From 3466e6f5d8fe6368d4fea5cac3a6eb7d15aa6860 Mon Sep 17 00:00:00 2001 From: Miguel de la Cruz Date: Tue, 8 Oct 2024 16:49:33 +0200 Subject: [PATCH] Avoid using token from sanitized remote cluster (#28335) After creating a remote cluster, we were using its token field to generate the remote invite. As we're going to return that remote cluster in the response, we sanitize the entity, emptying the token field before generating the invite, and causing it not to contain the token itself. This changes store the token in an independent variable to avoid mutating it as part of the sanitization. Co-authored-by: Mattermost Build --- server/channels/api4/remote_cluster.go | 5 +++-- server/channels/api4/remote_cluster_test.go | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/server/channels/api4/remote_cluster.go b/server/channels/api4/remote_cluster.go index 2852fc07ef..6c338edde5 100644 --- a/server/channels/api4/remote_cluster.go +++ b/server/channels/api4/remote_cluster.go @@ -378,12 +378,13 @@ func createRemoteCluster(c *Context, w http.ResponseWriter, r *http.Request) { rcWithTeamAndPassword.DisplayName = rcWithTeamAndPassword.Name } + token := model.NewId() rc := &model.RemoteCluster{ Name: rcWithTeamAndPassword.Name, DisplayName: rcWithTeamAndPassword.DisplayName, SiteURL: model.SiteURLPending + model.NewId(), DefaultTeamId: rcWithTeamAndPassword.DefaultTeamId, - Token: model.NewId(), + Token: token, CreatorId: c.AppContext.Session().UserId, } @@ -401,7 +402,7 @@ func createRemoteCluster(c *Context, w http.ResponseWriter, r *http.Request) { password = utils.SecureRandString(16) } - inviteCode, iErr := c.App.CreateRemoteClusterInvite(rcSaved.RemoteId, url, rcSaved.Token, password) + inviteCode, iErr := c.App.CreateRemoteClusterInvite(rcSaved.RemoteId, url, token, password) if iErr != nil { c.Err = iErr return diff --git a/server/channels/api4/remote_cluster_test.go b/server/channels/api4/remote_cluster_test.go index 3638f9aee9..9ecdd5b9e6 100644 --- a/server/channels/api4/remote_cluster_test.go +++ b/server/channels/api4/remote_cluster_test.go @@ -249,7 +249,7 @@ func TestCreateRemoteCluster(t *testing.T) { rci, appErr := th.App.DecryptRemoteClusterInvite(rcWithInvite.Invite, rcWithInvite.Password) require.Nil(t, appErr) require.Equal(t, rc.RemoteId, rci.RemoteId) - require.Equal(t, rc.RemoteToken, rci.Token) + require.Equal(t, rc.Token, rci.Token) require.Equal(t, th.App.GetSiteURL(), rci.SiteURL) }) @@ -273,7 +273,7 @@ func TestCreateRemoteCluster(t *testing.T) { rci, appErr := th.App.DecryptRemoteClusterInvite(rcWithInvite.Invite, rcWithTeamAndPassword.Password) require.Nil(t, appErr) require.Equal(t, rc.RemoteId, rci.RemoteId) - require.Equal(t, rc.RemoteToken, rci.Token) + require.Equal(t, rc.Token, rci.Token) require.Equal(t, th.App.GetSiteURL(), rci.SiteURL) }) }