Merge pull request #4159 from RocketChat/ChecksNew

Add more checks to methods

.eslintrc

@@ -63,7 +63,9 @@
 		"block-scoped-var": 2,
 		"curly": [2, "all"],
 		"eqeqeq": [2, "allow-null"],
-		"new-cap": 2,
+		"new-cap":  [2, {
+			"capIsNewExceptions": ["Match.Optional"]
+		}],
 		"use-isnan": 2,
 		"valid-typeof": 2,
 		"linebreak-style": [2, "unix"],

packages/rocketchat-lib/server/methods/archiveRoom.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	archiveRoom: (rid) ->
+
+		check rid, String
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'archiveRoom' }
 

packages/rocketchat-lib/server/methods/createChannel.coffee

@@ -1,5 +1,9 @@
 Meteor.methods
 	createChannel: (name, members) ->
+
+		check name, String
+		check members, Match.Optional([String])
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', "Invalid user", { method: 'createChannel' }
 

packages/rocketchat-lib/server/methods/createPrivateGroup.coffee

@@ -1,5 +1,9 @@
 Meteor.methods
 	createPrivateGroup: (name, members) ->
+
+		check name, String
+		check members, Match.Optional([String])
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', "Invalid user", { method: 'createPrivateGroup' }
 

packages/rocketchat-lib/server/methods/deleteMessage.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	deleteMessage: (message) ->
+
+		check message, Match.ObjectIncluding({_id:String})
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'deleteMessage' }
 

packages/rocketchat-lib/server/methods/joinRoom.coffee

@@ -1,5 +1,9 @@
 Meteor.methods
 	joinRoom: (rid, code) ->
+
+		check rid, String
+		check code, String
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'joinRoom' }
 

packages/rocketchat-lib/server/methods/leaveRoom.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	leaveRoom: (rid) ->
+
+		check rid, String
+
 		unless Meteor.userId()
 			throw new Meteor.Error('error-invalid-user', "Invalid user", { method: 'leaveRoom' })
 

packages/rocketchat-lib/server/methods/unarchiveRoom.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	unarchiveRoom: (rid) ->
+
+		check rid, String
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'unarchiveRoom' }
 

packages/rocketchat-lib/server/methods/updateMessage.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	updateMessage: (message) ->
+
+		check message, Match.ObjectIncluding({_id:String})
+
 		if not Meteor.userId()
 			throw new Meteor.Error('error-invalid-user', "Invalid user", { method: 'updateMessage' })
 

server/methods/addAllUserToRoom.js

@@ -1,5 +1,8 @@
 Meteor.methods({
 	addAllUserToRoom: function(rid) {
+
+		check (rid, String);
+
 		if (RocketChat.authz.hasRole(this.userId, 'admin') === true) {
 			var now, room, users;
 			var userCount = RocketChat.models.Users.find().count();

server/methods/addRoomModerator.coffee

@@ -1,11 +1,12 @@
 Meteor.methods
 	addRoomModerator: (rid, userId) ->
-		unless Meteor.userId()
-			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'addRoomModerator' }
 
 		check rid, String
 		check userId, String
 
+		unless Meteor.userId()
+			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'addRoomModerator' }
+
 		unless RocketChat.authz.hasPermission Meteor.userId(), 'set-moderator', rid
 			throw new Meteor.Error 'error-not-allowed', 'Not allowed', { method: 'addRoomModerator' }
 

server/methods/addRoomOwner.coffee

@@ -1,11 +1,12 @@
 Meteor.methods
 	addRoomOwner: (rid, userId) ->
-		unless Meteor.userId()
-			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'addRoomOwner' }
 
 		check rid, String
 		check userId, String
 
+		unless Meteor.userId()
+			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'addRoomOwner' }
+
 		unless RocketChat.authz.hasPermission Meteor.userId(), 'set-owner', rid
 			throw new Meteor.Error 'error-not-allowed', 'Not allowed', { method: 'addRoomOwner' }
 

server/methods/canAccessRoom.coffee

@@ -1,5 +1,9 @@
 Meteor.methods
 	canAccessRoom: (rid, userId) ->
+
+		check rid, String
+		check userId, String
+
 		user = RocketChat.models.Users.findOneById userId, fields: username: 1
 
 		unless user?.username

server/methods/channelsList.coffee

@@ -1,5 +1,11 @@
 Meteor.methods
 	channelsList: (filter, channelType, limit, sort) ->
+
+		check filter, String
+		check channelType, String
+		check limit, Match.Optional(Number)
+		check sort, Match.Optional(String)
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'channelsList' }
 

server/methods/createDirectMessage.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	createDirectMessage: (username) ->
+
+		check username, String
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', "Invalid user", { method: 'createDirectMessage' }
 

