fix: incoming webhooks improperly post in public channels under private teams #35782

abhinavkrin · 2025-04-11T08:27:44Z

Proposed changes (including videos or screenshots)

This PR fixes a permission issue where incoming webhooks could send messages to public channels under private teams even when the webhook user was not a team member.

Issue(s)

Steps to test or reproduce

Create a private team with a public channel inside it.
Configure a webhook using a user that is not a member of the team.
Try posting a message via webhook.

Further comments

CORE-1086
VLN-114

This pull request addresses a specific issue in the Rocket.Chat repository where incoming webhooks were improperly posting messages in public channels under private teams. The fix involves updating the @rocket.chat/meteor package to ensure that team membership checks are enforced for incoming webhooks. Additionally, the PR refactors the room joining logic in the getRoomByNameOrIdWithOptionToJoin function by replacing the local addUserToRoom function with the centralized Room.join method from @rocket.chat/core-services when the joinChannel option is enabled. This change aims to streamline the process and ensure consistency in how users are added to channel rooms.

dionisio-bot · 2025-04-11T08:27:48Z

Looks like this PR is ready to merge! 🎉
If you have any trouble, please check the PR guidelines

changeset-bot · 2025-04-11T08:27:49Z

🦋 Changeset detected

Latest commit: c0cc4da

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 36 packages

Name	Type
@rocket.chat/meteor	Patch
@rocket.chat/core-typings	Patch
@rocket.chat/rest-typings	Patch
@rocket.chat/uikit-playground	Patch
@rocket.chat/api-client	Patch
@rocket.chat/apps	Patch
@rocket.chat/core-services	Patch
@rocket.chat/cron	Patch
@rocket.chat/ddp-client	Patch
@rocket.chat/freeswitch	Patch
@rocket.chat/fuselage-ui-kit	Patch
@rocket.chat/gazzodown	Patch
@rocket.chat/livechat	Patch
@rocket.chat/model-typings	Patch
@rocket.chat/ui-contexts	Patch
@rocket.chat/account-service	Patch
@rocket.chat/authorization-service	Patch
@rocket.chat/ddp-streamer	Patch
@rocket.chat/omnichannel-transcript	Patch
@rocket.chat/presence-service	Patch
@rocket.chat/queue-worker	Patch
@rocket.chat/stream-hub-service	Patch
@rocket.chat/license	Patch
@rocket.chat/omnichannel-services	Patch
@rocket.chat/pdf-worker	Patch
@rocket.chat/presence	Patch
rocketchat-services	Patch
@rocket.chat/models	Patch
@rocket.chat/network-broker	Patch
@rocket.chat/mock-providers	Patch
@rocket.chat/ui-avatar	Patch
@rocket.chat/ui-client	Patch
@rocket.chat/ui-video-conf	Patch
@rocket.chat/ui-voip	Patch
@rocket.chat/web-ui-registration	Patch
@rocket.chat/instance-status	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

codecov · 2025-04-11T08:32:29Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 61.23%. Comparing base (2c19074) to head (c0cc4da).
Report is 1 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #35782      +/-   ##
===========================================
+ Coverage    61.17%   61.23%   +0.05%     
===========================================
  Files         2971     2971              
  Lines        70839    70839              
  Branches     16185    16185              
===========================================
+ Hits         43335    43375      +40     
+ Misses       24556    24502      -54     
- Partials      2948     2962      +14

Flag	Coverage Δ
e2e	`57.69% <ø> (-0.01%)`	⬇️
unit	`75.61% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2025-04-11T08:33:12Z

PR Preview Action v1.6.1
🚀 View preview at https://RocketChat.github.io/Rocket.Chat/pr-preview/pr-35782/
Built to branch `gh-pages` at 2025-04-17 05:57 UTC. Preview will be ready when the GitHub Pages deployment is complete.

kody-ai · 2025-04-15T09:36:49Z

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.
Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Security	✅
Code Style	✅
Kody Rules	✅
Refactoring	✅
Error Handling	✅
Maintainability	✅
Potential Issues	✅
Documentation And Comments	✅
Performance And Optimization	✅
Breaking Changes	❌

