view-joined-room')) {
+				ourQuery.usernames = {
+					$in: [ this.user.username ]
+				};
+			} else if (!RocketChat.authz.hasPermission(this.userId, 'view-c-room')) {
+				return RocketChat.API.v1.unauthorized();
+			}
+
 			const rooms = RocketChat.models.Rooms.find(ourQuery, {
 				sort: sort ? sort : { name: 1 },
 				skip: offset,

packages/rocketchat-api/server/v1/users.js

@@ -105,6 +105,10 @@ RocketChat.API.v1.addRoute('users.info', { authRequired: true }, {
 
 RocketChat.API.v1.addRoute('users.list', { authRequired: true }, {
 	get() {
+		if (!RocketChat.authz.hasPermission(this.userId, 'view-d-room')) {
+			return RocketChat.API.v1.unauthorized();
+		}
+
 		const { offset, count } = this.getPaginationItems();
 		const { sort, fields, query } = this.parseJsonQuery();
 

packages/rocketchat-authorization/server/startup.js

@@ -46,6 +46,7 @@ Meteor.startup(function() {
 		{ _id: 'run-migration',                 roles : ['admin'] },
 		{ _id: 'set-moderator',                 roles : ['admin', 'owner'] },
 		{ _id: 'set-owner',                     roles : ['admin', 'owner'] },
+		{ _id: 'send-many-messages',            roles : ['admin', 'bot'] },
 		{ _id: 'unarchive-room',                roles : ['admin'] },
 		{ _id: 'view-c-room',                   roles : ['admin', 'user', 'bot', 'anonymous'] },
 		{ _id: 'user-generate-access-token',    roles : ['admin'] },

packages/rocketchat-cors/cors.js

@@ -2,7 +2,7 @@
 
 import url from 'url';
 
-WebApp.rawConnectHandlers.use(function(req, res, next) {
+WebApp.rawConnectHandlers.use(Meteor.bindEnvironment(function(req, res, next) {
 	if (req._body) {
 		return next();
 	}
@@ -12,7 +12,7 @@ WebApp.rawConnectHandlers.use(function(req, res, next) {
 	if (req.headers['content-type'] !== '' && req.headers['content-type'] !== undefined) {
 		return next();
 	}
-	if (req.url.indexOf('/ufs/') === 0) {
+	if (req.url.indexOf(`${ __meteor_runtime_config__.ROOT_URL_PATH_PREFIX }/ufs/`) === 0) {
 		return next();
 	}
 
@@ -36,7 +36,7 @@ WebApp.rawConnectHandlers.use(function(req, res, next) {
 
 		return next();
 	});
-});
+}));
 
 WebApp.rawConnectHandlers.use(function(req, res, next) {
 	if (/^\/(api|_timesync|sockjs|tap-i18n|__cordova)(\/|$)/.test(req.url)) {

packages/rocketchat-custom-sounds/admin/soundEdit.html

@@ -13,7 +13,7 @@ <h3>{{_ "Custom_Sound_Add"}}</h3>
 				</div>
 				<div class="input-line">
 					<label for="image">{{_ "Sound_File_mp3"}}</label>
-					<input id="image" type="file" accept="audio/mp3"/>
+					<input id="image" type="file" accept="audio/mp3,audio/mpeg"/>
 				</div>
 				<nav>
 					<button class='button button-block cancel' type="button"><span>{{_ "Cancel"}}</span></button>

packages/rocketchat-file-upload/server/lib/requests.js

@@ -7,7 +7,8 @@ RocketChat.settings.get('FileUpload_ProtectFiles', function(key, value) {
 	protectedFiles = value;
 });
 
-WebApp.connectHandlers.use('/file-upload/', function(req, res, next) {
+WebApp.connectHandlers.use(`${ __meteor_runtime_config__.ROOT_URL_PATH_PREFIX }/file-upload/`,	function(req, res, next) {
+
 	const match = /^\/([^\/]+)\/(.*)/.exec(req.url);
 
 	if (match[1]) {

packages/rocketchat-lib/client/Notifications.js

@@ -79,8 +79,8 @@ RocketChat.Notifications = new class {
 	unRoom(room, eventName, callback) {
 		return this.streamRoom.removeListener(`${ room }/${ eventName }`, callback);
 	}
-	unUser(callback) {
-		return this.streamUser.removeListener(Meteor.userId(), callback);
+	unUser(eventName, callback) {
+		return this.streamUser.removeListener(`${ Meteor.userId() }/${ eventName }`, callback);
 	}
 
