From 3705d7af4daf711431a1432d36322c0fae8fa9cd Mon Sep 17 00:00:00 2001
From: Ben Schumacher <ben.schumacher@mattermost.com>
Date: Mon, 5 Jun 2023 19:16:47 +0200
Subject: [PATCH] Fix panic if JSON null value is passed as channel update
 (#23629)

---
 server/channels/api4/channel.go      | 2 +-
 server/channels/api4/channel_test.go | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/server/channels/api4/channel.go b/server/channels/api4/channel.go
index b5219663c4..aef74b557f 100644
--- a/server/channels/api4/channel.go
+++ b/server/channels/api4/channel.go
@@ -125,7 +125,7 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	var channel *model.Channel
 	err := json.NewDecoder(r.Body).Decode(&channel)
-	if err != nil {
+	if err != nil || channel == nil {
 		c.SetInvalidParamWithErr("channel", err)
 		return
 	}
diff --git a/server/channels/api4/channel_test.go b/server/channels/api4/channel_test.go
index 4c656c7219..2cc29da0ab 100644
--- a/server/channels/api4/channel_test.go
+++ b/server/channels/api4/channel_test.go
@@ -250,6 +250,15 @@ func TestUpdateChannel(t *testing.T) {
 	_, resp, err = client.UpdateChannel(directChannel)
 	require.Error(t, err)
 	CheckForbiddenStatus(t, resp)
+
+	t.Run("null value", func(t *testing.T) {
+		r, err := client.DoAPIPut(fmt.Sprintf("/channels"+"/%v", channel.Id), "null")
+		resp := model.BuildResponse(r)
+		defer closeBody(r)
+
+		require.Error(t, err)
+		CheckBadRequestStatus(t, resp)
+	})
 }
 
 func TestPatchChannel(t *testing.T) {