restrict room types for rooms.membersOrderedByRole

Signed-off-by: Abhinav Kumar <[email protected]>
RocketChat · Jan 15, 2025 · 89ea1e5 · 89ea1e5
1 parent 3b0a10e
commit 89ea1e5
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/apps/meteor/app/api/server/v1/rooms.ts b/apps/meteor/app/api/server/v1/rooms.ts
@@ -874,6 +874,10 @@ API.v1.addRoute(
 				return API.v1.notFound('The required "roomId" or "roomName" param provided does not match any room');
 			}
 
+			if (findResult.t !== 'c' && findResult.t !== 'p') {
+				return API.v1.failure('error-room-type-not-supported');
+			}
+
 			if (findResult.broadcast && !(await hasPermissionAsync(this.userId, 'view-broadcast-member-list', findResult._id))) {
 				return API.v1.unauthorized();
 			}