 };

packages/rocketchat-lib/client/lib/settings.js

@@ -59,8 +59,8 @@ Meteor.startup(function() {
 			return c.stop();
 		}
 		Meteor.setTimeout(function() {
-			if (__meteor_runtime_config__.ROOT_URL !== location.origin) {
-				const currentUrl = location.origin + __meteor_runtime_config__.ROOT_URL_PATH_PREFIX;
+			const currentUrl = location.origin + __meteor_runtime_config__.ROOT_URL_PATH_PREFIX;
+			if (__meteor_runtime_config__.ROOT_URL !== currentUrl) {
 				swal({
 					type: 'warning',
 					title: t('Warning'),

packages/rocketchat-lib/lib/startup/settingsOnLoadSiteUrl.js

@@ -10,10 +10,10 @@ RocketChat.settings.get('Site_Url', function(key, value) {
 		host = match[1];
 		// prefix = match[2].replace(/\/$/, '');
 	}
-	__meteor_runtime_config__.ROOT_URL = host;
+	__meteor_runtime_config__.ROOT_URL = value;
 
 	if (Meteor.absoluteUrl.defaultOptions && Meteor.absoluteUrl.defaultOptions.rootUrl) {
-		Meteor.absoluteUrl.defaultOptions.rootUrl = host;
+		Meteor.absoluteUrl.defaultOptions.rootUrl = value;
 	}
 	if (Meteor.isServer) {
 		RocketChat.hostname = host.replace(/^https?:\/\//, '');

packages/rocketchat-lib/rocketchat.info

@@ -1,3 +1,3 @@
 {
-	"version": "0.57.2"
+	"version": "0.57.3"
 }

packages/rocketchat-lib/server/methods/sendMessage.js

@@ -68,14 +68,8 @@ Meteor.methods({
 	}
 });
 // Limit a user, who does not have the "bot" role, to sending 5 msgs/second
-DDPRateLimiter.addRule({
-	type: 'method',
-	name: 'sendMessage',
+RocketChat.RateLimiter.limitMethod('sendMessage', 5, 1000, {
 	userId(userId) {
-		const user = RocketChat.models.Users.findOneById(userId);
-		if (user == null || !user.roles) {
-			return true;
-		}
-		return user.roles.includes('bot');
+		return !RocketChat.authz.hasPermission(userId, 'send-many-messages');
 	}
-}, 5, 1000);
+});

packages/rocketchat-livechat/app/client/lib/fromApp/Notifications.js

@@ -72,8 +72,8 @@ this.Notifications = new class {
 	unRoom(room, eventName, callback) {
 		return this.streamRoom.removeListener(`${ room }/${ eventName }`, callback);
 	}
-	unUser(callback) {
-		return this.streamUser.removeListener(Meteor.userId(), callback);
+	unUser(eventName, callback) {
+		return this.streamUser.removeListener(`${ Meteor.userId() }/${ eventName }`, callback);
 	}
 
 };

packages/rocketchat-slashcommands-create/server.js

@@ -12,12 +12,13 @@ function Create(command, params, item) {
 		return result;
 	}
 
-	const regexp = /#?([\d-_\w]+)/g;
+	const regexp = new RegExp(RocketChat.settings.get('UTF8_Names_Validation'));
+
 	if (command !== 'create' || !Match.test(params, String)) {
 		return;
 	}
 	let channel = regexp.exec(params.trim());
-	channel = channel ? channel[1] : '';
+	channel = channel ? channel[0] : '';
 	if (channel === '') {
 		return;
 	}

packages/rocketchat-ui-flextab/client/tabs/membersList.js

@@ -26,7 +26,7 @@ Template.membersList.helpers({
 		const roomUsers = Template.instance().users.get();
 		const room = ChatRoom.findOne(this.rid);
 		const roomMuted = (room != null ? room.muted : undefined) || [];
-		const userUtcOffset = Meteor.user().utcOffset;
+		const userUtcOffset = Meteor.user() && Meteor.user().utcOffset;
 		let totalOnline = 0;
 		let users = roomUsers.map(function(user) {
 			let utcOffset;

packages/rocketchat-ui-message/client/message.js

@@ -13,7 +13,7 @@ Template.message.helpers({
 	roleTags() {
 		const user = Meteor.user();
 		// test user -> settings -> preferences -> hideRoles
-		if (!RocketChat.settings.get('UI_DisplayRoles') || ['settings', 'preferences', 'hideRoles'].reduce((obj, field) => typeof obj !== 'undefined' && obj[field], user)) {
+		if (!RocketChat.settings.get('UI_DisplayRoles') || (user && ['settings', 'preferences', 'hideRoles'].reduce((obj, field) => typeof obj !== 'undefined' && obj[field], user))) {
 			return [];
 		}
 
