teams: defaulting invalid permission level to member permission level

2019-03-19 14:01:13 +01:00
parent c823ad5de7
commit c826f39a8b
2 changed files with 32 additions and 1 deletions
@@ -271,7 +271,10 @@ func UpdateTeamMember(cmd *m.UpdateTeamMemberCommand) error {
 			return m.ErrTeamMemberNotFound
 		}

-		// TODO: check to make sure that permission is a legal value
+		if cmd.Permission != int64(m.PERMISSION_ADMIN) {
+			cmd.Permission = 0
+		}
+
 		member.Permission = cmd.Permission
 		_, err = sess.Cols("permission").Where("org_id=? and team_id=? and user_id=?", cmd.OrgId, cmd.TeamId, cmd.UserId).Update(member)