snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/meteor-methods/settings/getSetupWizardParameters.ts

@@ -0,0 +1,28 @@
+import type { ISetting } from '@rocket.chat/core-typings';
+import type { ServerMethods } from '@rocket.chat/ddp-client';
+import { Meteor } from 'meteor/meteor';
+
+import { methodDeprecationLogger } from '../../lib/deprecationWarningLogger';
+import { getSetupWizardParameters } from '../../lib/getSetupWizardParameters';
+
+declare module '@rocket.chat/ddp-client' {
+	// eslint-disable-next-line @typescript-eslint/naming-convention
+	interface ServerMethods {
+		getSetupWizardParameters(): Promise<{
+			settings: ISetting[];
+			serverAlreadyRegistered: boolean;
+		}>;
+	}
+}
+
+Meteor.methods<ServerMethods>({
+	/**
+	 * @deprecated this method is deprecated and will be removed soon.
+	 * Prefer using the setupWizard.parameters rest api.
+	 */
+	async getSetupWizardParameters() {
+		methodDeprecationLogger.method('getSetupWizardParameters', '9.0.0', '/v1/setupWizard.parameters');
+
+		return getSetupWizardParameters();
+	},
+});

apps/meteor/server/meteor-methods/settings/saveSetting.ts

@@ -0,0 +1,95 @@
+import type { SettingEditor, SettingValue } from '@rocket.chat/core-typings';
+import type { ServerMethods } from '@rocket.chat/ddp-client';
+import { Settings } from '@rocket.chat/models';
+import { Match, check } from 'meteor/check';
+import { Meteor } from 'meteor/meteor';
+
+import { getSettingPermissionId } from '../../../app/authorization/lib';
+import { twoFactorRequired } from '../../lib/2fa/twoFactorRequired';
+import { hasPermissionAsync, hasAllPermissionAsync } from '../../lib/authorization/hasPermission';
+import { methodDeprecationLogger } from '../../lib/deprecationWarningLogger';
+import { notifyOnSettingChanged } from '../../lib/notifyListener';
+import { SettingValidationError, validateSettingRules } from '../../lib/settingValidationRules';
+import { disableCustomScripts } from '../../lib/shared/disableCustomScripts';
+import { updateAuditedByUser } from '../../settings/lib/auditedSettingUpdates';
+
+declare module '@rocket.chat/ddp-client' {
+	// eslint-disable-next-line @typescript-eslint/naming-convention
+	interface ServerMethods {
+		saveSetting(_id: string, value: SettingValue, editor: SettingEditor): Promise<boolean>;
+	}
+}
+
+Meteor.methods<ServerMethods>({
+	saveSetting: twoFactorRequired(async function (_id: string, value: SettingValue, editor: SettingEditor) {
+		methodDeprecationLogger.method('saveSetting', '9.0.0', '/v1/settings/:_id');
+		const uid = Meteor.userId();
+		if (!uid) {
+			throw new Meteor.Error('error-action-not-allowed', 'Editing settings is not allowed', {
+				method: 'saveSetting',
+			});
+		}
+
+		if (
+			!(await hasPermissionAsync(uid, 'edit-privileged-setting')) &&
+			!(await hasAllPermissionAsync(uid, ['manage-selected-settings', getSettingPermissionId(_id)]))
+		) {
+			// TODO use the same function
+			throw new Meteor.Error('error-action-not-allowed', 'Editing settings is not allowed', {
+				method: 'saveSetting',
+				settingId: _id,
+			});
+		}
+
+		// Verify the _id passed in is a string.
+		check(_id, String);
+
+		// Disable custom scripts in cloud trials to prevent phishing campaigns
+		if (disableCustomScripts() && /^Custom_Script_/.test(_id)) {
+			throw new Meteor.Error('error-action-not-allowed', 'Editing settings is not allowed', {
+				method: 'saveSetting',
+				settingId: _id,
+			});
+		}
+
+		const setting = await Settings.findOneById(_id);
+
+		// Verify the value is what it should be
+		switch (setting?.type) {
+			case 'roomPick':
+				check(value, Match.OneOf([Object], ''));
+				break;
+			case 'boolean':
+				check(value, Boolean);
+				break;
+			case 'int':
+				check(value, Number);
+				break;
+			default:
+				check(value, String);
+				break;
+		}
+
+		try {
+			validateSettingRules([{ _id, value }]);
+		} catch (error) {
+			if (error instanceof SettingValidationError) {
+				throw new Meteor.Error('error-setting-validation-failed', error.message);
+			}
+			throw error;
+		}
+
+		const auditSettingOperation = updateAuditedByUser({
+			_id: uid,
+			username: (await Meteor.userAsync())!.username!,
+			ip: this.connection?.clientAddress || '',
+			useragent: this.connection?.httpHeaders['user-agent'] || '',
+		});
+
+		(await auditSettingOperation(Settings.updateValueAndEditorById, _id, value, editor)).modifiedCount &&
+			setting &&
+			void notifyOnSettingChanged({ ...setting, editor, value });
+
+		return true;
+	}),
+});

