[MM-59069] Make sure OTP are actual One Time Password (#28074)

Automatic Merge

server/public/model/user_test.go

@@ -332,6 +332,7 @@ func TestUserSanitizeInput(t *testing.T) {
 	user.EmailVerified = true
 	user.FailedAttempts = 10
 	user.LastActivityAt = GetMillis()
+	user.MfaUsedTimestamps = StringArray{"1234", "4566"}
 
 	user.SanitizeInput(false)
 
@@ -347,6 +348,7 @@ func TestUserSanitizeInput(t *testing.T) {
 	require.Equal(t, int64(0), user.LastPictureUpdate)
 	require.Equal(t, int64(0), user.LastActivityAt)
 	require.Equal(t, 0, user.FailedAttempts)
+	require.Equal(t, StringArray{}, user.MfaUsedTimestamps)
 
 	// these fields should remain intact
 	require.Equal(t, "user@example.com", user.Email)