Rocket.chat: [BUG] Users can't send messages (>= 2.4.x)

Created on 28 Dec 2019 · 43Comments · Source: RocketChat/Rocket.Chat

Description:

I updated from 2.3.2 to 2.4.0 - now regular users (only user role) can't send messages anymore. As bot or admin I still can send messages. Will roll back for now.

Server Setup Information:

Version of Rocket.Chat Server: 2.4.0
Operating System: Linux x64
Deployment Method: tar
Number of Running Instances: 1
DB Replicaset Oplog: On
NodeJS Version: 8.17.0
MongoDB Version: 4.0.13

Relevant logs:

I20191228-13:33:45.469(1) server.js:204 System ➔ error Error sending message: Error: You are not authorized to change message properties
     at validateUserIdentity (app/lib/server/functions/sendMessage.js:164:9)
     at sendMessage (app/lib/server/functions/sendMessage.js:174:2)
     at MethodInvocation.sendMessage (app/lib/server/methods/sendMessage.js:86:11)
     at MethodInvocation.methodsMap.(anonymous function) (app/lib/server/lib/debug.js:67:34)
     at maybeAuditArgumentChecks (packages/ddp-server/livedata_server.js:1771:12)
     at DDP._CurrentMethodInvocation.withValue (packages/ddp-server/livedata_server.js:719:19)
     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)
     at DDPServer._CurrentWriteFence.withValue (packages/ddp-server/livedata_server.js:717:46)
     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)
     at Promise (packages/ddp-server/livedata_server.js:715:46)
     at new Promise (<anonymous>)
     at Session.method (packages/ddp-server/livedata_server.js:689:23)
     at packages/ddp-server/livedata_server.js:559:43

Source

soundstorm

👍7

Most helpful comment

Same issue here.
Worked around it by using the reset feature in /admin/Message

jbguerraz on 30 Dec 2019

👍15 🎉2

All 43 comments

Works for me.

himpierre on 28 Dec 2019

I rolled back, updated again and the same thing happened.
Now tried it with updating from 2.2.1 to 2.4.0 and also no regular user can send messages.
So I can only try a later release with a proper MongoDB backup to roll back to (just lost 16 days because of snapshot full restore due to broken mdb backup).

soundstorm on 29 Dec 2019

Strange. My server setup looks exactly like yours.

himpierre on 29 Dec 2019

Our system is hit by this too. The error message is the same.
In our case admins cannot send any messages either.
Happens with both old and new channels.

We have Mongo 3.6, the rest is the same as OP.
OS: CentOS7

After the inital failure I also tested with the previous virtual server snapshot that was still using nodejs version 8.15.1, but the result was the same as with 8.17.0.

Gummikavalier on 30 Dec 2019

Interesting. I really wonder why it works on my system.

himpierre on 30 Dec 2019

Interesting. I really wonder why it works on my system.

Is your setup old? If so, there may be something in the database that needs to have been set earlier that cannot be found on newer systems.

For the reference the setup I used for testing was a fresh install starting from RC 2.2.0. The update path has been 2.2.0 -> 2.3.0 -> 2.3.1 -> 2.3.2.

Gummikavalier on 30 Dec 2019

Good point @Gummikavalier. My system is rather old, yes.

Installed at October 19, 2017 8:57 AM

himpierre on 30 Dec 2019

👍1

Since there were changes to the Oauth / OpenID publication (REST) in 2.4.0, maybe I should also mention that our setup uses Custom OAuth / OpenID authentication. However, the issue was also reproducible using original local admin account that was created during the installation.

Gummikavalier on 30 Dec 2019

Custom OAuth / OpenID is not activated here.

himpierre on 30 Dec 2019

My Setup is from Dec 2016, Zapier was automatically activated back then, additionally I enabled Facebook, but users were all registered by mail.
My admin account is additionally linked to my Facebook account (haven't yet tried to register an account via Facebook then upgrade or even create a new account under the new environment)

soundstorm on 30 Dec 2019

Same issue here.
Worked around it by using the reset feature in /admin/Message

jbguerraz on 30 Dec 2019

👍15 🎉2

Good point @Gummikavalier. My system is rather old, yes.
Installed at October 19, 2017 8:57 AM

our one is from March 17, 2017 6:16 PM but faced the issue. probably not related then.

jbguerraz on 30 Dec 2019

👍1

@jbguerraz Thanks! Resetting Message settings fixed our issue too.

The offending setting seems to be:
Screenshot from 2019-12-30 16-40-02
When it is enabled, the users cannot send messages. When it is disabled (default) they can.

Why I had this enabled probably stems from that I thought it would have something to do with the
Admin -> Layout -> User Interface -> Use Real Name
setting.

Gummikavalier on 30 Dec 2019

👍6

A setting like this should not forbid users to text. Leaving this open until a proper software fix, even if it may work.

soundstorm on 30 Dec 2019

👍2 👀1

Where that setting seems to affect particularly when disabled, is the impersonation setting with outgoing integrations. This does not work anymore:

Screenshot from 2019-12-30 17-45-02
Admin -> Integrations -> Outgoing Webhook

Gummikavalier on 30 Dec 2019

I'm experiencing the same issue, same versions.

The proposed solutions do not work for me. I'm agostino on open.rocket.chat if someone want info to troubleshot the issue.

asarubbo on 7 Jan 2020

I'm experiencing the same issue, same versions.

The proposed solutions do not work for me. I'm agostino on open.rocket.chat if someone want info to troubleshot the issue.

