Manual Cherrypick: Add audits for accessing posts without membership (#31266) (#35022)

Automatic Merge

server/channels/app/file.go

@@ -1460,12 +1460,12 @@ func populateZipfile(w *zip.Writer, fileDatas []model.FileData) error {
 	return nil
 }
 
-func (a *App) SearchFilesInTeamForUser(c request.CTX, terms string, userId string, teamId string, isOrSearch bool, includeDeletedChannels bool, timeZoneOffset int, page, perPage int) (*model.FileInfoList, *model.AppError) {
+func (a *App) SearchFilesInTeamForUser(c request.CTX, terms string, userId string, teamId string, isOrSearch bool, includeDeletedChannels bool, timeZoneOffset int, page, perPage int) (*model.FileInfoList, bool, *model.AppError) {
 	paramsList := model.ParseSearchParams(strings.TrimSpace(terms), timeZoneOffset)
 	includeDeleted := includeDeletedChannels && *a.Config().TeamSettings.ExperimentalViewArchivedChannels
 
 	if !*a.Config().ServiceSettings.EnableFileSearch {
-		return nil, model.NewAppError("SearchFilesInTeamForUser", "store.sql_file_info.search.disabled", nil, fmt.Sprintf("teamId=%v userId=%v", teamId, userId), http.StatusNotImplemented)
+		return nil, false, model.NewAppError("SearchFilesInTeamForUser", "store.sql_file_info.search.disabled", nil, fmt.Sprintf("teamId=%v userId=%v", teamId, userId), http.StatusNotImplemented)
 	}
 
 	finalParamsList := []*model.SearchParams{}
@@ -1489,7 +1489,7 @@ func (a *App) SearchFilesInTeamForUser(c request.CTX, terms string, userId strin
 
 	// If the processed search params are empty, return empty search results.
 	if len(finalParamsList) == 0 {
-		return model.NewFileInfoList(), nil
+		return model.NewFileInfoList(), true, nil
 	}
 
 	fileInfoSearchResults, nErr := a.Srv().Store().FileInfo().Search(c, finalParamsList, userId, teamId, page, perPage)
@@ -1497,26 +1497,27 @@ func (a *App) SearchFilesInTeamForUser(c request.CTX, terms string, userId strin
 		var appErr *model.AppError
 		switch {
 		case errors.As(nErr, &appErr):
-			return nil, appErr
+			return nil, false, appErr
 		default:
-			return nil, model.NewAppError("SearchFilesInTeamForUser", "app.post.search.app_error", nil, "", http.StatusInternalServerError).Wrap(nErr)
+			return nil, false, model.NewAppError("SearchFilesInTeamForUser", "app.post.search.app_error", nil, "", http.StatusInternalServerError).Wrap(nErr)
 		}
 	}
 
 	if appErr := a.filterInaccessibleFiles(fileInfoSearchResults, filterFileOptions{assumeSortedCreatedAt: true}); appErr != nil {
-		return nil, appErr
+		return nil, false, appErr
 	}
 
-	if appErr := a.FilterFilesByChannelPermissions(c, fileInfoSearchResults, userId); appErr != nil {
-		return nil, appErr
+	allFilesHaveMembership, appErr := a.FilterFilesByChannelPermissions(c, fileInfoSearchResults, userId)
+	if appErr != nil {
+		return nil, false, appErr
 	}
 
-	return fileInfoSearchResults, nil
+	return fileInfoSearchResults, allFilesHaveMembership, nil
 }
 
-func (a *App) FilterFilesByChannelPermissions(rctx request.CTX, fileList *model.FileInfoList, userID string) *model.AppError {
+func (a *App) FilterFilesByChannelPermissions(rctx request.CTX, fileList *model.FileInfoList, userID string) (bool, *model.AppError) {
 	if fileList == nil || fileList.FileInfos == nil || len(fileList.FileInfos) == 0 {
-		return nil
+		return true, nil // On an empty file list, we consider all files as having membership
 	}
 
 	channels := make(map[string]*model.Channel)
@@ -1530,7 +1531,7 @@ func (a *App) FilterFilesByChannelPermissions(rctx request.CTX, fileList *model.
 		channelIDs := slices.Collect(maps.Keys(channels))
 		channelList, err := a.GetChannels(rctx, channelIDs)
 		if err != nil && err.StatusCode != http.StatusNotFound {
-			return err
+			return false, err
 		}
 		for _, channel := range channelList {
 			channels[channel.Id] = channel
@@ -1540,6 +1541,7 @@ func (a *App) FilterFilesByChannelPermissions(rctx request.CTX, fileList *model.
 	channelReadPermission := make(map[string]bool)
 	filteredFiles := make(map[string]*model.FileInfo)
 	filteredOrder := []string{}
+	allFilesHaveMembership := true
 
 	for _, fileID := range fileList.Order {
 		fileInfo, ok := fileList.FileInfos[fileID]
@@ -1550,10 +1552,14 @@ func (a *App) FilterFilesByChannelPermissions(rctx request.CTX, fileList *model.
 		if _, ok := channelReadPermission[fileInfo.ChannelId]; !ok {
 			channel := channels[fileInfo.ChannelId]
 			allowed := false
+			isMember := true
 			if channel != nil {
-				allowed = a.HasPermissionToReadChannel(rctx, userID, channel)
+				allowed, isMember = a.HasPermissionToReadChannel(rctx, userID, channel)
 			}
 			channelReadPermission[fileInfo.ChannelId] = allowed
+			if allowed {
+				allFilesHaveMembership = allFilesHaveMembership && isMember
+			}
 		}
 
 		if channelReadPermission[fileInfo.ChannelId] {
@@ -1565,7 +1571,7 @@ func (a *App) FilterFilesByChannelPermissions(rctx request.CTX, fileList *model.
 	fileList.FileInfos = filteredFiles
 	fileList.Order = filteredOrder
 
-	return nil
+	return allFilesHaveMembership, nil
 }
 
 func (a *App) ExtractContentFromFileInfo(rctx request.CTX, fileInfo *model.FileInfo) error {