Access your configuration settings here.

apps/meteor/app/lib/server/functions/getRoomByNameOrIdWithOptionToJoin.ts

pierre-lehnen-rc

A few comments but nothing that prevents merging this.

apps/meteor/tests/end-to-end/api/incoming-integrations.ts

apps/meteor/app/lib/server/functions/getRoomByNameOrIdWithOptionToJoin.ts

apps/meteor/app/lib/server/functions/addUserToRoom.ts

kody-ai · 2025-04-16T07:18:52Z

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.
Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Security	✅
Code Style	✅
Kody Rules	✅
Refactoring	✅
Error Handling	✅
Maintainability	✅
Potential Issues	✅
Documentation And Comments	✅
Performance And Optimization	✅
Breaking Changes	❌

Access your configuration settings here.

kody-ai · 2025-04-16T07:23:32Z

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.
Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Security	✅
Code Style	✅
Kody Rules	✅
Refactoring	✅
Error Handling	✅
Maintainability	✅
Potential Issues	✅
Documentation And Comments	✅
Performance And Optimization	✅
Breaking Changes	❌

Access your configuration settings here.

apps/meteor/app/lib/server/functions/addUserToRoom.ts

kody-ai · 2025-04-16T12:51:46Z

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.
Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Security	✅
Code Style	✅
Kody Rules	✅
Refactoring	✅
Error Handling	✅
Maintainability	✅
Potential Issues	✅
Documentation And Comments	✅
Performance And Optimization	✅
Breaking Changes	❌

Access your configuration settings here.

kody-ai · 2025-04-16T14:11:15Z

Kody Review Complete

Great news! 🎉
No issues were found that match your current review configurations.

Keep up the excellent work! 🚀

Kody Guide: Usage and Configuration

Interacting with Kody

Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.
Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Security	✅
Code Style	✅
Kody Rules	✅
Refactoring	✅
Error Handling	✅
Maintainability	✅
Potential Issues	✅
Documentation And Comments	✅
Performance And Optimization	✅
Breaking Changes	❌

Access your configuration settings here.

kody-ai · 2025-04-16T19:42:22Z

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.
Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Security	✅
Code Style	✅
Kody Rules	✅
Refactoring	✅
Error Handling	✅
Maintainability	✅
Potential Issues	✅
Documentation And Comments	✅
Performance And Optimization	✅
Breaking Changes	❌

Access your configuration settings here.

abhinavkrin · 2025-04-29T11:50:43Z

/backport 7.4.3

dionisio-bot · 2025-04-29T11:51:20Z

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-7.4.3-35782
git cherry-pick fe5f8a2cf346ab7757a67873060127db2cd8265d
// solve the conflict
git push

after that just run /backport 7.4.3 again

…te teams (#35782)

abhinavkrin · 2025-04-29T11:52:39Z

/backport 7.4.3

dionisio-bot · 2025-04-29T11:52:54Z

Pull request #35896 added to Project: "Patch 7.4.3"

abhinavkrin · 2025-04-29T11:53:16Z

/backport 7.3.5

dionisio-bot · 2025-04-29T11:53:55Z

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-7.3.5-35782
git cherry-pick fe5f8a2cf346ab7757a67873060127db2cd8265d
// solve the conflict
git push

after that just run /backport 7.3.5 again

…te teams (#35782)

abhinavkrin · 2025-04-29T11:55:02Z

/backport 7.3.5

dionisio-bot · 2025-04-29T11:55:21Z

Pull request #35897 added to Project: "Patch 7.3.5"

abhinavkrin · 2025-04-29T11:55:35Z

/backport 7.2.6

dionisio-bot · 2025-04-29T11:56:14Z

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-7.2.6-35782
git cherry-pick fe5f8a2cf346ab7757a67873060127db2cd8265d
// solve the conflict
git push

after that just run /backport 7.2.6 again

…te teams (#35782)

