Merge pull request #12874 from antobinary/chat-selector

fix(guests): Propagate list of pending guests only to mods

bigbluebutton-html5/imports/api/guest-users/server/publishers.js

 import GuestUsers from '/imports/api/guest-users/';
+import Users from '/imports/api/users';
 import { Meteor } from 'meteor/meteor';
 import Logger from '/imports/startup/server/logger';
 import AuthTokenValidation, { ValidationStates } from '/imports/api/auth-token-validation';
 
+const ROLE_MODERATOR = Meteor.settings.public.user.role_moderator;
+
 function guestUsers() {
   const tokenValidation = AuthTokenValidation.findOne({ connectionId: this.connection.id });
 
   if (!tokenValidation || tokenValidation.validationStatus !== ValidationStates.VALIDATED) {
-    Logger.warn(`Publishing GuestUsers was requested by unauth connection ${this.connection.id}`);
+    Logger.warn(`Publishing GuestUser was requested by unauth connection ${this.connection.id}`);
     return GuestUsers.find({ meetingId: '' });
   }
 
   const { meetingId, userId } = tokenValidation;
 
+  const User = Users.findOne({ userId, meetingId }, { fields: { role: 1 } });
+  if (!User || User.role !== ROLE_MODERATOR) {
+    Logger.warn(
+      'Publishing current-poll was requested by non-moderator connection',
+      { meetingId, userId, connectionId: this.connection.id },
+    );
+    return GuestUsers.find({ meetingId: '' });
+  }
+
   Logger.debug(`Publishing GuestUsers for ${meetingId} ${userId}`);
 
   return GuestUsers.find({ meetingId });

bigbluebutton-html5/imports/api/polls/server/publishers.js

@@ -16,10 +16,10 @@ function currentPoll() {
   const { meetingId, userId } = tokenValidation;
 
   const User = Users.findOne({ userId, meetingId }, { fields: { role: 1 } });
-  if (!User || User.role != ROLE_MODERATOR) {
+  if (!User || User.role !== ROLE_MODERATOR) {
     Logger.warn(
       'Publishing current-poll was requested by non-moderator connection',
-      { meetingId, userId, connectionId: this.connection.id }
+      { meetingId, userId, connectionId: this.connection.id },
     );
     return Polls.find({ meetingId: '' });
   }