From 160c0669f81512190594638b98263f16eddd4351 Mon Sep 17 00:00:00 2001
From: Tainan Felipe <tainanfelipe214@gmail.com>
Date: Thu, 7 Mar 2019 17:23:42 -0300
Subject: [PATCH] Fix publishers access for moderators

---
 .../api/breakouts/server/publishers.js        | 20 +++++++++++--------
 .../imports/api/meetings/server/publishers.js | 12 +++++++----
 .../imports/api/users/server/publishers.js    | 13 +++++++-----
 3 files changed, 28 insertions(+), 17 deletions(-)

diff --git a/bigbluebutton-html5/imports/api/breakouts/server/publishers.js b/bigbluebutton-html5/imports/api/breakouts/server/publishers.js
index b01f3538db..edff5ef6c2 100755
--- a/bigbluebutton-html5/imports/api/breakouts/server/publishers.js
+++ b/bigbluebutton-html5/imports/api/breakouts/server/publishers.js
@@ -1,8 +1,9 @@
 import { Meteor } from 'meteor/meteor';
 import Breakouts from '/imports/api/breakouts';
+import Users from '/imports/api/users';
 import Logger from '/imports/startup/server/logger';
 
-function breakouts(credentials, moderator) {
+function breakouts(credentials, moderator = false) {
   const {
     meetingId,
     requesterUserId,
@@ -10,14 +11,17 @@ function breakouts(credentials, moderator) {
   Logger.info(`Publishing Breakouts for ${meetingId} ${requesterUserId}`);
 
   if (moderator) {
-    const presenterSelector = {
-      $or: [
-        { parentMeetingId: meetingId },
-        { breakoutId: meetingId },
-      ],
-    };
+    const User = Users.findOne({ userId: requesterUserId });
+    if (User.moderator) {
+      const presenterSelector = {
+        $or: [
+          { parentMeetingId: meetingId },
+          { breakoutId: meetingId },
+        ],
+      };
 
-    return Breakouts.find(presenterSelector);
+      return Breakouts.find(presenterSelector);
+    }
   }
 
   const selector = {
diff --git a/bigbluebutton-html5/imports/api/meetings/server/publishers.js b/bigbluebutton-html5/imports/api/meetings/server/publishers.js
index 78d1f486e7..06f7b93e33 100755
--- a/bigbluebutton-html5/imports/api/meetings/server/publishers.js
+++ b/bigbluebutton-html5/imports/api/meetings/server/publishers.js
@@ -1,6 +1,7 @@
 import { Meteor } from 'meteor/meteor';
 import { check } from 'meteor/check';
 import Meetings from '/imports/api/meetings';
+import Users from '/imports/api/users';
 import Logger from '/imports/startup/server/logger';
 
 function meetings(credentials, isModerator = false) {
@@ -19,10 +20,13 @@ function meetings(credentials, isModerator = false) {
   };
 
   if (isModerator) {
-    selector.$or.push({
-      'meetingProp.isBreakout': true,
-      'breakoutProps.parentId': meetingId,
-    });
+    const User = Users.findOne({ userId: requesterUserId });
+    if (User.moderator) {
+      selector.$or.push({
+        'meetingProp.isBreakout': true,
+        'breakoutProps.parentId': meetingId,
+      });
+    }
   }
 
   const options = {
diff --git a/bigbluebutton-html5/imports/api/users/server/publishers.js b/bigbluebutton-html5/imports/api/users/server/publishers.js
index b1fae3ba76..0eeaa17376 100644
--- a/bigbluebutton-html5/imports/api/users/server/publishers.js
+++ b/bigbluebutton-html5/imports/api/users/server/publishers.js
@@ -57,11 +57,14 @@ function users(credentials, isModerator = false) {
   };
 
   if (isModerator) {
-    selector.$or.push({
-      'breakoutProps.isBreakoutUser': true,
-      'breakoutProps.parentId': meetingId,
-      connectionStatus: 'online',
-    });
+    const User = Users.findOne({ userId: requesterUserId });
+    if (User.moderator) {
+      selector.$or.push({
+        'breakoutProps.isBreakoutUser': true,
+        'breakoutProps.parentId': meetingId,
+        connectionStatus: 'online',
+      });
+    }
   }
 
   const options = {