Rocket.chat: Exception while invoking method 'deleteUser' TypeError: Cannot read property 'indexOf' of undefined

[robinreinhardt]

Description:

Some users who registered a long time ago (1-1.5 years ago) via LDAP can no longer log in.
They have not been assigned a name and any role.
The field "Last login" of these users are empty.
And when I try to add role, there is no roles in the list.
So i can't change any settings of these users.
When I try to delete them, I get an error message: internal server error

Log: Exception while invoking method 'deleteUser' TypeError: Cannot read property 'indexOf'
Server Setup Information:

Server Setup Information:

Version of Rocket.Chat Server: 2.0.0
Operating System: CentOS 7
Deployment Method(snap/docker/tar/etc): tar
Number of Running Instances: 5
DB Replicaset Oplog: 1
Node Version: 8.11.4
MongoDB Version: v3.6.13

Relevant logs:

I20191125-09:38:43.248(1) Exception while invoking method 'deleteUser' TypeError: Cannot read property 'indexOf' of undefined at MethodInvocation.deleteUser (server/methods/deleteUser.js:33:34) at MethodInvocation.methodsMap.(anonymous function) (app/lib/server/lib/debug.js:62:34) at MethodInvocation.methodMap.(anonymous function) (packages/rocketchat_monitoring.js:2731:30) at maybeAuditArgumentChecks (packages/ddp-server/livedata_server.js:1767:12) at DDP._CurrentMethodInvocation.withValue (packages/ddp-server/livedata_server.js:719:19) at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1304:12) at DDPServer._CurrentWriteFence.withValue (packages/ddp-server/livedata_server.js:717:46) at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1304:12) at Promise (packages/ddp-server/livedata_server.js:715:46) at new Promise () at Session.method (packages/ddp-server/livedata_server.js:689:23) at packages/ddp-server/livedata_server.js:559:43

[Phhere]

The issue is in https://github.com/RocketChat/Rocket.Chat/blob/d53e264b83ccc971236123853e4b68c9eb6beeb4/server/methods/deleteUser.js#L33

For this single user the roles attribute seems to be missing.
Maybe it should be replaced by the following

const userIsAdmin = Users.isUserInRole(userId,'admin')

[deja-geek]

I have the exact same issue as the original poster. I am on Rocket.Chat version 1.1.3

[deja-geek]

I resolved this by going in to Mongo and adding the roles they should be in to the mongoDB document. For me the user only had to be in the role "user". Find the users "_id" and run this MongoDB statement:
db.users.updateOne( { "_id": "eSKYyKYXTjFYmayGM" }, { $set: { "roles": [ "user" ] } } )

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[Phhere]

@sampaiodiego @ggazzo could you review this?

[memeshift]

I just got this error while testing a new registration. Aside from not going to any screen after I attempt to register, switching to another browser (where I am logged in as an admin) I _am_ able to see the new user under 'Administration>Users, but am unable to assign any role (the drop-down contains nothing). When attempting to DELETE, I get the 'Internal Server Error'.

ENVIRONMENT:
Version | 2.4.9
Apps Engine Version | 1.11.2
Database Migration | 170
Deployment ID | RBrfckkBPK2eKATvg
PID | 992
Running Instances 1
OpLog Enabled

LOG OUT PUT:
Exception while invoking method 'deleteUser' TypeError: Cannot read property 'indexOf' of undefined at MethodInvocation.deleteUser (server/methods/deleteUser.js:33:34) at MethodInvocation.methodsMap.(anonymous function) (app/lib/server/lib/debug.js:67:34) at maybeAuditArgumentChecks (packages/ddp-server/livedata_server.js:1771:12) at DDP._CurrentMethodInvocation.withValue (packages/ddp-server/livedata_server.js:719:19) at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12) at DDPServer._CurrentWriteFence.withValue (packages/ddp-server/livedata_server.js:717:46) at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12) at Promise (packages/ddp-server/livedata_server.js:715:46) at new Promise () at Session.method (packages/ddp-server/livedata_server.js:689:23) at packages/ddp-server/livedata_server.js:559:43

P.S. The last thing I was doing was attempting to adjust registration defaults. I also adjusted some permissions and wanted to restore default permissions, but was unable to find out how in the manual, thinking if I could get back to a 'baseline' I could troubleshoot this better.

[sampaiodiego]

Looks like somehow the user ended up without the roles field..

it can be fixed by "protecting" the code in here:
https://github.com/RocketChat/Rocket.Chat/blob/a84ed8f61fed9b8f4a86a83ba608739ba42ed99c/server/methods/deleteUser.js#L39

[RohitKumar-200]

const userIsAdmin = user.roles?.indexOf('admin') > -1;
I think this will work
Should I create a PR with this fix?