diff --git a/app/post_test.go b/app/post_test.go index 5975c92d61..2e0fb07b78 100644 --- a/app/post_test.go +++ b/app/post_test.go @@ -2502,6 +2502,79 @@ func TestCollapsedThreadFetch(t *testing.T) { wg.Wait() }) + + t.Run("should sanitize participant data", func(t *testing.T) { + id := model.NewId() + user3, err := th.App.CreateUser(th.Context, &model.User{ + Email: "success+" + id + "@simulator.amazonses.com", + Username: "un_" + id, + Nickname: "nn_" + id, + AuthData: ptrStr("bobbytables"), + AuthService: "saml", + EmailVerified: true, + }) + require.Nil(t, err) + + channel := th.CreateChannel(th.BasicTeam) + th.LinkUserToTeam(user3, th.BasicTeam) + th.AddUserToChannel(user3, channel) + defer th.App.DeleteChannel(th.Context, channel, user1.Id) + defer th.App.PermanentDeleteUser(th.Context, user3) + + postRoot, err := th.App.CreatePost(th.Context, &model.Post{ + UserId: user1.Id, + ChannelId: channel.Id, + Message: "root post", + }, channel, false, true) + require.Nil(t, err) + + _, err = th.App.CreatePost(th.Context, &model.Post{ + UserId: user3.Id, + ChannelId: channel.Id, + RootId: postRoot.Id, + Message: "reply", + }, channel, false, true) + require.Nil(t, err) + thread, nErr := th.App.Srv().Store.Thread().Get(postRoot.Id) + require.NoError(t, nErr) + require.Len(t, thread.Participants, 1) + + // extended fetch posts page + l, err := th.App.GetPostsPage(model.GetPostsOptions{ + UserId: user1.Id, + ChannelId: channel.Id, + PerPage: int(10), + SkipFetchThreads: false, + CollapsedThreads: true, + CollapsedThreadsExtended: true, + }) + require.Nil(t, err) + require.Len(t, l.Order, 1) + require.NotEmpty(t, l.Posts[postRoot.Id].Participants[0].Email) + require.Empty(t, l.Posts[postRoot.Id].Participants[0].AuthData) + + th.App.MarkChannelAsUnreadFromPost(postRoot.Id, user1.Id, true) + + // extended fetch posts around + l, err = th.App.GetPostsForChannelAroundLastUnread(channel.Id, user1.Id, 10, 10, true, true, true) + require.Nil(t, err) + require.Len(t, l.Order, 1) + require.NotEmpty(t, l.Posts[postRoot.Id].Participants[0].Email) + require.Empty(t, l.Posts[postRoot.Id].Participants[0].AuthData) + + // extended fetch post thread + opts := model.GetPostsOptions{ + SkipFetchThreads: false, + CollapsedThreads: true, + CollapsedThreadsExtended: true, + } + + l, err = th.App.GetPostThread(postRoot.Id, opts, user1.Id) + require.Nil(t, err) + require.Len(t, l.Order, 2) + require.NotEmpty(t, l.Posts[postRoot.Id].Participants[0].Email) + require.Empty(t, l.Posts[postRoot.Id].Participants[0].AuthData) + }) } func TestReplyToPostWithLag(t *testing.T) { diff --git a/store/sqlstore/post_store.go b/store/sqlstore/post_store.go index a9761981da..e850d142ed 100644 --- a/store/sqlstore/post_store.go +++ b/store/sqlstore/post_store.go @@ -1071,6 +1071,7 @@ func (s *SqlPostStore) prepareThreadedResponse(posts []*postWithExtra, extended, return nil, err } for _, user := range users { + user.SanitizeProfile(map[string]bool{}) usersMap[user.Id] = user } } else {