[FIX] Permission view-all-teams is not checked in the teams.info endpoint

apps/meteor/app/api/server/v1/teams.ts

@@ -577,6 +577,12 @@ API.v1.addRoute(
 				return API.v1.failure('Team not found');
 			}
 
+			const canViewInfo = (await Team.getMember(teamInfo._id, this.userId)) || hasPermission(this.userId, 'view-all-teams');
+
+			if (!canViewInfo) {
+				return API.v1.unauthorized();
+			}
+
 			return API.v1.success({ teamInfo });
 		},
 	},

apps/meteor/server/sdk/types/ITeamService.ts

@@ -105,6 +105,7 @@ export interface ITeamService {
 	autocomplete(uid: string, name: string): Promise<ITeamAutocompleteResult[]>;
 	getAllPublicTeams(options?: WithoutProjection<FindOneOptions<ITeam>>): Promise<Array<ITeam>>;
 	getMembersByTeamIds(teamIds: Array<string>, options: FindOneOptions<ITeamMember>): Promise<Array<ITeamMember>>;
+	getMember(teamId: string, userId: string, options?: FindOneOptions<ITeamMember>): Promise<ITeamMember | null>;
 	update(uid: string, teamId: string, updateData: ITeamUpdateData): Promise<void>;
 	listTeamsBySubscriberUserId(uid: string, options?: FindOneOptions<ITeamMember>): Promise<Array<ITeamMember> | null>;
 	insertMemberOnTeams(userId: string, teamIds: Array<string>): Promise<void>;

apps/meteor/server/services/team/service.ts

@@ -530,6 +530,10 @@ export class TeamService extends ServiceClassInternal implements ITeamService {
 		};
 	}
 
+	async getMember(teamId: string, userId: string, options: FindOneOptions<ITeamMember>): Promise<ITeamMember | null> {
+		return TeamMember.findOneByUserIdAndTeamId(userId, teamId, options);
+	}
+
 	async listRoomsOfUser(
 		uid: string,
 		teamId: string,