abhinavkrin · 2025-04-29T11:57:45Z

/backport 7.2.6

dionisio-bot · 2025-04-29T11:58:04Z

Pull request #35898 added to Project: "Patch 7.2.6"

abhinavkrin · 2025-04-29T11:58:17Z

/backport 7.1.6

dionisio-bot · 2025-04-29T11:58:57Z

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-7.1.6-35782
git cherry-pick fe5f8a2cf346ab7757a67873060127db2cd8265d
// solve the conflict
git push

after that just run /backport 7.1.6 again

…te teams (#35782)

abhinavkrin · 2025-04-29T12:00:02Z

/backport 7.1.6

dionisio-bot · 2025-04-29T12:00:23Z

Pull request #35899 added to Project: "Patch 7.1.6"

abhinavkrin · 2025-04-29T12:00:43Z

/backport 7.0.10

dionisio-bot · 2025-04-29T12:01:29Z

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-7.0.10-35782
git cherry-pick fe5f8a2cf346ab7757a67873060127db2cd8265d
// solve the conflict
git push

after that just run /backport 7.0.10 again

…te teams (#35782)

abhinavkrin · 2025-04-29T12:02:29Z

/backport 7.0.10

dionisio-bot · 2025-04-29T12:02:50Z

Pull request #35900 added to Project: "Patch 7.0.10"

abhinavkrin requested a review from a team as a code owner April 11, 2025 08:27

abhinavkrin added this to the 7.6.0 milestone Apr 11, 2025

MarcosSpessatto previously approved these changes Apr 11, 2025

View reviewed changes

julio-rocketchat previously approved these changes Apr 15, 2025

View reviewed changes

julio-rocketchat added the stat: QA assured Means it has been tested and approved by a company insider label Apr 15, 2025

dionisio-bot bot added the stat: ready to merge PR tested and approved waiting for merge label Apr 15, 2025

kody-ai bot reviewed Apr 15, 2025

View reviewed changes

apps/meteor/app/lib/server/functions/getRoomByNameOrIdWithOptionToJoin.ts Show resolved Hide resolved

pierre-lehnen-rc previously approved these changes Apr 15, 2025

View reviewed changes

apps/meteor/tests/end-to-end/api/incoming-integrations.ts Outdated Show resolved Hide resolved

apps/meteor/tests/end-to-end/api/incoming-integrations.ts Show resolved Hide resolved

apps/meteor/app/lib/server/functions/getRoomByNameOrIdWithOptionToJoin.ts Show resolved Hide resolved

abhinavkrin dismissed stale reviews from pierre-lehnen-rc, MarcosSpessatto, and julio-rocketchat via 6e815f9 April 16, 2025 06:51

abhinavkrin force-pushed the fix/incoming-webhooks-private-team-public-channel branch from 2a29d59 to 6e815f9 Compare April 16, 2025 06:51

abhinavkrin requested review from MarcosSpessatto and pierre-lehnen-rc April 16, 2025 06:54

abhinavkrin commented Apr 16, 2025

View reviewed changes

apps/meteor/app/lib/server/functions/addUserToRoom.ts Show resolved Hide resolved

kody-ai bot reviewed Apr 16, 2025

View reviewed changes

apps/meteor/app/lib/server/functions/addUserToRoom.ts Show resolved Hide resolved

kody-ai bot reviewed Apr 16, 2025

View reviewed changes

apps/meteor/app/lib/server/functions/addUserToRoom.ts Outdated Show resolved Hide resolved

kody-ai bot reviewed Apr 16, 2025

View reviewed changes

apps/meteor/app/lib/server/functions/addUserToRoom.ts Show resolved Hide resolved

pierre-lehnen-rc previously approved these changes Apr 16, 2025

View reviewed changes

julio-rocketchat previously approved these changes Apr 16, 2025

View reviewed changes

abhinavkrin added a commit that referenced this pull request Apr 29, 2025

fix: incoming webhooks improperly post in public channels under priva…

6b2e316

…te teams (#35782)

dionisio-bot bot mentioned this pull request Apr 29, 2025

fix: incoming webhooks improperly post in public channels under private teams #35896

