Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions Readme.md
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@ Done in Markdown this looks like:

[![](https://cldup.com/WIbawiqp0Q.png)](http://slack.socket.io)

Point to `https://slack.yourdomain.com`.
Point to `https://slack.yourdomain.com`. If you're only allowing single-channel guests, you can also link to `https://slack.yourdomain.com/?channel=<name>` to have them join that particular channel.

**Note:** the image for the logo of the landing page
is retrieved from the Slack API. If your organization
Expand Down Expand Up @@ -136,16 +136,16 @@ By default logging is enabled.

## Developing

Slackin's server side code is written in ES6. It uses babel to transpile the
ES6 code to a format node understands. After cloning Slackin, you should
Slackin's server side code is written in ES6. It uses babel to transpile the
ES6 code to a format node understands. After cloning Slackin, you should
install the prerequisite node libraries with npm:

```bash
$ npm install
```

After the libraries install, the postinstall script will run `gulp` to invoke
babel on the source. It is important to run `gulp` manually after updating any
babel on the source. It is important to run `gulp` manually after updating any
files in lib/ to update the versions in node/.

## Credits
Expand Down
17 changes: 16 additions & 1 deletion lib/index.js
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,20 @@ import splash from './splash';
import iframe from './iframe';
import log from './log';

export function restrictChannels(channels, req) {
let channelName = req.query.channel;
if (
channels &&
channels.length > 0 &&
channelName &&
channels.indexOf(channelName) > -1
) {
return [channelName];
} else {
return channels;
}
}

export default function slackin({
token,
interval = 5000, // jshint ignore:line
Expand Down Expand Up @@ -65,6 +79,7 @@ export default function slackin({
let { name, logo } = slack.org;
let { active, total } = slack.users;
if (!name) return res.send(404);
let restrictedChannels = restrictChannels(channels, req);
let page = dom('html',
dom('head',
dom('title',
Expand All @@ -74,7 +89,7 @@ export default function slackin({
dom('link rel="shortcut icon" href=https://slack.global.ssl.fastly.net/272a/img/icons/favicon-32.png'),
css && dom('link rel=stylesheet', { href: css })
),
splash({ coc, path, css, name, org, logo, channels, active, total })
splash({ coc, path, css, name, org, logo, active, total, channels: restrictedChannels })
);
res.type('html');
res.send(page.toHTML());
Expand Down
25 changes: 24 additions & 1 deletion test/index.js
Original file line number Diff line number Diff line change
@@ -1,8 +1,31 @@
import assert from 'assert';
import nock from 'nock';
import request from 'supertest';
import slackin from '../lib/index';
import slackin, { restrictChannels } from '../lib/index';

describe('slackin', () => {
describe('.restrictChannels()', () => {
it("returns the same list when the query is empty", () => {
let results = restrictChannels(['foo', 'bar'], {query: {}});
assert.deepEqual(results, ['foo', 'bar']);
});

it("returns the same list when the channel isn't in the list", () => {
let results = restrictChannels(['foo', 'bar'], {query: {channel: 'baz'}});
assert.deepEqual(results, ['foo', 'bar']);
});

it("returns undefined when there are no channels to restrict", () => {
let results = restrictChannels(undefined, {query: {channel: 'foo'}});
assert.equal(results, undefined);
});

it("returns undefined when there is an empty list of channels to restrict", () => {
let results = restrictChannels([], {query: {channel: 'foo'}});
assert.deepEqual(results, []);
});
});
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These tests may seem overkill, but I was very nervous about creating a security hole where external users could join a channel that wasn't whitelisted through the channel list provided to slackin.


describe('POST /invite', () => {
beforeEach(() => {
nock('https://myorg.slack.com')
Expand Down