Merge pull request #6919 from phutchins/feature/deleteAnyMessagePermi…

…ssion [NEW] Feature/delete any message permission
RocketChat · May 10, 2017 · d6883a0 · d6883a0
2 parents e7dd4b8 + 9cf1bcc
commit d6883a0
Show file tree

Hide file tree

Showing 6 changed files with 174 additions and 40 deletions.
diff --git a/client/methods/deleteMessage.js b/client/methods/deleteMessage.js
@@ -11,18 +11,18 @@ Meteor.methods({
 		message = ChatMessage.findOne({ _id: message._id });
 
 		const hasPermission = RocketChat.authz.hasAtLeastOnePermission('delete-message', message.rid);
+		const forceDelete = RocketChat.authz.hasAtLeastOnePermission('force-delete-message', message.rid);
 		const deleteAllowed = RocketChat.settings.get('Message_AllowDeleting');
 		let deleteOwn = false;
+
 		if (message && message.u && message.u._id) {
 			deleteOwn = message.u._id === Meteor.userId();
 		}
-
-		if (!(hasPermission || (deleteAllowed && deleteOwn))) {
+		if (!(forceDelete || hasPermission || (deleteAllowed && deleteOwn))) {
 			return false;
 		}
-
 		const blockDeleteInMinutes = RocketChat.settings.get('Message_AllowDeleting_BlockDeleteInMinutes');
-		if (_.isNumber(blockDeleteInMinutes) && blockDeleteInMinutes !== 0) {
+		if (!(forceDelete) || (_.isNumber(blockDeleteInMinutes) && blockDeleteInMinutes !== 0)) {
 			if (message.ts) {
 				const msgTs = moment(message.ts);
 				if (msgTs) {

diff --git a/packages/rocketchat-authorization/server/startup.js b/packages/rocketchat-authorization/server/startup.js
@@ -32,6 +32,7 @@ Meteor.startup(function() {
 		{ _id: 'edit-other-user-password',      roles : ['admin'] },
 		{ _id: 'edit-privileged-setting',       roles : ['admin'] },
 		{ _id: 'edit-room',                     roles : ['admin', 'owner', 'moderator'] },
+		{ _id: 'force-delete-message',          roles : ['admin', 'owner'] },
 		{ _id: 'join-without-join-code',        roles : ['admin', 'bot'] },
 		{ _id: 'manage-assets',                 roles : ['admin'] },
 		{ _id: 'manage-emoji',                  roles : ['admin'] },