snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/settings/lib/auditedSettingUpdates.spec.ts

@@ -0,0 +1,307 @@
+import type { ISetting, SettingValue } from '@rocket.chat/core-typings';
+
+import { updateAuditedByUser, updateAuditedBySystem, updateAuditedByApp, resetAuditedSettingByUser } from './auditedSettingUpdates';
+
+const mockCreateAuditServerEvent = jest.fn();
+jest.mock('@rocket.chat/models', () => ({
+	ServerEvents: {
+		createAuditServerEvent: (...args: any[]) => mockCreateAuditServerEvent(...args),
+	},
+}));
+
+const mockSettings = new Map<string, ISetting>();
+
+jest.mock('../cached', () => {
+	const mockGetSetting = jest.fn((key: string) => mockSettings.get(key));
+	return {
+		settings: {
+			getSetting: mockGetSetting,
+		},
+	};
+});
+
+describe('auditedSettingUpdates', () => {
+	beforeEach(() => {
+		jest.clearAllMocks();
+		mockSettings.clear();
+	});
+
+	describe('Masking sensitive settings', () => {
+		it('should mask password type settings with more than 8 characters', () => {
+			const settingId = 'SMTP_Password';
+			const originalValue = 'secretpassword123';
+			const newValue = 'newpassword456';
+
+			mockSettings.set(settingId, {
+				_id: settingId,
+				type: 'password',
+				value: originalValue,
+			} as ISetting);
+
+			const actor = {
+				_id: 'user1234567',
+				username: 'testuser133532',
+				ip: '127.0.0.1',
+				useragent: 'test-agent',
+			};
+
+			const mockFn = jest.fn((_key: string, value: SettingValue) => value);
+			const auditedFn = updateAuditedByUser(actor)(mockFn, settingId, newValue);
+
+			expect(auditedFn).toBe(newValue);
+			expect(mockCreateAuditServerEvent).toHaveBeenCalledWith(
+				'settings.changed',
+				{
+					id: settingId,
+					previous: 'sec**************',
+					current: 'new***********',
+				},
+				{
+					type: 'user',
+					...actor,
+				},
+			);
+		});
+
+		it('should mask password type settings with 8 or fewer characters completely', () => {
+			const settingId = 'Short_Password';
+
+			mockSettings.set(settingId, {
+				_id: settingId,
+				type: 'password',
+				value: 'abc',
+			} as ISetting);
+
+			const actor = {
+				_id: 'user123',
+				username: 'testuser',
+				ip: '127.0.0.1',
+				useragent: 'test-agent',
+			};
+
+			const mockFn = jest.fn((_key: string, value: SettingValue) => value);
+			const auditedFn = updateAuditedByUser(actor)(mockFn, settingId, 'xy');
+
+			expect(auditedFn).toBe('xy');
+			expect(mockCreateAuditServerEvent).toHaveBeenCalledWith(
+				'settings.changed',
+				{
+					id: settingId,
+					previous: '***',
+					current: '**',
+				},
+				{
+					type: 'user',
+					...actor,
+				},
+			);
+		});
+
+		it('should mask secret type settings', () => {
+			const settingId = 'SMTP_Username';
+
+			mockSettings.set(settingId, {
+				_id: settingId,
+				type: 'string',
+				secret: true,
+				value: 'myusername',
+			} as ISetting);
+
+			const actor = {
+				_id: 'user123',
+				username: 'testuser',
+				ip: '127.0.0.1',
+				useragent: 'test-agent',
+			};
+
+			const mockFn = jest.fn((_key: string, value: SettingValue) => value);
+			const auditedFn = updateAuditedByUser(actor)(mockFn, settingId, 'newusername');
+
+			expect(auditedFn).toBe('newusername');
+			expect(mockCreateAuditServerEvent).toHaveBeenCalledWith(
+				'settings.changed',
+				{
+					id: settingId,
+					previous: 'myu*******',
+					current: 'new********',
+				},
+				{
+					type: 'user',
+					...actor,
+				},
+			);
+		});
+	});
+
+	describe('updateAuditedBySystem', () => {
+		it('should mask sensitive settings for system actor', () => {
+			const settingId = 'SMTP_Password';
+
+			mockSettings.set(settingId, {
+				_id: settingId,
+				type: 'password',
+				value: 'oldpassword',
+			} as ISetting);
+
+			const mockFn = jest.fn((_key: string, value: SettingValue) => value);
+			const auditedFn = updateAuditedBySystem({});
+
+			auditedFn(mockFn, settingId, 'newpassword123');
+
