expose exceptions to non logged users

RocketChat · Sep 18, 2023 · 66dc626 · 66dc626
1 parent bd2b193
commit 66dc626
Show file tree

Hide file tree

Showing 3 changed files with 52 additions and 55 deletions.
diff --git a/apps/meteor/app/api/server/default/info.ts b/apps/meteor/app/api/server/default/info.ts
@@ -1,15 +1,12 @@
 import { API } from '../api';
-import { getLoggedInUser } from '../helpers/getLoggedInUser';
 import { getServerInfo } from '../lib/getServerInfo';
 
 API.default.addRoute(
 	'info',
 	{ authRequired: false },
 	{
 		async get() {
-			const user = await getLoggedInUser(this.request);
-
-			return API.v1.success(await getServerInfo(user?._id));
+			return API.v1.success(await getServerInfo(this.userId));
 		},
 	},
 );

diff --git a/apps/meteor/app/api/server/lib/getServerInfo.ts b/apps/meteor/app/api/server/lib/getServerInfo.ts
@@ -5,35 +5,33 @@ import {
 } from '../../../cloud/server/functions/supportedVersionsToken/supportedVersionsToken';
 import { Info, minimumClientVersions } from '../../../utils/rocketchat.info';
 
-type ServerInfo =
-	| {
-			info: typeof Info;
-			supportedVersions?: string;
-			minimumClientVersions: typeof minimumClientVersions;
-	  }
-	| {
-			version: string | undefined;
-	  };
+type ServerInfo = {
+	info?: typeof Info;
+	supportedVersions?: string;
+	minimumClientVersions: typeof minimumClientVersions;
+	version: string | undefined;
+};
 
 const removePatchInfo = (version: string): string => version.replace(/(\d+\.\d+).*/, '$1');
 
 export async function getServerInfo(userId?: string): Promise<ServerInfo> {
-	if (userId && (await hasPermissionAsync(userId, 'get-server-info'))) {
-		const supportedVersionsToken = await wrapPromise(getCachedSupportedVersionsToken());
+	const hasPermissionToViewStatistics = userId && (await hasPermissionAsync(userId, 'view-statistics'));
+	const supportedVersionsToken = await wrapPromise(getCachedSupportedVersionsToken());
 
-		return {
+	return {
+		version: removePatchInfo(Info.version),
+
+		...(hasPermissionToViewStatistics && {
 			info: {
 				...Info,
 			},
-			minimumClientVersions,
-			...(supportedVersionsToken.success &&
-				supportedVersionsToken.result && {
-					supportedVersions: supportedVersionsToken.result,
-				}),
-		};
-	}
+			version: Info.version,
+		}),
 
-	return {
-		version: removePatchInfo(Info.version),
+		minimumClientVersions,
+		...(supportedVersionsToken.success &&
+			supportedVersionsToken.result && {
+				supportedVersions: supportedVersionsToken.result,
+			}),
 	};
 }
diff --git a/packages/rest-typings/src/default/index.ts b/packages/rest-typings/src/default/index.ts
@@ -1,36 +1,38 @@
 // eslint-disable-next-line @typescript-eslint/naming-convention
 export interface DefaultEndpoints {
 	'/info': {
-		GET: () =>
-			| {
-					info: {
-						build: {
-							arch: string;
-							cpus: number;
-							date: string;
-							freeMemory: number;
-							nodeVersion: string;
-							osRelease: string;
-							platform: string;
-							totalMemory: number;
-						};
-						commit: {
-							author?: string;
-							branch?: string;
-							date?: string;
-							hash?: string;
-							subject?: string;
-							tag?: string;
-						};
-						marketplaceApiVersion: string;
-						version: string;
-						tag?: string;
-						branch?: string;
-					};
-			  }
-			| {
-					version: string | undefined;
-			  };
+		GET: () => {
+			info: {
+				build: {
+					arch: string;
+					cpus: number;
+					date: string;
+					freeMemory: number;
+					nodeVersion: string;
+					osRelease: string;
+					platform: string;
+					totalMemory: number;
+				};
+				commit: {
+					author?: string;
+					branch?: string;
+					date?: string;
+					hash?: string;
+					subject?: string;
+					tag?: string;
+				};
+				marketplaceApiVersion: string;
+				version: string;
+				tag?: string;
+				branch?: string;
+			};
+			supportedVersions?: string;
+			minimumClientVersions: {
+				desktop: string;
+				mobile: string;
+			};
+			version: string | undefined;
+		};
 	};
 	'/ecdh_proxy/initEncryptedSession': {
 		POST: () => void;