Merge pull request #7917 from nextcloud/bugfix/7476/flow-and-chat-per…

…missions

Fix flow and chat permissions

lib/Flow/Operation.php

@@ -29,6 +29,7 @@
 use OCA\Talk\Exceptions\ParticipantNotFoundException;
 use OCA\Talk\Exceptions\RoomNotFoundException;
 use OCA\Talk\Manager as TalkManager;
+use OCA\Talk\Model\Attendee;
 use OCA\Talk\Participant;
 use OCA\Talk\Room;
 use OCP\EventDispatcher\Event;
@@ -116,7 +117,17 @@ public function onEvent(string $eventName, Event $event, IRuleMatcher $ruleMatch
 				}
 
 				$room = $this->getRoom($token, $uid);
+				if ($room->getReadOnly() !== Room::READ_WRITE) {
+					// Ignore conversation because it is locked
+					continue;
+				}
+
 				$participant = $this->getParticipant($uid, $room);
+				if (!($participant->getPermissions() & Attendee::PERMISSIONS_CHAT)) {
+					// Ignore conversation because the user has no permissions
+					continue;
+				}
+
 				$this->chatManager->sendMessage(
 					$room,
 					$participant,

src/views/FlowPostToConversation.vue

@@ -18,7 +18,7 @@
 import NcMultiselect from '@nextcloud/vue/dist/Components/NcMultiselect.js'
 import axios from '@nextcloud/axios'
 import { generateOcsUrl } from '@nextcloud/router'
-import { FLOW, CONVERSATION } from '../constants.js'
+import { FLOW, CONVERSATION, PARTICIPANT } from '../constants.js'
 
 export default {
 	name: 'FlowPostToConversation',
@@ -80,6 +80,7 @@ export default {
 			axios.get(generateOcsUrl('/apps/spreed/api/v4/room')).then((response) => {
 				this.roomOptions = response.data.ocs.data.filter(function(room) {
 					return room.readOnly === CONVERSATION.STATE.READ_WRITE
+						&& (room.permissions & PARTICIPANT.PERMISSIONS.CHAT) !== 0
 				})
 			})
 		},