+			expect(mockCreateAuditServerEvent).toHaveBeenCalledWith(
+				'settings.changed',
+				{
+					id: settingId,
+					previous: 'old********',
+					current: 'new***********',
+				},
+				{
+					type: 'system',
+				},
+			);
+		});
+	});
+
+	describe('updateAuditedByApp', () => {
+		it('should mask sensitive settings for app actor', () => {
+			const settingId = 'LDAP_Authentication_Password';
+
+			mockSettings.set(settingId, {
+				_id: settingId,
+				type: 'password',
+				value: 'oldpass',
+			} as ISetting);
+
+			const actor = {
+				type: 'app' as const,
+				_id: 'app123',
+			};
+
+			const mockFn = jest.fn((_key: string, value: SettingValue) => value);
+			const auditedFn = updateAuditedByApp(actor);
+
+			auditedFn(mockFn, settingId, 'ldappass');
+
+			expect(mockCreateAuditServerEvent).toHaveBeenCalledWith(
+				'settings.changed',
+				{
+					id: settingId,
+					previous: '*******',
+					current: '********',
+				},
+				{
+					type: 'app',
+					_id: 'app123',
+				},
+			);
+		});
+	});
+
+	describe('resetAuditedSettingByUser', () => {
+		it('should mask sensitive settings when resetting', () => {
+			const settingId = 'SMTP_Password';
+
+			mockSettings.set(settingId, {
+				_id: settingId,
+				type: 'password',
+				value: 'currentpassword123',
+				packageValue: 'packagepassword456',
+			} as ISetting);
+
+			const actor = {
+				_id: 'user123',
+				username: 'testuser',
+				ip: '127.0.0.1',
+				useragent: 'test-agent',
+			};
+
+			const mockFn = jest.fn((key: string) => key);
+			const auditedFn = resetAuditedSettingByUser(actor);
+
+			auditedFn(mockFn, settingId);
+
+			expect(mockCreateAuditServerEvent).toHaveBeenCalledWith(
+				'settings.changed',
+				{
+					id: settingId,
+					previous: 'cur***************',
+					current: 'pac***************',
+				},
+				{
+					type: 'user',
+					...actor,
+				},
+			);
+		});
+	});
+
+	describe('Edge cases', () => {
+		it('should handle exactly 8 character values', () => {
+			const settingId = 'Three_Char_Password';
+
+			mockSettings.set(settingId, {
+				_id: settingId,
+				type: 'password',
+				value: 'abc',
+			} as ISetting);
+
+			const actor = {
+				_id: 'user1234',
+				username: 'testuser',
+				ip: '127.0.0.1',
+				useragent: 'test-agent',
+			};
+
+			const mockFn = jest.fn((_key: string, value: SettingValue) => value);
+			const auditedFn = updateAuditedByUser(actor)(mockFn, settingId, 'xyz');
+
+			expect(auditedFn).toBe('xyz');
+			expect(mockCreateAuditServerEvent).toHaveBeenCalledWith(
+				'settings.changed',
+				{
+					id: settingId,
+					previous: '***',
+					current: '***',
+				},
+				{
+					type: 'user',
+					...actor,
+				},
+			);
+		});
+
+		it('should handle non-string values (numbers)', () => {
+			const settingId = 'Numeric_Password';
+
+			mockSettings.set(settingId, {
+				_id: settingId,
+				type: 'password',
+				value: 12345,
+			} as ISetting);
+
+			const actor = {
+				_id: 'user123',
+				username: 'testuser',
+				ip: '127.0.0.1',
+				useragent: 'test-agent',
+			};
+
+			const mockFn = jest.fn((_key: string, value: SettingValue) => value);
+			const auditedFn = updateAuditedByUser(actor)(mockFn, settingId, 67890);
+
+			expect(auditedFn).toBe(67890);
+			expect(mockCreateAuditServerEvent).toHaveBeenCalledWith(
+				'settings.changed',
+				{
+					id: settingId,
+					previous: '*****',
+					current: '*****',
+				},
+				{
+					type: 'user',
+					...actor,
+				},
+			);
+		});
+	});
+});

apps/meteor/server/settings/lib/auditedSettingUpdates.ts

@@ -0,0 +1,134 @@
+import type {
+	IAuditServerAppActor,
+	IAuditServerSystemActor,
+	IAuditServerUserActor,
+	ISetting,
+	SettingValue,
+} from '@rocket.chat/core-typings';
+import { ServerEvents } from '@rocket.chat/models';
+
+import { settings } from '../cached';
+
+const shouldMaskSettingInAudit = (settingId: ISetting['_id']): boolean => {
+	const setting = settings.getSetting(settingId);