Merged

abhinavkrin added a commit that referenced this pull request Apr 29, 2025

fix: incoming webhooks improperly post in public channels under priva…

66f0e72

…te teams (#35782)

dionisio-bot bot mentioned this pull request Apr 29, 2025

fix: incoming webhooks improperly post in public channels under private teams #35897

Merged

abhinavkrin added a commit that referenced this pull request Apr 29, 2025

fix: incoming webhooks improperly post in public channels under priva…

b3aff7b

…te teams (#35782)

dionisio-bot bot mentioned this pull request Apr 29, 2025

fix: incoming webhooks improperly post in public channels under private teams #35898

Merged

abhinavkrin added a commit that referenced this pull request Apr 29, 2025

fix: incoming webhooks improperly post in public channels under priva…

1fb20ea

…te teams (#35782)

dionisio-bot bot mentioned this pull request Apr 29, 2025

fix: incoming webhooks improperly post in public channels under private teams #35899

Merged

abhinavkrin added a commit that referenced this pull request Apr 29, 2025

fix: incoming webhooks improperly post in public channels under priva…

ba384a0

…te teams (#35782)

dionisio-bot bot mentioned this pull request Apr 29, 2025

fix: incoming webhooks improperly post in public channels under private teams #35900

Merged

fix: incoming webhooks improperly post in public channels under private teams #35782

fix: incoming webhooks improperly post in public channels under private teams #35782

Uh oh!

Conversation

abhinavkrin commented Apr 11, 2025 • edited by kody-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes (including videos or screenshots)

Issue(s)

Steps to test or reproduce

Further comments

Uh oh!

dionisio-bot bot commented Apr 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Apr 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

codecov bot commented Apr 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Apr 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Built to branch gh-pages at 2025-04-17 05:57 UTC. Preview will be ready when the GitHub Pages deployment is complete.

Uh oh!

kody-ai bot commented Apr 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Completed! 🔥

Uh oh!

Uh oh!

pierre-lehnen-rc left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kody-ai bot commented Apr 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Completed! 🔥

Uh oh!

kody-ai bot commented Apr 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Completed! 🔥

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kody-ai bot commented Apr 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Completed! 🔥

Uh oh!

kody-ai bot commented Apr 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Kody Review Complete

Uh oh!

kody-ai bot commented Apr 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Completed! 🔥

Uh oh!

abhinavkrin commented Apr 29, 2025

Uh oh!

dionisio-bot bot commented Apr 29, 2025

Uh oh!

abhinavkrin commented Apr 29, 2025

Uh oh!

dionisio-bot bot commented Apr 29, 2025

Uh oh!

abhinavkrin commented Apr 29, 2025

Uh oh!

dionisio-bot bot commented Apr 29, 2025

Uh oh!

abhinavkrin commented Apr 29, 2025

Uh oh!

dionisio-bot bot commented Apr 29, 2025

Uh oh!

abhinavkrin commented Apr 29, 2025

Uh oh!

dionisio-bot bot commented Apr 29, 2025

abhinavkrin commented Apr 11, 2025 •

edited by kody-ai bot

Loading

dionisio-bot bot commented Apr 11, 2025 •

edited

Loading

changeset-bot bot commented Apr 11, 2025 •

edited

Loading

codecov bot commented Apr 11, 2025 •

edited

Loading

github-actions bot commented Apr 11, 2025 •

edited

Loading

Built to branch `gh-pages` at 2025-04-17 05:57 UTC.
Preview will be ready when the GitHub Pages deployment is complete.

kody-ai bot commented Apr 15, 2025 •

edited

Loading

kody-ai bot commented Apr 16, 2025 •

edited

Loading

kody-ai bot commented Apr 16, 2025 •

edited

Loading

kody-ai bot commented Apr 16, 2025 •

edited

Loading

kody-ai bot commented Apr 16, 2025 •

edited

Loading

kody-ai bot commented Apr 16, 2025 •

edited

Loading