server/methods/deleteFileMessage.js

@@ -1,5 +1,7 @@
 Meteor.methods({
 	deleteFileMessage: function(fileID) {
+		check(fileID, String);
+
 		return Meteor.call('deleteMessage', RocketChat.models.Messages.getMessageByFileId(fileID));
 	}
 });

server/methods/deleteUser.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	deleteUser: (userId) ->
+
+		check userId, String
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', "Invalid user", { method: 'deleteUser' }
 

server/methods/eraseRoom.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	eraseRoom: (rid) ->
+
+		check rid, String
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'eraseRoom' }
 

server/methods/getAvatarSuggestion.coffee

@@ -1,4 +1,7 @@
 @getAvatarSuggestionForUser = (user) ->
+
+	check user, Object
+
 	avatars = []
 
 	if user.services.facebook?.id? and RocketChat.settings.get 'Accounts_OAuth_Facebook'

server/methods/getRoomIdByNameOrId.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	getRoomIdByNameOrId: (rid) ->
+
+		check rid, String
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'getRoomIdByNameOrId' }
 

server/methods/groupsList.js

@@ -1,5 +1,10 @@
 Meteor.methods({
 	groupsList: function(nameFilter, limit, sort) {
+
+		check(nameFilter, String);
+		check(limit, Match.Optional(Number));
+		check(sort, Match.Optional(String));
+
 		if (!Meteor.userId()) {
 			throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'groupsList' });
 		}

server/methods/hideRoom.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	hideRoom: (rid) ->
+
+		check rid, String
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'hideRoom' }
 

server/methods/loadHistory.coffee

@@ -1,5 +1,11 @@
 Meteor.methods
 	loadHistory: (rid, end, limit=20, ls) ->
+
+		check rid, String
+		check end, Match.Optional(Number)
+		check limit, Number
+		check ls, Match.Optional(Number)
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'loadHistory' }
 

server/methods/loadLocale.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	loadLocale: (locale) ->
+
+		check locale, String
+
 		try
 			return Assets.getText "moment-locales/#{locale.toLowerCase()}.js"
 		catch e

server/methods/loadMissedMessages.coffee

@@ -1,5 +1,9 @@
 Meteor.methods
 	loadMissedMessages: (rid, start) ->
+
+		check rid, String
+		check start, Number
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'loadMissedMessages' }
 

server/methods/loadNextMessages.coffee

@@ -1,5 +1,10 @@
 Meteor.methods
 	loadNextMessages: (rid, end, limit=20) ->
+
+		check rid, String
+		check end, Match.Optional(Number)
+		check limt, Number
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'loadNextMessages' }
 

server/methods/loadSurroundingMessages.coffee

@@ -1,5 +1,9 @@
 Meteor.methods
 	loadSurroundingMessages: (message, limit=50) ->
+
+		check message, Object
+		check limit, Number
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'loadSurroundingMessages' }
 

server/methods/logoutCleanUp.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	logoutCleanUp: (user) ->
+
+		check user, Object
+
 		Meteor.defer ->
 
 			RocketChat.callbacks.run 'afterLogoutCleanUp', user

server/methods/messageSearch.coffee

@@ -1,5 +1,10 @@
 Meteor.methods
 	messageSearch: (text, rid, limit) ->
+
+		check text, String
+		check rid, String
+		check limit, Match.Optional(Number)
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'messageSearch' }
 

server/methods/migrate.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	migrateTo: (version) ->
+
+		check version, String
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'migrateTo' }
 

server/methods/muteUserInRoom.coffee

@@ -1,10 +1,12 @@
 Meteor.methods
 	muteUserInRoom: (data) ->
+
+		check(data, Match.ObjectIncluding({ rid: String, username: String }))
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'muteUserInRoom' }
 
 		fromId = Meteor.userId()
-		check(data, Match.ObjectIncluding({ rid: String, username: String }))
 
 		unless RocketChat.authz.hasPermission(fromId, 'mute-user', data.rid)
 			throw new Meteor.Error 'error-not-allowed', 'Not allowed', { method: 'muteUserInRoom' }

server/methods/openRoom.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
   openRoom: (rid) ->
+
+    check rid, String
+
     if not Meteor.userId()
       throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'openRoom' }
 

server/methods/readMessages.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	readMessages: (rid) ->
+
+		check rid, String
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'readMessages' }
 

server/methods/registerUser.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	registerUser: (formData) ->
+
+		check formData, Object
+
 		if RocketChat.settings.get('Accounts_RegistrationForm') is 'Disabled'
 			throw new Meteor.Error 'error-user-registration-disabled', 'User registration is disabled', { method: 'registerUser' }
 