+	return Boolean(setting && (setting.type === 'password' || (setting.type === 'string' && setting.secret === true)));
+};
+
+const maskIfNeeded = (settingId: ISetting['_id'], value: SettingValue): SettingValue => {
+	if (!shouldMaskSettingInAudit(settingId)) {
+		return value;
+	}
+
+	if (value === undefined || value === null || value === '') {
+		return value;
+	}
+
+	const valueString = String(value);
+	const valueLength = valueString.length;
+
+	let maskedValue: string;
+
+	if (valueLength <= 8) {
+		maskedValue = '*'.repeat(valueLength);
+	} else {
+		maskedValue = valueString.substring(0, 3) + '*'.repeat(valueLength - 3);
+	}
+
+	return maskedValue;
+};
+
+export const resetAuditedSettingByUser =
+	(actor: Omit<IAuditServerUserActor, 'type'>) =>
+	<F extends (key: ISetting['_id']) => any>(fn: F, key: ISetting['_id']): ReturnType<F> => {
+		const { value, packageValue } = settings.getSetting(key) ?? {};
+
+		void ServerEvents.createAuditServerEvent(
+			'settings.changed',
+			{
+				id: key,
+				previous: maskIfNeeded(key, value),
+				current: maskIfNeeded(key, packageValue),
+			},
+			{
+				type: 'user',
+				...actor,
+			},
+		);
+		return fn(key);
+	};
+
+export const updateAuditedByUser =
+	(actor: Omit<IAuditServerUserActor, 'type'>) =>
+	<K extends ISetting['_id'], T extends ISetting['value'], F extends (_id: K, value: T, ...args: any[]) => any>(
+		fn: F,
+		...args: Parameters<F>
+	): ReturnType<F> => {
+		const [key, value, ...rest] = args;
+		const setting = settings.getSetting(key);
+
+		const previous = setting?.value;
+
+		void ServerEvents.createAuditServerEvent(
+			'settings.changed',
+			{
+				id: key,
+				previous: maskIfNeeded(key, previous),
+				current: maskIfNeeded(key, value),
+			},
+			{
+				type: 'user',
+				...actor,
+			},
+		);
+		return fn(key, value, ...rest);
+	};
+
+export const updateAuditedBySystem =
+	(actor: Omit<IAuditServerSystemActor, 'type'>) =>
+	<T extends ISetting['value'], F extends (_id: ISetting['_id'], value: T, ...args: any[]) => any>(
+		fn: F,
+		...args: Parameters<F>
+	): ReturnType<F> => {
+		const [key, value, ...rest] = args;
+		const setting = settings.getSetting(key);
+
+		const previous = setting?.value;
+
+		void ServerEvents.createAuditServerEvent(
+			'settings.changed',
+			{
+				id: key,
+				previous: maskIfNeeded(key, previous),
+				current: maskIfNeeded(key, value),
+			},
+			{
+				type: 'system',
+				...actor,
+			},
+		);
+		return fn(key, value, ...rest);
+	};
+
+export const updateAuditedByApp =
+	<T extends ISetting['value'], F extends (_id: ISetting['_id'], value: T, ...args: any[]) => any>(
+		actor: Omit<IAuditServerAppActor, 'type'>,
+	) =>
+	(fn: F, ...args: Parameters<F>): ReturnType<F> => {
+		const [key, value, ...rest] = args;
+		const setting = settings.getSetting(key);
+
+		const previous = setting?.value;
+		void ServerEvents.createAuditServerEvent(
+			'settings.changed',
+			{
+				id: key,
+				previous: maskIfNeeded(key, previous),
+				current: maskIfNeeded(key, value),
+			},
+			{
+				type: 'app',
+				...actor,
+			},
+		);
+		return fn(key, value, ...rest);
+	};

apps/meteor/server/settings/lib/saveSettingsBulk.ts

@@ -0,0 +1,146 @@
+import type { ISetting, ISettingColor } from '@rocket.chat/core-typings';
+import { isSettingCode, isSettingColor } from '@rocket.chat/core-typings';
+import { Settings } from '@rocket.chat/models';
+import { Match, check } from 'meteor/check';
+import { Meteor } from 'meteor/meteor';
+
+import { settings } from '..';
+import { updateAuditedByUser } from './auditedSettingUpdates';
+import { getSettingPermissionId } from '../../../app/authorization/lib';
+import { hasPermissionAsync } from '../../lib/authorization/hasPermission';
+import { notifyOnSettingChangedById } from '../../lib/notifyListener';
+import { validateSettingRules } from '../../lib/settingValidationRules';
+import { disableCustomScripts } from '../../lib/shared/disableCustomScripts';
