From 216395f5410ef429639bbf6ea42a0317e508066e Mon Sep 17 00:00:00 2001
From: Matt Gibson <mgibson@bitwarden.com>
Date: Wed, 20 Oct 2021 10:31:17 -0500
Subject: [PATCH] Create collections allows view all access (#1653)

* Create collections allows view all access

* Add missing permission to read users
---
 src/Api/Controllers/OrganizationUsersController.cs | 3 ++-
 src/Core/Context/CurrentContext.cs                 | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/Api/Controllers/OrganizationUsersController.cs b/src/Api/Controllers/OrganizationUsersController.cs
index 0ff3fe105c..bd31fc8066 100644
--- a/src/Api/Controllers/OrganizationUsersController.cs
+++ b/src/Api/Controllers/OrganizationUsersController.cs
@@ -61,7 +61,8 @@ namespace Bit.Api.Controllers
         public async Task<ListResponseModel<OrganizationUserUserDetailsResponseModel>> Get(string orgId)
         {
             var orgGuidId = new Guid(orgId);
-            if (!await _currentContext.ViewAssignedCollections(orgGuidId) &&
+            if (!await _currentContext.ViewAllCollections(orgGuidId) &&
+                !await _currentContext.ViewAssignedCollections(orgGuidId) &&
                 !await _currentContext.ManageGroups(orgGuidId) &&
                 !await _currentContext.ManageUsers(orgGuidId))
             {
diff --git a/src/Core/Context/CurrentContext.cs b/src/Core/Context/CurrentContext.cs
index f5cb29ba64..633b3cbfdd 100644
--- a/src/Core/Context/CurrentContext.cs
+++ b/src/Core/Context/CurrentContext.cs
@@ -310,7 +310,7 @@ namespace Bit.Core.Context
 
         public async Task<bool> ViewAllCollections(Guid orgId)
         {
-            return await EditAnyCollection(orgId) || await DeleteAnyCollection(orgId);
+            return await CreateNewCollections(orgId) || await EditAnyCollection(orgId) || await DeleteAnyCollection(orgId);
         }
 
         public async Task<bool> EditAssignedCollections(Guid orgId)