From 414f72e5e700f935f438b1d63730d8cd50546501 Mon Sep 17 00:00:00 2001 From: Kevin Aleman Date: Wed, 20 Dec 2023 09:43:53 -0600 Subject: [PATCH 1/2] prevent create visitor with empty token --- apps/meteor/app/livechat/server/api/v1/visitor.ts | 5 +++++ apps/meteor/tests/end-to-end/api/livechat/09-visitors.ts | 4 ++++ 2 files changed, 9 insertions(+) diff --git a/apps/meteor/app/livechat/server/api/v1/visitor.ts b/apps/meteor/app/livechat/server/api/v1/visitor.ts index 59be77d298f13..3d78280c51093 100644 --- a/apps/meteor/app/livechat/server/api/v1/visitor.ts +++ b/apps/meteor/app/livechat/server/api/v1/visitor.ts @@ -30,6 +30,11 @@ API.v1.addRoute('livechat/visitor', { }); const { customFields, id, token, name, email, department, phone, username, connectionData } = this.bodyParams.visitor; + + if (!token?.trim()) { + throw new Meteor.Error('error-invalid-token', 'Token cannot be empty', { method: 'livechat/visitor' }); + } + const guest = { token, ...(id && { id }), diff --git a/apps/meteor/tests/end-to-end/api/livechat/09-visitors.ts b/apps/meteor/tests/end-to-end/api/livechat/09-visitors.ts index 6fa4206b6e588..372f7ddf5d7b4 100644 --- a/apps/meteor/tests/end-to-end/api/livechat/09-visitors.ts +++ b/apps/meteor/tests/end-to-end/api/livechat/09-visitors.ts @@ -44,6 +44,10 @@ describe('LIVECHAT - visitors', function () { const { body } = await request.post(api('livechat/visitor')).send({ visitor: {} }); expect(body).to.have.property('success', false); }); + it('should fail when token is an empty string', async () => { + const { body } = await request.post(api('livechat/visitor')).send({ visitor: { token: '' } }); + expect(body).to.have.property('success', false); + }); it('should create a visitor', async () => { const { body } = await request.post(api('livechat/visitor')).send({ visitor: { token: 'test' } }); expect(body).to.have.property('success', true); From 0b4df290b767c9f48f8538eb46f0ae20d5d21f45 Mon Sep 17 00:00:00 2001 From: Kevin Aleman Date: Wed, 20 Dec 2023 09:45:43 -0600 Subject: [PATCH 2/2] Create thin-socks-brush.md --- .changeset/thin-socks-brush.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/thin-socks-brush.md diff --git a/.changeset/thin-socks-brush.md b/.changeset/thin-socks-brush.md new file mode 100644 index 0000000000000..a1da5c81e6845 --- /dev/null +++ b/.changeset/thin-socks-brush.md @@ -0,0 +1,5 @@ +--- +"@rocket.chat/meteor": patch +--- + +Removed an old behavior that allowed visitors to be created with an empty token on `livechat/visitor` endpoint.