From 49bd5a13acf2f54afd48874b53a93b784651dda9 Mon Sep 17 00:00:00 2001
From: Mattermost Build <build@mattermost.com>
Date: Tue, 18 Aug 2020 09:43:09 -0400
Subject: [PATCH] MM-26436: Allows others' posts to be delete with just
 'delete_others_posts' permission. (#4660) (#4694)

(cherry picked from commit 7f7e7e75546d542e8f8c6f50c44764c67dbb5cb1)

Co-authored-by: Martin Kraft <martinkraft@gmail.com>
---
 app/mm-redux/utils/post_utils.ts | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/app/mm-redux/utils/post_utils.ts b/app/mm-redux/utils/post_utils.ts
index 5cca5671f..0623147b5 100644
--- a/app/mm-redux/utils/post_utils.ts
+++ b/app/mm-redux/utils/post_utils.ts
@@ -62,11 +62,18 @@ export function canDeletePost(state: GlobalState, config: any, license: any, tea
     const isOwner = isPostOwner(userId, post);
 
     if (hasNewPermissions(state)) {
-        const canDelete = haveIChannelPermission(state, {team: teamId, channel: channelId, permission: Permissions.DELETE_POST});
-        if (!isOwner) {
-            return canDelete && haveIChannelPermission(state, {team: teamId, channel: channelId, permission: Permissions.DELETE_OTHERS_POSTS});
+        let permissions = [];
+        if (isOwner) {
+            permissions = [Permissions.DELETE_POST];
+        } else {
+            const {serverVersion} = state.entities.general;
+
+            // prior to v5.27, the server used to require delete_own_posts and
+            // delete_others_posts permissions to be able to delete a post by a
+            // different author.
+            permissions = isMinimumServerVersion(serverVersion, 5, 27) ? [Permissions.DELETE_OTHERS_POSTS] : [Permissions.DELETE_POST, Permissions.DELETE_OTHERS_POSTS];
         }
-        return canDelete;
+        return permissions.every((permission) => haveIChannelPermission(state, {team: teamId, channel: channelId, permission, default: false}));
     }
 
     // Backwards compatibility with pre-advanced permissions config settings.
@@ -87,11 +94,12 @@ export function canEditPost(state: GlobalState, config: any, license: any, teamI
     let canEdit = true;
 
     if (hasNewPermissions(state)) {
-        const {serverVersion} = state.entities.general;
         let permissions = [];
         if (isOwner) {
             permissions = [Permissions.EDIT_POST];
         } else {
+            const {serverVersion} = state.entities.general;
+
             // prior to v5.26, the server used to require edit_own_posts and
             // edit_others_posts permissions to be able to edit a post by a
             // different author.