diff --git a/server/api/members.go b/server/api/members.go index a1cc1880a..3b5dff592 100644 --- a/server/api/members.go +++ b/server/api/members.go @@ -127,7 +127,8 @@ func (a *API) handleAddMember(w http.ResponseWriter, r *http.Request) { return } - if !a.permissions.HasPermissionToBoard(userID, boardID, model.PermissionManageBoardRoles) { + if !a.permissions.HasPermissionToBoard(userID, boardID, model.PermissionManageBoardRoles) && + !(board.Type == model.BoardTypeOpen && a.permissions.HasPermissionToBoard(userID, boardID, model.PermissionManageBoardProperties)) { a.errorResponse(w, r, model.NewErrPermission("access denied to modify board members")) return } diff --git a/server/integrationtests/board_test.go b/server/integrationtests/board_test.go index 722a7b410..360b1711d 100644 --- a/server/integrationtests/board_test.go +++ b/server/integrationtests/board_test.go @@ -1397,8 +1397,8 @@ func TestAddMember(t *testing.T) { require.Equal(t, th.GetUser2().ID, member.UserID) member, resp = th.Client2.AddMemberToBoard(newMember) - th.CheckForbidden(resp) - require.Nil(t, member) + th.CheckOK(resp) + require.NotNil(t, member) members, resp = th.Client2.GetMembersForBoard(board.ID) th.CheckOK(resp) diff --git a/server/integrationtests/permissions_test.go b/server/integrationtests/permissions_test.go index a5688ad6c..8c0b4ce52 100644 --- a/server/integrationtests/permissions_test.go +++ b/server/integrationtests/permissions_test.go @@ -1697,7 +1697,7 @@ func TestPermissionsCreateBoardMembers(t *testing.T) { {"/boards/{PUBLIC_BOARD_ID}/members", methodPost, boardMemberJSON(testData.publicBoard.ID), userTeamMember, http.StatusForbidden, 0}, {"/boards/{PUBLIC_BOARD_ID}/members", methodPost, boardMemberJSON(testData.publicBoard.ID), userViewer, http.StatusForbidden, 0}, {"/boards/{PUBLIC_BOARD_ID}/members", methodPost, boardMemberJSON(testData.publicBoard.ID), userCommenter, http.StatusForbidden, 0}, - {"/boards/{PUBLIC_BOARD_ID}/members", methodPost, boardMemberJSON(testData.publicBoard.ID), userEditor, http.StatusForbidden, 0}, + {"/boards/{PUBLIC_BOARD_ID}/members", methodPost, boardMemberJSON(testData.publicBoard.ID), userEditor, http.StatusOK, 1}, {"/boards/{PUBLIC_BOARD_ID}/members", methodPost, boardMemberJSON(testData.publicBoard.ID), userAdmin, http.StatusOK, 1}, {"/boards/{PUBLIC_BOARD_ID}/members", methodPost, boardMemberJSON(testData.publicBoard.ID), userGuest, http.StatusForbidden, 0}, @@ -1715,7 +1715,7 @@ func TestPermissionsCreateBoardMembers(t *testing.T) { {"/boards/{PUBLIC_TEMPLATE_ID}/members", methodPost, boardMemberJSON(testData.publicTemplate.ID), userTeamMember, http.StatusForbidden, 0}, {"/boards/{PUBLIC_TEMPLATE_ID}/members", methodPost, boardMemberJSON(testData.publicTemplate.ID), userViewer, http.StatusForbidden, 0}, {"/boards/{PUBLIC_TEMPLATE_ID}/members", methodPost, boardMemberJSON(testData.publicTemplate.ID), userCommenter, http.StatusForbidden, 0}, - {"/boards/{PUBLIC_TEMPLATE_ID}/members", methodPost, boardMemberJSON(testData.publicTemplate.ID), userEditor, http.StatusForbidden, 0}, + {"/boards/{PUBLIC_TEMPLATE_ID}/members", methodPost, boardMemberJSON(testData.publicTemplate.ID), userEditor, http.StatusOK, 1}, {"/boards/{PUBLIC_TEMPLATE_ID}/members", methodPost, boardMemberJSON(testData.publicTemplate.ID), userAdmin, http.StatusOK, 1}, {"/boards/{PUBLIC_TEMPLATE_ID}/members", methodPost, boardMemberJSON(testData.publicTemplate.ID), userGuest, http.StatusForbidden, 0}, }