api: wrong permissions on file uploaded to channel about mattermost HOT 8 CLOSED

Opened https://mattermost.atlassian.net/browse/MM-57792.

from mattermost.

Closing as the team mentioned that this is working as expected.

from mattermost.

hi @haavardw ! This is working as expected. The way file uploads work in Mattermost is that you upload the file via the mentioned POST /api/v4/files API, this gives you a fileID. This file ID is then linked to a post in a channel. Who can access a file depends on who can access the corresponding post. Only uploading the file won't work. If it did, anyone would be able to see files from channels they are not a member of.

Does that solve your concern?

from mattermost.

@harshilsharma63 Not really, I'm not sure the problem is fully understood.

• This used to work before (I'm not sure what exact version).
• Authorization should be checked link access time, not when the link is published. In this case the file is uploaded to a given channel and it should be available for users with read access to this channel (as per documentation).

from mattermost.

@haavardw Do you remember what MM version it used to work?

from mattermost.

@harshilsharma63 It worked in 9.6.0 (downgraded and re-testet with 9.6.0 today)

from mattermost.

@harshilsharma63 it also works in 9.6.1

from mattermost.

@haavardw okay, I'll check it out.

from mattermost.