User can start meeting in a channel that they do not have appropriate permissions to post in

[ewwollesen]

I don't know if this is necessarily a Zoom plugin issue, but since it was the Zoom plugin where I noticed it I thought I would start here and then if I need to open an issue in the main MM repo then I can do that or maybe it's just a config setting on our end.

We have a channel that we have effectively made read-only using channel moderation so that only channel admins can post. However, the other day someone who is not a channel admin was able to click the Zoom plugin button in the channel and it posted the "I have started a meeting" dialog to the channel.

Is there a way to prevent this?

[mickmister]

@ewwollesen Would you expect someone that is indeed a channel admin to able to use the plugin to create a meeting in the read-only channel?

@aaronrothschild What are your thoughts on this?

[ewwollesen]

@mickmister Yeah I think from my perspective I would expect the plugin to follow the permissions set for the channel based on whoever pressed the button/used the slash command. So if a user has permissions to post then the "join meeting" dialog would post to the channel, but if they didn't it would give them an error.

I will say that in the grand scheme of things this is a pretty minor. We only have like two channels out of thousands where we have permissions set like this, but I thought it was worth mentioning anyway.

[aaronrothschild]

Agree with Wayne, it's minor but could be a way around for some to cause havoc because those "read-only" channels are usually populated with "Everyone at the organization" and is used for mass announcements, etc. So this could be a fairly visible "bypass".

I believe we now post "as the user" to the channel....I guess Plugins can simply post on behalf of a user, even if that user cannot post to the channel? I think we should check that the user has permission to post to the channel and block it if they don't have access for now.

Side Note for @mickmister The longer term answer is IMO A zoom App which has scopes that limit what the bot can post in channels based on the user's permissions in that channel. We should enforce that a bot cannot post on behalf of a user in a read-only channel that the user doesn't have access to.

[mickmister]

Side Note for @mickmister The longer term answer is IMO A zoom App which has scopes that limit what the bot can post in channels based on the user's permissions in that channel. We should enforce that a bot cannot post on behalf of a user in a read-only channel that the user doesn't have access to.

@aaronrothschild This should already be covered, since the user wouldn't be able to do that with their token anyway

[maisnamrajusingh]

This is similar to the msteams issue, so will work on this once we resolve that one. mattermost/mattermost-plugin-msteams-meetings#29