server/methods/removeRoomModerator.coffee

@@ -1,11 +1,12 @@
 Meteor.methods
 	removeRoomModerator: (rid, userId) ->
-		unless Meteor.userId()
-			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'removeRoomModerator' }
 
 		check rid, String
 		check userId, String
 
+		unless Meteor.userId()
+			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'removeRoomModerator' }
+
 		unless RocketChat.authz.hasPermission Meteor.userId(), 'set-moderator', rid
 			throw new Meteor.Error 'error-not-allowed', 'Not allowed', { method: 'removeRoomModerator' }
 

server/methods/removeRoomOwner.coffee

@@ -1,11 +1,12 @@
 Meteor.methods
 	removeRoomOwner: (rid, userId) ->
-		unless Meteor.userId()
-			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'removeRoomOwner' }
 
 		check rid, String
 		check userId, String
 
+		unless Meteor.userId()
+			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'removeRoomOwner' }
+
 		unless RocketChat.authz.hasPermission Meteor.userId(), 'set-owner', rid
 			throw new Meteor.Error 'error-not-allowed', 'Not allowed', { method: 'removeRoomOwner' }
 

server/methods/removeUserFromRoom.coffee

@@ -1,10 +1,12 @@
 Meteor.methods
 	removeUserFromRoom: (data) ->
+
+		check(data, Match.ObjectIncluding({ rid: String, username: String }))
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'removeUserFromRoom' }
 
 		fromId = Meteor.userId()
-		check(data, Match.ObjectIncluding({ rid: String, username: String }))
 
 		unless RocketChat.authz.hasPermission(fromId, 'remove-user', data.rid)
 			throw new Meteor.Error 'error-not-allowed', 'Not allowed', { method: 'removeUserFromRoom' }

server/methods/reportMessage.coffee

@@ -1,5 +1,9 @@
 Meteor.methods
 	reportMessage: (message, description) ->
+
+		check message, Object
+		check description, String
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'reportMessage' }
 

server/methods/resetAvatar.coffee

@@ -1,5 +1,5 @@
 Meteor.methods
-	resetAvatar: (image, service) ->
+	resetAvatar:->
 		unless Meteor.userId()
 			throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'resetAvatar' });
 

server/methods/saveUserPreferences.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	saveUserPreferences: (settings) ->
+
+		check settings, Object
+
 		if Meteor.userId()
 			preferences = {}
 

server/methods/saveUserProfile.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	saveUserProfile: (settings) ->
+
+		check settings, Object
+
 		unless RocketChat.settings.get("Accounts_AllowUserProfileChange")
 			throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'saveUserProfile' })
 

server/methods/sendConfirmationEmail.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	sendConfirmationEmail: (email) ->
+
+		check email, String
+
 		user = RocketChat.models.Users.findOneByEmailAddress s.trim(email)
 
 		if user?

server/methods/sendForgotPasswordEmail.coffee

@@ -1,6 +1,8 @@
 Meteor.methods
 	sendForgotPasswordEmail: (email) ->
 
+		check email, String
+
 		email = s.trim(email)
 		user = RocketChat.models.Users.findOneByEmailAddress(email)
 		regex = new RegExp("^" + s.escapeRegExp(email) + "$", 'i')

server/methods/setAvatarFromService.coffee

@@ -1,5 +1,10 @@
 Meteor.methods
 	setAvatarFromService: (dataURI, contentType, service) ->
+
+		check dataURI, String
+		check contentType, Match.Optional(String)
+		check service, Match.Optional(String)
+
 		unless Meteor.userId()
 			throw new Meteor.Error('error-invalid-user', "Invalid user", { method: 'setAvatarFromService' })
 

server/methods/setUserActiveStatus.coffee

@@ -1,5 +1,9 @@
 Meteor.methods
 	setUserActiveStatus: (userId, active) ->
+
+		check userId, String
+		check active, Boolean
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'setUserActiveStatus' }
 

server/methods/setUserPassword.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	setUserPassword: (password) ->
+
+		check password, String
+
 		if not Meteor.userId()
 			throw new Meteor.Error 'error-invalid-user', 'Invalid user', { method: 'setUserPassword' }
 

server/methods/toogleFavorite.coffee

@@ -1,5 +1,9 @@
 Meteor.methods
 	toggleFavorite: (rid, f) ->
+
+		check rid, String
+		check f, Match.Optional(Boolean)
+
 		if not Meteor.userId()
 			throw new Meteor.Error('error-invalid-user', "Invalid user", { method: 'toggleFavorite' })
 

server/methods/userSetUtcOffset.coffee

@@ -1,5 +1,8 @@
 Meteor.methods
 	userSetUtcOffset: (utcOffset) ->
+
+		check utcOffset, Number
+
 		if not @userId?
 			return