From 4cae30d20f86858faa81ca2d477d39d09556467a Mon Sep 17 00:00:00 2001 From: Diego Sampaio Date: Mon, 20 Apr 2026 19:22:12 -0300 Subject: [PATCH] regression: validate the subscription status on unban --- .../server/functions/executeUnbanUserFromRoom.ts | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/apps/meteor/app/lib/server/functions/executeUnbanUserFromRoom.ts b/apps/meteor/app/lib/server/functions/executeUnbanUserFromRoom.ts index bc9c2dd742c6c..4e6e9f39616ff 100644 --- a/apps/meteor/app/lib/server/functions/executeUnbanUserFromRoom.ts +++ b/apps/meteor/app/lib/server/functions/executeUnbanUserFromRoom.ts @@ -1,5 +1,5 @@ import { Message } from '@rocket.chat/core-services'; -import { isBannedSubscription, type IUser } from '@rocket.chat/core-typings'; +import { isBannedSubscription, isInviteSubscription, type IUser } from '@rocket.chat/core-typings'; import { Rooms, Subscriptions, Users } from '@rocket.chat/models'; import { afterUnbanFromRoomCallback } from '../../../../server/lib/callbacks/afterUnbanFromRoomCallback'; @@ -20,10 +20,10 @@ export const executeUnbanUserFromRoom = async function (rid: string, user: IUser throw new Error('error-invalid-subscription'); } - // if the subscription is not banned anymore it means we received an invite and then updated the status. - // after the invite was accepted we receive a leave event (meaning the user was unbanned), so at this point - // we just need send the message to say the user was unbanned. - if (!isBannedSubscription(subscription)) { + // if the subscription is an invite it means we were unbanned and then invited again, then + // the invite was accepted and we receive a leave event (meaning the user was unbanned), so + // at this point we just need send the message to say the user was unbanned. + if (isInviteSubscription(subscription)) { await Message.saveSystemMessage('user-unbanned', rid, user.username, user, { u: { _id: byUser._id, username: byUser.username }, }); @@ -31,6 +31,11 @@ export const executeUnbanUserFromRoom = async function (rid: string, user: IUser return; } + // if the subscription exists and is not an invite and not banned + if (!isBannedSubscription(subscription)) { + throw new Error('error-user-not-banned'); + } + // Remove the subscription entirely — the user is no longer banned but also not a member. // Room count and __rooms were already adjusted during ban, so we only delete the document. await Subscriptions.removeById(subscription._id);