github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-08-17 10:18:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

🐛 Fix send-invitations policy not enforced in backend RPC (#11206)

Browse Source
This commit is contained in:
María Valderrama 2026-08-12 16:55:20 +02:00 committed by GitHub
parent 6d49fb2be0
commit 93f02ea0b4
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
backend/src/app/rpc/commands/teams_invitations.clj
View File

@ -460,6 +460,10 @@
[cfg {:keys [::rpc/profile-id team-id role emails] :as params}] [cfg {:keys [::rpc/profile-id team-id role emails] :as params}]
(let [perms (teams/get-permissions cfg profile-id team-id) (let [perms (teams/get-permissions cfg profile-id team-id)
profile (db/get-by-id cfg :profile profile-id) profile (db/get-by-id cfg :profile profile-id)
team (db/get-by-id cfg :team team-id)
team-with-org (when (contains? cf/flags :admin-console)
(nitrate/add-organization-info-to-team cfg team {}))
organization (:organization team-with-org)
;; Determine which format is being used ;; Determine which format is being used
using-emails-format? (and emails role) using-emails-format? (and emails role)
;; Handle both parameter formats ;; Handle both parameter formats
@ -475,6 +479,17 @@
(ex/raise :type :validation (ex/raise :type :validation
:code :insufficient-permissions)) :code :insufficient-permissions))
(when (and (contains? cf/flags :admin-console)
organization
(not (cto/allowed? :send-invitations
{:organization-perms {:owner-id (:owner-id organization)
:permissions (:permissions organization)}
:profile-id profile-id
:team-perms perms})))
(ex/raise :type :validation
:code :insufficient-permissions
:hint "Organization policy does not allow you to send invitations"))
(when (> invitation-count max-invitations-by-request-threshold) (when (> invitation-count max-invitations-by-request-threshold)
(ex/raise :type :validation (ex/raise :type :validation
:code :max-invitations-by-request :code :max-invitations-by-request