[NEW] Add mention-here permission #7631

packages/rocketchat-authorization/server/startup.js

@@ -40,6 +40,7 @@ Meteor.startup(function() {
 		{ _id: 'manage-own-integrations',       roles : ['admin', 'bot'] },
 		{ _id: 'manage-oauth-apps',             roles : ['admin'] },
 		{ _id: 'mention-all',                   roles : ['admin', 'owner', 'moderator', 'user'] },
+		{ _id: 'mention-here',                  roles : ['admin', 'owner', 'moderator', 'user'] },
 		{ _id: 'mute-user',                     roles : ['admin', 'owner', 'moderator'] },
 		{ _id: 'remove-user',                   roles : ['admin', 'owner', 'moderator'] },
 		{ _id: 'run-import',                    roles : ['admin'] },

packages/rocketchat-lib/package.js

@@ -166,6 +166,7 @@ Package.onUse(function(api) {
 	api.addFiles('server/methods/deleteUserOwnAccount.js', 'server');
 	api.addFiles('server/methods/filterBadWords.js', ['server']);
 	api.addFiles('server/methods/filterATAllTag.js', 'server');
+	api.addFiles('server/methods/filterATHereTag.js', 'server');
 	api.addFiles('server/methods/getChannelHistory.js', 'server');
 	api.addFiles('server/methods/getFullUserData.js', 'server');
 	api.addFiles('server/methods/getRoomJoinCode.js', 'server');

packages/rocketchat-lib/server/methods/filterATHereTag.js

@@ -0,0 +1,34 @@
+import _ from 'underscore';
+
+RocketChat.callbacks.add('beforeSaveMessage', function(message) {
+	// Test if the message mentions include @here.
+	if (message.mentions != null &&
+		_.pluck(message.mentions, '_id').some((item) => item === 'here')) {
+
+		// Check if the user has permissions to use @here in both global and room scopes.
+		if (!RocketChat.authz.hasPermission(message.u._id, 'mention-here') && !RocketChat.authz.hasPermission(message.u._id, 'mention-here', message.rid)) {
+
+			// Get the language of the user for the error notification.
+			const language = RocketChat.models.Users.findOneById(message.u._id).language;
+			const action = TAPi18n.__('Notify_active_in_this_room', {}, language);
+
+			// Add a notification to the chat, informing the user that this
+			// action is not allowed.
+			RocketChat.Notifications.notifyUser(message.u._id, 'message', {
+				_id: Random.id(),
+				rid: message.rid,
+				ts: new Date,
+				msg: TAPi18n.__('error-action-not-allowed', { action }, language)
+			});
+
+			// Also throw to stop propagation of 'sendMessage'.
+			throw new Meteor.Error('error-action-not-allowed', 'Notify here in this room not allowed', {
+				method: 'filterATHereTag',
+				action: 'Notify_active_in_this_room'
+			});
+		}
+	}
+
+	return message;
+
+}, 1, 'filterATHereTag');