apps/meteor/server/meteor-methods/settings/saveSettings.ts

@@ -0,0 +1,53 @@
+import type { ISetting } from '@rocket.chat/core-typings';
+import type { ServerMethods } from '@rocket.chat/ddp-client';
+import { Meteor } from 'meteor/meteor';
+
+import { twoFactorRequired } from '../../lib/2fa/twoFactorRequired';
+import { methodDeprecationLogger } from '../../lib/deprecationWarningLogger';
+import { SettingValidationError } from '../../lib/settingValidationRules';
+import { saveSettingsBulk } from '../../settings/lib/saveSettingsBulk';
+
+declare module '@rocket.chat/ddp-client' {
+	// eslint-disable-next-line @typescript-eslint/naming-convention
+	interface ServerMethods {
+		saveSettings(
+			changes: {
+				_id: ISetting['_id'];
+				value: ISetting['value'];
+			}[],
+		): Promise<boolean>;
+	}
+}
+
+Meteor.methods<ServerMethods>({
+	saveSettings: twoFactorRequired(async function (
+		params: {
+			_id: ISetting['_id'];
+			value: ISetting['value'];
+		}[] = [],
+	) {
+		methodDeprecationLogger.method('saveSettings', '9.0.0', '/v1/settings');
+
+		const uid = Meteor.userId();
+		if (uid === null) {
+			throw new Meteor.Error('error-action-not-allowed', 'Editing settings is not allowed', {
+				method: 'saveSetting',
+			});
+		}
+
+		try {
+			await saveSettingsBulk(uid, params, {
+				username: (await Meteor.userAsync())!.username!,
+				ip: this.connection.clientAddress || '',
+				useragent: this.connection.httpHeaders['user-agent'] || '',
+			});
+		} catch (error) {
+			if (error instanceof SettingValidationError) {
+				throw new Meteor.Error('error-setting-validation-failed', error.message);
+			}
+			throw error;
+		}
+
+		return true;
+	}, {}),
+});

apps/meteor/server/meteor-methods/settings/sendSMTPTestEmail.ts

@@ -0,0 +1,61 @@
+import type { ServerMethods } from '@rocket.chat/ddp-client';
+import { DDPRateLimiter } from 'meteor/ddp-rate-limiter';
+import { Meteor } from 'meteor/meteor';
+
+import * as Mailer from '../../lib/notifications/email/api';
+import { settings } from '../../settings';
+
+declare module '@rocket.chat/ddp-client' {
+	// eslint-disable-next-line @typescript-eslint/naming-convention
+	interface ServerMethods {
+		sendSMTPTestEmail(): {
+			message: string;
+			params: string[];
+		};
+	}
+}
+
+Meteor.methods<ServerMethods>({
+	async sendSMTPTestEmail() {
+		if (!Meteor.userId()) {
+			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
+				method: 'sendSMTPTestEmail',
+			});
+		}
+		const user = await Meteor.userAsync();
+		if (!user?.emails?.[0]?.address) {
+			throw new Meteor.Error('error-invalid-email', 'Invalid email', {
+				method: 'sendSMTPTestEmail',
+			});
+		}
+		try {
+			await Mailer.send({
+				to: user.emails[0].address,
+				from: settings.get('From_Email'),
+				subject: 'SMTP Test Email',
+				html: '<p>You have successfully sent an email</p>',
+			});
+		} catch ({ message }: any) {
+			throw new Meteor.Error('error-email-send-failed', `Error trying to send email: ${message}`, {
+				method: 'sendSMTPTestEmail',
+				message,
+			});
+		}
+		return {
+			message: 'Sending_your_mail_to_s',
+			params: [user.emails[0].address],
+		};
+	},
+});
+
+DDPRateLimiter.addRule(
+	{
+		type: 'method',
+		name: 'sendSMTPTestEmail',
+		userId() {
+			return true;
+		},
+	},
+	1,
+	1000,
+);