Skip to content

[Bug/All] Roles allow viewing of channels that they should not #294

@Robocat999

Description

@Robocat999

Describe the bug
When a user does not have permission to view a channel, but is given a role which is not explicitly being denied access, the channel (and category, if applicable) becomes visible in the channel selection bar on the left-hand side. Users can not actually view the contents of these channels, as the server correctly denies them access. However, this does lead to a looping reconnect (though that should be resolved by the recently merged 0843d7c). This will only occur if the role that is not being explicitly denied is a higher ranking role than the role being denied.

To Reproduce
Steps to reproduce the behavior:

  1. Create two roles (or one role and use the everyone role)
  2. Create a channel.
  3. In the newly created channel, mark the lower ranking role as unable to view the channel.
  4. Do not give or deny the view permission to the higher ranking role.
  5. Give both roles to a user.
  6. The user should now be able to see the channel and its parent category on the left-hand channel browsing menu.

Expected behavior
User should not see channels that they cannot access appear in their left-hand channel menu.

Desktop (please complete the following information):

  • OS: Windows 10
  • Browser: Firefox
  • Browser Version: 148.0

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions