From f04a6056ae832981fa60b8ea85298a10fdef2fa5 Mon Sep 17 00:00:00 2001
From: yflory <yann.flory@xwiki.com>
Date: Tue, 18 Feb 2020 17:04:44 +0100
Subject: [PATCH] Fix race condition with team access rights #497

---
 www/common/outer/mailbox-handlers.js |  7 ++++---
 www/common/outer/team.js             | 26 +++++++++++++++++++-------
 2 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/www/common/outer/mailbox-handlers.js b/www/common/outer/mailbox-handlers.js
index d66ff516e..fec467fc5 100644
--- a/www/common/outer/mailbox-handlers.js
+++ b/www/common/outer/mailbox-handlers.js
@@ -494,10 +494,11 @@ define([
         try {
             var module = ctx.store.modules['team'];
             // changeMyRights returns true if we can't change our rights
-            module.changeMyRights(teamId, content.state, content.teamData);
+            module.changeMyRights(teamId, content.state, content.teamData, function (done) {
+                if (!done) { console.error("Can't update team rights"); }
+                cb(true);
+            });
         } catch (e) { console.error(e); }
-
-        cb(true);
     };
 
     handlers['OWNED_PAD_REMOVED'] = function (ctx, box, data, cb) {
diff --git a/www/common/outer/team.js b/www/common/outer/team.js
index 24952f5c9..a2dbf7c05 100644
--- a/www/common/outer/team.js
+++ b/www/common/outer/team.js
@@ -1067,14 +1067,25 @@ define([
         ctx.emit('ROSTER_CHANGE_RIGHTS', teamId, team.clients);
     };
 
-    var changeMyRights = function (ctx, teamId, state, data) {
-        if (!teamId) { return true; }
+    var changeMyRights = function (ctx, teamId, state, data, cb) {
+        if (!teamId) { return void cb(false); }
         var teamData = Util.find(ctx, ['store', 'proxy', 'teams', teamId]);
-        if (!teamData) { return true; }
+        if (!teamData) { return void cb(false); }
+        var onReady = ctx.onReadyHandlers[teamId];
         var team = ctx.teams[teamId];
-        if (!team) { return true; }
 
-        if (teamData.channel !== data.channel || teamData.password !== data.password) { return true; }
+        if (!team && Array.isArray(onReady)) {
+            onReady.push({
+                cb: function () {
+                    changeMyRights(ctx, teamId, state, data, cb);
+                }
+            });
+            return;
+        }
+
+        if (!team) { return void cb(false); }
+
+        if (teamData.channel !== data.channel || teamData.password !== data.password) { return void cb(false); }
 
         if (state) {
             teamData.hash = data.hash;
@@ -1091,6 +1102,7 @@ define([
         }
 
         updateMyRights(ctx, teamId, data.hash);
+        cb(true);
     };
     var changeEditRights = function (ctx, teamId, user, state, cb) {
         if (!teamId) { return void cb({error: 'EINVAL'}); }
@@ -1632,8 +1644,8 @@ define([
             });
 
         };
-        team.changeMyRights = function (id, edit, teamData) {
-            changeMyRights(ctx, id, edit, teamData);
+        team.changeMyRights = function (id, edit, teamData, cb) {
+            changeMyRights(ctx, id, edit, teamData, cb);
         };
         team.updateMyData = function (data) {
             Object.keys(ctx.teams).forEach(function (id) {