From 0a06b3e80870de423bd30d9d829560745f616181 Mon Sep 17 00:00:00 2001
From: Anurag Shivarathri <anurag6713@gmail.com>
Date: Mon, 17 Jan 2022 18:29:52 +0530
Subject: [PATCH] Sanitize teamsWithCount Teams (#19280)

Automatic Merge
---
 api4/team.go      |  4 ++--
 api4/team_test.go | 13 +++++++++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/api4/team.go b/api4/team.go
index 3e3a5e99a6..4fc31e9edc 100644
--- a/api4/team.go
+++ b/api4/team.go
@@ -1055,13 +1055,13 @@ func getAllTeams(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	c.App.SanitizeTeams(*c.AppContext.Session(), teams)
-
 	var js []byte
 	var jsonErr error
 	if c.Params.IncludeTotalCount {
+		c.App.SanitizeTeams(*c.AppContext.Session(), teamsWithCount.Teams)
 		js, jsonErr = json.Marshal(teamsWithCount)
 	} else {
+		c.App.SanitizeTeams(*c.AppContext.Session(), teams)
 		js, jsonErr = json.Marshal(teams)
 	}
 	if jsonErr != nil {
diff --git a/api4/team_test.go b/api4/team_test.go
index 0e4e3f866c..286bc0be95 100644
--- a/api4/team_test.go
+++ b/api4/team_test.go
@@ -1123,6 +1123,19 @@ func TestGetAllTeams(t *testing.T) {
 		require.Error(t, err)
 		CheckUnauthorizedStatus(t, resp)
 	})
+
+	t.Run("Sanitize the teams in the response with total count", func(t *testing.T) {
+		otherUser := th.CreateUser()
+		client.Login(otherUser.Email, otherUser.Password)
+		teams, _, _, err := client.GetAllTeamsWithTotalCount("", 0, 10)
+		require.NoError(t, err)
+		for _, team := range teams {
+			if team.Email != "" {
+				require.Nil(t, team.Email)
+				break
+			}
+		}
+	})
 }
 
 func TestGetAllTeamsSanitization(t *testing.T) {