MM-44568: sanitizes profiles in posts (#20291)

* MM-44568: sanitizes profiles in posts

* Fixes tests

* Adds test

* Satisfy vet

app/post_test.go

@@ -2502,6 +2502,79 @@ func TestCollapsedThreadFetch(t *testing.T) {
 
 		wg.Wait()
 	})
+
+	t.Run("should sanitize participant data", func(t *testing.T) {
+		id := model.NewId()
+		user3, err := th.App.CreateUser(th.Context, &model.User{
+			Email:         "success+" + id + "@simulator.amazonses.com",
+			Username:      "un_" + id,
+			Nickname:      "nn_" + id,
+			AuthData:      ptrStr("bobbytables"),
+			AuthService:   "saml",
+			EmailVerified: true,
+		})
+		require.Nil(t, err)
+
+		channel := th.CreateChannel(th.BasicTeam)
+		th.LinkUserToTeam(user3, th.BasicTeam)
+		th.AddUserToChannel(user3, channel)
+		defer th.App.DeleteChannel(th.Context, channel, user1.Id)
+		defer th.App.PermanentDeleteUser(th.Context, user3)
+
+		postRoot, err := th.App.CreatePost(th.Context, &model.Post{
+			UserId:    user1.Id,
+			ChannelId: channel.Id,
+			Message:   "root post",
+		}, channel, false, true)
+		require.Nil(t, err)
+
+		_, err = th.App.CreatePost(th.Context, &model.Post{
+			UserId:    user3.Id,
+			ChannelId: channel.Id,
+			RootId:    postRoot.Id,
+			Message:   "reply",
+		}, channel, false, true)
+		require.Nil(t, err)
+		thread, nErr := th.App.Srv().Store.Thread().Get(postRoot.Id)
+		require.NoError(t, nErr)
+		require.Len(t, thread.Participants, 1)
+
+		// extended fetch posts page
+		l, err := th.App.GetPostsPage(model.GetPostsOptions{
+			UserId:                   user1.Id,
+			ChannelId:                channel.Id,
+			PerPage:                  int(10),
+			SkipFetchThreads:         false,
+			CollapsedThreads:         true,
+			CollapsedThreadsExtended: true,
+		})
+		require.Nil(t, err)
+		require.Len(t, l.Order, 1)
+		require.NotEmpty(t, l.Posts[postRoot.Id].Participants[0].Email)
+		require.Empty(t, l.Posts[postRoot.Id].Participants[0].AuthData)
+
+		th.App.MarkChannelAsUnreadFromPost(postRoot.Id, user1.Id, true)
+
+		// extended fetch posts around
+		l, err = th.App.GetPostsForChannelAroundLastUnread(channel.Id, user1.Id, 10, 10, true, true, true)
+		require.Nil(t, err)
+		require.Len(t, l.Order, 1)
+		require.NotEmpty(t, l.Posts[postRoot.Id].Participants[0].Email)
+		require.Empty(t, l.Posts[postRoot.Id].Participants[0].AuthData)
+
+		// extended fetch post thread
+		opts := model.GetPostsOptions{
+			SkipFetchThreads:         false,
+			CollapsedThreads:         true,
+			CollapsedThreadsExtended: true,
+		}
+
+		l, err = th.App.GetPostThread(postRoot.Id, opts, user1.Id)
+		require.Nil(t, err)
+		require.Len(t, l.Order, 2)
+		require.NotEmpty(t, l.Posts[postRoot.Id].Participants[0].Email)
+		require.Empty(t, l.Posts[postRoot.Id].Participants[0].AuthData)
+	})
 }
 
 func TestReplyToPostWithLag(t *testing.T) {

store/sqlstore/post_store.go

@@ -1071,6 +1071,7 @@ func (s *SqlPostStore) prepareThreadedResponse(posts []*postWithExtra, extended,
 			return nil, err
 		}
 		for _, user := range users {
+			user.SanitizeProfile(map[string]bool{})
 			usersMap[user.Id] = user
 		}
 	} else {