Update:
with @frdmn we tried to debug the issue.
In app.js, we added the following before the Error print:

      console.log("userIsNotABot", userIsNotABot);
      console.log("messageContainsAnyForbiddenProp", messageContainsAnyForbiddenProp);
      console.log("settings.get('Message_SetNameToAliasEnabled')", settings.get('Message_SetNameToAliasEnabled'));
      console.log("message.alias", message.alias);
      console.log("user.name", user.name);

Then, the issue was 'amenable' to:
messageContainsAnyForbiddenProp is true

So we dumped the entire message with:

console.log("message", message);

And then the result was:

message { alias: '',
  msg: 'test',
  attachments: [],
  parseUrls: true,
  bot: undefined,
  groupable: false,
  avatar: 'https://i.imgur.com/Hg2VK4Z.png' }

We finally resolved my issue by adding the bot role to that user, but I reported the entire story that can be helpful.

NOTE: I got the issue only when I tried to post a message with curl, not from the UI

asarubbo on 8 Jan 2020

👍1

For me/us neither App nor Web worked, curl not attempted but that not the usual way to use RC ;)

soundstorm on 8 Jan 2020

We had the same issue - We did the following and it seemed to fix this.

@jbguerraz Thanks! Resetting Message settings fixed our issue too.

The offending setting seems to be:

When it is enabled, the users cannot send messages. When it is disabled (default) they can.

Why I had this enabled probably stems from that I thought it would have something to do with the
Admin -> Layout -> User Interface -> Use Real Name
setting.

pbexiga on 9 Jan 2020

Hi. I have identical problem with this option after install clean verion of Rocket.Chat 2.4.0

heleo-ru on 13 Jan 2020

I'm experiencing the same issue, same versions.
The proposed solutions do not work for me. I'm agostino on open.rocket.chat if someone want info to troubleshot the issue.

Update:
with @frdmn we tried to debug the issue.
In app.js, we added the following before the Error print:
      console.log("userIsNotABot", userIsNotABot);
      console.log("messageContainsAnyForbiddenProp", messageContainsAnyForbiddenProp);
      console.log("settings.get('Message_SetNameToAliasEnabled')", settings.get('Message_SetNameToAliasEnabled'));
      console.log("message.alias", message.alias);
      console.log("user.name", user.name);
Then, the issue was 'amenable' to:
messageContainsAnyForbiddenProp is true

So we dumped the entire message with:
console.log("message", message);
And then the result was:
message { alias: '',
  msg: 'test',
  attachments: [],
  parseUrls: true,
  bot: undefined,
  groupable: false,
  avatar: 'https://i.imgur.com/Hg2VK4Z.png' }
We finally resolved my issue by adding the bot role to that user, but I reported the entire story that can be helpful.

NOTE: I got the issue only when I tried to post a message with curl, not from the UI

Could you tell me where this app.js file is and how to add these commands?

shibiriba on 13 Jan 2020

I've same issue any of users with any role can't send messages in private rooms or on channels.

I was updated Rocket.Chat server 2.3.1 to 2.4.1
Server Setup Information:
Version of Rocket.Chat Server: 2.4.1
Operating System: Debian 9.11
Deployment Method: docker
Number of Running Instances: 1
DB Replicaset Oplog: On
NodeJS Version: 8.17.0
MongoDB Version: 4.0.12

And like @Gummikavalier here I've to disable "Set a User Name to Alias in Message" in Administration Panel > Message, so this feature doesn't work anymore :/

SupportAdar on 14 Jan 2020

Hello, I ended up stopping here because I had a problem integrating with zapier, did a clean install on a virtual machine and realized that this problem is a bug of this new version, and my production version was old. In the old version I did not have this problem (I had another similar problem, but not this one), I believe the only way to fix this is to roll back to version 2.2.0 (which is the one I use and I know not to make mistakes).

shibiriba on 14 Jan 2020

Still not flagged as bug @rocketchat/core

soundstorm on 14 Jan 2020

Could you tell me where this app.js file is and how to add these commands?

For me is programs/server/app/app.js
You can add the commands by editing the js file.

asarubbo on 15 Jan 2020

This is clearly a bug, easily reproducible with a clean install of Rocket.Chat >= 2.4.0 and setting Message_SetNameToAliasEnabled to false.

You wont be able to send messages or attachments.

AmShaegar13 on 15 Jan 2020

When I set Message_SetNameToAliasEnabled to true, message cannot be sent by human users. And robot through python rocketchat_API would get

{'error': 'You are not authorized to change message properties',
 'success': False}

xgdgsc on 16 Jan 2020

Why I cannot see reset section button in /admin/Message

xgdgsc on 16 Jan 2020

@xgdgsc you can chekc network output in DevTools, also I've front problem with admin panel, exact when I want choose any switch form Message options everything disapear on panel any it only work on 25% page scale.

SupportAdar on 16 Jan 2020

@rodrigok @sampaiodiego are you guys aware of this bug? It feels like not. :-)

cheers, t.

himpierre on 16 Jan 2020

👀1

We also had the Problem that neither Users or Admins could send Messages after the Update from 2.3.1 to 2.4.1
The suggestion from @Gummikavalier (disbling the Use Real Name Option) solved it for us.

But since many people had this issue and it cost us about half an hour to restore the chat (analyzing, testing, finding this issue, trying it), maybe it would be wise to withdraw the release until this is fixed.

herbetom on 16 Jan 2020

2.4.2 bug still here.
@jbguerraz thanks!

ghost on 20 Jan 2020

I just hit this issue as well after an update to version 2.4.2. Changing the "set username to alias" setting to false is working for my users at the moment.

doransmestad on 20 Jan 2020

Same here. I am still puzzled by the fact that this bug was reported on 28.12.2019 and nonetheless this morning my snap image of rocket-chat was automatically updated to a broken version. Has this bug been accepted as such?