From 412e52894c9e11f87a7b388e0b15e714d3e2524a Mon Sep 17 00:00:00 2001
From: Martin Kraft <martinkraft@gmail.com>
Date: Thu, 4 Nov 2021 09:41:19 -0400
Subject: [PATCH] MM-39420: Checks for presence of slice before index access.
 (#18826)

* MM-39420: Checks for presence of slice before index access.

* MM-39420: Sanitize all embeds with single method.

* MM-39420: Already checking len in method.
---
 app/notification.go | 13 ++++---------
 app/post.go         | 19 +++++++------------
 2 files changed, 11 insertions(+), 21 deletions(-)

diff --git a/app/notification.go b/app/notification.go
index a8c52e6ac2..f34f0ecc45 100644
--- a/app/notification.go
+++ b/app/notification.go
@@ -601,16 +601,11 @@ func (a *App) SendNotifications(post *model.Post, team *model.Team, channel *mod
 					a.sanitizeProfiles(userThread.Participants, false)
 					userThread.Post.SanitizeProps()
 
-					previewPost := post.GetPreviewPost()
-					if previewPost != nil {
-						previewedChannel, err := a.GetChannel(previewPost.Post.ChannelId)
-						if err != nil {
-							return nil, err
-						}
-						if previewedChannel != nil && !a.HasPermissionToReadChannel(uid, previewedChannel) {
-							userThread.Post.Metadata.Embeds[0].Data = nil
-						}
+					sanitizedPost, err := a.SanitizePostMetadataForUser(userThread.Post, uid)
+					if err != nil {
+						return nil, err
 					}
+					userThread.Post = sanitizedPost
 
 					payload, jsonErr := json.Marshal(userThread)
 					if jsonErr != nil {
diff --git a/app/post.go b/app/post.go
index 7be53bc516..cf61061e22 100644
--- a/app/post.go
+++ b/app/post.go
@@ -721,24 +721,19 @@ func (a *App) publishWebsocketEventForPermalinkPost(post *model.Post, message *m
 		return false, err
 	}
 
-	previewedChannel, err := a.GetChannel(previewedPost.ChannelId)
-	if err != nil {
-		if err.StatusCode == http.StatusNotFound {
-			mlog.Warn("channel containing permalinked post not found", mlog.String("referenced_channel_id", previewedPost.ChannelId))
-			return false, nil
-		}
-		return false, err
-	}
-
 	channelMembers, err := a.GetChannelMembersPage(post.ChannelId, 0, 10000000)
 	if err != nil {
 		return false, err
 	}
 
 	for _, cm := range channelMembers {
-		postForUser := post.Clone()
-		if !a.HasPermissionToReadChannel(cm.UserId, previewedChannel) {
-			postForUser.Metadata.Embeds[0].Data = nil
+		postForUser, err := a.SanitizePostMetadataForUser(post, cm.UserId)
+		if err != nil {
+			if err.StatusCode == http.StatusNotFound {
+				mlog.Warn("channel containing permalinked post not found", mlog.String("referenced_channel_id", previewedPost.ChannelId))
+				return false, nil
+			}
+			return false, err
 		}
 		messageCopy := message.Copy()
 		broadcastCopy := messageCopy.GetBroadcast()