+import { checkSettingValueBounds } from '../checkSettingValueBonds';
+
+const validJSON = Match.Where((value: string) => {
+	try {
+		value === '' || JSON.parse(value);
+		return true;
+	} catch (_) {
+		throw new Meteor.Error('Invalid JSON provided');
+	}
+});
+
+const checkInteger = (value: ISetting['value']) => {
+	if (!Number.isInteger(value)) {
+		throw new Meteor.Error('error-invalid-setting-value', `Invalid setting value ${value}`, {
+			method: 'saveSettings',
+		});
+	}
+};
+
+export type SaveSettingsAudit = {
+	username: string;
+	ip: string;
+	useragent: string;
+};
+
+export const saveSettingsBulk = async (
+	uid: string,
+	params: { _id: ISetting['_id']; value: ISetting['value']; editor?: ISettingColor['editor'] }[],
+	audit: SaveSettingsAudit,
+): Promise<void> => {
+	const settingsNotAllowed: ISetting['_id'][] = [];
+
+	const editPrivilegedSetting = await hasPermissionAsync(uid, 'edit-privileged-setting');
+	const manageSelectedSettings = await hasPermissionAsync(uid, 'manage-selected-settings');
+
+	// if the id contains Organization_Name then change the Site_Name
+	const orgName = params.find(({ _id }) => _id === 'Organization_Name');
+
+	if (orgName) {
+		// check if the site name is still the default value or ifs the same as organization name
+		const siteName = await Settings.findOneById('Site_Name');
+
+		if (siteName?.value === siteName?.packageValue || siteName?.value === settings.get('Organization_Name')) {
+			params.push({
+				_id: 'Site_Name',
+				value: orgName.value,
+			});
+		}
+	}
+
+	await Promise.all(
+		params.map(async ({ _id, value }) => {
+			// Verify the _id passed in is a string.
+			check(_id, String);
+			if (!editPrivilegedSetting && !(manageSelectedSettings && (await hasPermissionAsync(uid, getSettingPermissionId(_id))))) {
+				return settingsNotAllowed.push(_id);
+			}
+
+			// Disable custom scripts in cloud trials to prevent phishing campaigns
+			if (disableCustomScripts() && /^Custom_Script_/.test(_id)) {
+				return settingsNotAllowed.push(_id);
+			}
+
+			const setting = await Settings.findOneById(_id);
+			// Verify the value is what it should be
+			switch (setting?.type) {
+				case 'roomPick':
+					check(value, Match.OneOf([Object], ''));
+					break;
+				case 'boolean':
+					check(value, Boolean);
+					break;
+				case 'timespan':
+				case 'int':
+				case 'range':
+					check(value, Number);
+					checkInteger(value);
+					checkSettingValueBounds(setting, value);
+					break;
+				case 'multiSelect':
+					check(value, Array);
+					break;
+				case 'code':
+					check(value, String);
+					if (isSettingCode(setting) && setting.code === 'application/json') {
+						check(value, validJSON);
+					}
+					break;
+				default:
+					check(value, String);
+					break;
+			}
+		}),
+	);
+
+	if (settingsNotAllowed.length) {
+		throw new Meteor.Error('error-action-not-allowed', 'Editing settings is not allowed', {
+			method: 'saveSettings',
+			settingIds: settingsNotAllowed,
+		});
+	}
+
+	validateSettingRules(params);
+
+	const auditSettingOperation = updateAuditedByUser({
+		_id: uid,
+		username: audit.username,
+		ip: audit.ip,
+		useragent: audit.useragent,
+	});
+
+	const promises = params.map(async ({ _id, value, editor }) => {
+		const valueResult = await auditSettingOperation(Settings.updateValueById, _id, value);
+
+		if (!editor) {
+			return Boolean(valueResult?.modifiedCount);
+		}
+
+		const setting = await Settings.findOneById(_id, { projection: { type: 1 } });
+		if (!setting || !isSettingColor(setting)) {
+			return Boolean(valueResult?.modifiedCount);
+		}
+
+		const { modifiedCount } = await Settings.updateOptionsById<ISettingColor>(_id, { editor });
+		return Boolean(valueResult?.modifiedCount) || Boolean(modifiedCount);
+	});
+
+	(await Promise.all(promises)).forEach((changed, index) => {
+		if (changed) {
+			void notifyOnSettingChangedById(params[index]._id);
+		}
+	});
+};