@@ -205,7 +205,7 @@ Template.message.helpers({
 		return true;
 	},
 	reactions() {
-		const userUsername = Meteor.user().username;
+		const userUsername = Meteor.user() && Meteor.user().username;
 		return Object.keys(this.reactions||{}).map(emoji => {
 			const reaction = this.reactions[emoji];
 			const total = reaction.usernames.length;

packages/rocketchat-ui-message/client/messageBox.js

@@ -54,7 +54,7 @@ Template.messageBox.helpers({
 		return RocketChat.settings.get('Message_ShowFormattingTips') && (RocketChat.Markdown || RocketChat.MarkdownCode || katexSyntax());
 	},
 	canJoin() {
-		return RocketChat.roomTypes.verifyShowJoinLink(this._id);
+		return Meteor.userId() && RocketChat.roomTypes.verifyShowJoinLink(this._id);
 	},
 	joinCodeRequired() {
 		const code = Session.get(`roomData${ this._id }`);
@@ -179,6 +179,13 @@ Template.messageBox.helpers({
 	},
 	showSandstorm() {
 		return Meteor.settings['public'].sandstorm && !Meteor.isCordova;
+	},
+
+	anonymousRead() {
+		return (Meteor.userId() == null) && RocketChat.settings.get('Accounts_AllowAnonymousRead') === true;
+	},
+	anonymousWrite() {
+		return (Meteor.userId() == null) && RocketChat.settings.get('Accounts_AllowAnonymousRead') === true && RocketChat.settings.get('Accounts_AllowAnonymousWrite') === true;
 	}
 });
 
@@ -248,6 +255,21 @@ Template.messageBox.events({
 			}
 		});
 	},
+
+	'click .register'(event) {
+		event.stopPropagation();
+		event.preventDefault();
+		return Session.set('forceLogin', true);
+	},
+	'click .register-anonymous'(event) {
+		event.stopPropagation();
+		event.preventDefault();
+		return Meteor.call('registerUser', {}, function(error, loginData) {
+			if (loginData && loginData.token) {
+				return Meteor.loginWithToken(loginData.token);
+			}
+		});
+	},
 	'focus .input-message'(event, instance) {
 		KonchatNotification.removeRoomNotification(this._id);
 		chatMessages[this._id].input = instance.find('.input-message');

packages/rocketchat-ui/client/lib/RoomHistoryManager.js

@@ -51,11 +51,12 @@ export const RoomHistoryManager = new class {
 			typeName = (curRoomDoc != null ? curRoomDoc.t : undefined) + (curRoomDoc != null ? curRoomDoc.name : undefined);
 		}
 
-		return Meteor.call('loadHistory', rid, ts, limit, ls, function(err, result) {
+		Meteor.call('loadHistory', rid, ts, limit, ls, function(err, result) {
 			if (err) {
 				return;
 			}
 			let previousHeight;
+			const {messages = []} = result;
 			room.unreadNotLoaded.set(result.unreadNotLoaded);
 			room.firstUnread.set(result.firstUnread);
 
@@ -64,7 +65,7 @@ export const RoomHistoryManager = new class {
 				previousHeight = wrapper.scrollHeight;
 			}
 
-			result.messages.forEach(item => {
+			messages.forEach(item => {
 				if (item.t !== 'command') {
 					const roles = [
 						(item.u && item.u._id && UserRoles.findOne(item.u._id, { fields: { roles: 1 }})) || {},
@@ -87,8 +88,8 @@ export const RoomHistoryManager = new class {
 
 			room.isLoading.set(false);
 			if (room.loaded == null) { room.loaded = 0; }
-			room.loaded += result.messages.length;
-			if (result.messages.length < limit) {
+			room.loaded += messages.length;
+			if (messages.length < limit) {
 				return room.hasMore.set(false);
 			}
 		});