diff --git a/bigbluebutton-html5/imports/api/annotations/server/methods/clearWhiteboard.js b/bigbluebutton-html5/imports/api/annotations/server/methods/clearWhiteboard.js index 8254c344ea..c8552db104 100644 --- a/bigbluebutton-html5/imports/api/annotations/server/methods/clearWhiteboard.js +++ b/bigbluebutton-html5/imports/api/annotations/server/methods/clearWhiteboard.js @@ -4,6 +4,8 @@ import RedisPubSub from '/imports/startup/server/redis'; import { Meteor } from 'meteor/meteor'; import { check } from 'meteor/check'; +import isPodPresenter from '/imports/api/presentation-pods/server/utils/isPodPresenter'; + export default function clearWhiteboard(credentials, whiteboardId) { const REDIS_CONFIG = Meteor.settings.private.redis; const CHANNEL = REDIS_CONFIG.channels.toAkkaApps; @@ -16,7 +18,8 @@ export default function clearWhiteboard(credentials, whiteboardId) { check(requesterToken, String); check(whiteboardId, String); - const allowed = Acl.can('methods.clearWhiteboard', credentials) || getMultiUserStatus(meetingId, whiteboardId); + const allowed = isPodPresenter(meetingId, whiteboardId, requesterUserId) + || getMultiUserStatus(meetingId, whiteboardId); if (!allowed) { throw new Meteor.Error('not-allowed', `User ${requesterUserId} is not allowed to clear the whiteboard`); } diff --git a/bigbluebutton-html5/imports/api/annotations/server/methods/sendAnnotation.js b/bigbluebutton-html5/imports/api/annotations/server/methods/sendAnnotation.js index 33c78a66e0..d5e1514a97 100755 --- a/bigbluebutton-html5/imports/api/annotations/server/methods/sendAnnotation.js +++ b/bigbluebutton-html5/imports/api/annotations/server/methods/sendAnnotation.js @@ -5,6 +5,8 @@ import { Meteor } from 'meteor/meteor'; import { check } from 'meteor/check'; import Annotations from '/imports/api/annotations'; +import isPodPresenter from '/imports/api/presentation-pods/server/utils/isPodPresenter'; + function isLastMessage(meetingId, annotation, userId) { const DRAW_END = Meteor.settings.public.whiteboard.annotations.status.end; @@ -43,7 +45,7 @@ export default function sendAnnotation(credentials, annotation) { // and then slide/presentation changes, the user lost presenter rights, // or multi-user whiteboard gets turned off // So we allow the last "DRAW_END" message to pass through, to finish the shape. - const allowed = Acl.can('methods.sendAnnotation', credentials) || + const allowed = isPodPresenter(meetingId, whiteboardId, requesterUserId) || getMultiUserStatus(meetingId, whiteboardId) || isLastMessage(meetingId, annotation, requesterUserId); diff --git a/bigbluebutton-html5/imports/api/annotations/server/methods/undoAnnotation.js b/bigbluebutton-html5/imports/api/annotations/server/methods/undoAnnotation.js index 3089d077b2..3247955baf 100644 --- a/bigbluebutton-html5/imports/api/annotations/server/methods/undoAnnotation.js +++ b/bigbluebutton-html5/imports/api/annotations/server/methods/undoAnnotation.js @@ -4,6 +4,8 @@ import RedisPubSub from '/imports/startup/server/redis'; import { Meteor } from 'meteor/meteor'; import { check } from 'meteor/check'; +import isPodPresenter from '/imports/api/presentation-pods/server/utils/isPodPresenter'; + export default function undoAnnotation(credentials, whiteboardId) { const REDIS_CONFIG = Meteor.settings.private.redis; const CHANNEL = REDIS_CONFIG.channels.toAkkaApps; @@ -16,7 +18,9 @@ export default function undoAnnotation(credentials, whiteboardId) { check(requesterToken, String); check(whiteboardId, String); - const allowed = Acl.can('methods.undoAnnotation', credentials) || getMultiUserStatus(meetingId, whiteboardId); + const allowed = isPodPresenter(meetingId, whiteboardId, requesterUserId) + || getMultiUserStatus(meetingId, whiteboardId); + if (!allowed) { throw new Meteor.Error('not-allowed', `User ${requesterUserId} is not allowed to undo the annotation`); } diff --git a/bigbluebutton-html5/imports/api/cursor/server/methods/publishCursorUpdate.js b/bigbluebutton-html5/imports/api/cursor/server/methods/publishCursorUpdate.js index b6249e1d47..c7e051b8d3 100644 --- a/bigbluebutton-html5/imports/api/cursor/server/methods/publishCursorUpdate.js +++ b/bigbluebutton-html5/imports/api/cursor/server/methods/publishCursorUpdate.js @@ -4,6 +4,7 @@ import Acl from '/imports/startup/acl'; import { Meteor } from 'meteor/meteor'; import { check } from 'meteor/check'; +import isPodPresenter from '/imports/api/presentation-pods/server/utils/isPodPresenter'; export default function publishCursorUpdate(credentials, payload) { const REDIS_CONFIG = Meteor.settings.private.redis; @@ -21,7 +22,10 @@ export default function publishCursorUpdate(credentials, payload) { whiteboardId: String, }); - const allowed = Acl.can('methods.moveCursor', credentials) || getMultiUserStatus(meetingId, payload.whiteboardId); + const { whiteboardId } = payload; + + const allowed = isPodPresenter(meetingId, whiteboardId, requesterUserId) + || getMultiUserStatus(meetingId, whiteboardId); if (!allowed) { throw new Meteor.Error('not-allowed', `User ${requesterUserId} is not allowed to move the cursor`); } diff --git a/bigbluebutton-html5/imports/api/presentation-pods/server/utils/isPodPresenter.js b/bigbluebutton-html5/imports/api/presentation-pods/server/utils/isPodPresenter.js new file mode 100644 index 0000000000..76cec54043 --- /dev/null +++ b/bigbluebutton-html5/imports/api/presentation-pods/server/utils/isPodPresenter.js @@ -0,0 +1,9 @@ +import Slides from '/imports/api/slides'; +import PresentationPods from '/imports/api/presentation-pods'; + +export default function isPodPresenter(meetingId, whiteboardId, userId) { + const slide = Slides.findOne({ meetingId, id: whiteboardId }); + const pod = PresentationPods.findOne({ meetingId, podId: slide.podId }); + + return pod.currentPresenterId === userId; +}