Added validation

packages/app/src/server/models/user-group.js

@@ -1,3 +1,5 @@
+import { compareObjectId, includesObjectId } from '~/server/util/compare-objectId';
+
 const debug = require('debug')('growi:models:userGroup');
 const mongoose = require('mongoose');
 const mongoosePaginate = require('mongoose-paginate-v2');
@@ -184,6 +186,13 @@ class UserGroup {
 
     const parent = await this.findById(parentId);
 
+    // throw if parent was in its descendants
+    const descendantsWithTarget = await this.findGroupsWithDescendantsRecursively([userGroup]);
+    const descendants = descendantsWithTarget.filter(d => compareObjectId(d._id, userGroup._id));
+    if (includesObjectId(descendants, parent._id)) {
+      throw Error('It is not allowed to choose parent from descendant groups.');
+    }
+
     // find users for comparison
     const UserGroupRelation = mongoose.model('UserGroupRelation');
     const [targetGroupUsers, parentGroupUsers] = await Promise.all(

packages/app/src/server/util/compare-objectId.ts

@@ -3,6 +3,20 @@ import mongoose from 'mongoose';
 type IObjectId = mongoose.Types.ObjectId;
 const ObjectId = mongoose.Types.ObjectId;
 
+export const compareObjectId = (_id1: IObjectId, _id2: IObjectId): boolean => {
+  const id1 = _id1.toString();
+  const id2 = _id2.toString();
+
+  return id1 === id2;
+};
+
+export const includesObjectId = (_arr: IObjectId[], _id: IObjectId): boolean => {
+  const arr = _arr.map(i => i.toString());
+  const id = _id.toString();
+
+  return arr.includes(id);
+};
+
 export const filterIdsByIds = (_arr1: IObjectId[], _arr2: IObjectId[]): IObjectId[] => {
   // cast to string
   const arr1 = _arr1.map(e => e.toString());