Rocket.chat: SendMessage ignores archive-flag

[smoehrle]

Description:

It is possible to send messages even if a room is archived. The client shows a 'This room is read only' message but via the api it is still possible to send messages because there is no backend check. Even some of the clients were still able to write messages because they did not receive an update for the room(?)/did not reload.

Steps to reproduce:

1. Archive an existing room
2. Send a message via the api or (in some cases) even the client. Reloading blocks the client but the api still works.

Expected behavior:

The backend should check for the archived-flag and reject the message

Actual behavior:

The message is saved as if the room was not archived

Server Setup Information:

• Version of Rocket.Chat Server: 0.71.1
• Operating System: debian 9.5
• Deployment Method: docker
• Number of Running Instances:1
• DB Replicaset Oplog:
• NodeJS Version:
• MongoDB Version:

[vynmera]

this also happens with readonly rooms or rooms you've been muted in

:cold_sweat: don't let the vandals know...

[smoehrle]

How did you manage to get this to work with readonly rooms and rooms you've been muted in?

For a room were I have been muted, I get something like this:
ddp_asyncio.exceptions.RemoteMethodError: [You can't send messages because you have been muted]
And when I set a room to readonly all users get automatically muted, even the owner. Only with admin privileges I'm still able to write.

[vynmera]

try the other API? theres 2 @smoehrle

[reyalpsirc]

I just found this too on my side. The channels I archived which were still appearing to my other users (since I'm not updating the data about archived channels yet in realtime) allowed the messages that were sent after archive.

In my case I'm using chat.postMessage to send the messages and channels.archive to archive a channel

[graywolf336]

@MarcosSpessatto fyi

[reyalpsirc]

@MarcosSpessatto any news on this?

[vynmera]

Would, too, like to hear a status update. This is a bomb waiting to blow for every team.. (especially factoring in the readonly/muted)

[MarcosSpessatto]

Sorry for the long delay, I'll fix it for the next release. Thanks for let us know. :+1: