MM-39420: Checks for presence of slice before index access. (#18826)

* MM-39420: Checks for presence of slice before index access.

* MM-39420: Sanitize all embeds with single method.

* MM-39420: Already checking len in method.

app/notification.go

@@ -601,16 +601,11 @@ func (a *App) SendNotifications(post *model.Post, team *model.Team, channel *mod
 					a.sanitizeProfiles(userThread.Participants, false)
 					userThread.Post.SanitizeProps()
 
-					previewPost := post.GetPreviewPost()
+					sanitizedPost, err := a.SanitizePostMetadataForUser(userThread.Post, uid)
-					if previewPost != nil {
+					if err != nil {
-						previewedChannel, err := a.GetChannel(previewPost.Post.ChannelId)
+						return nil, err
-						if err != nil {
-							return nil, err
-						}
-						if previewedChannel != nil && !a.HasPermissionToReadChannel(uid, previewedChannel) {
-							userThread.Post.Metadata.Embeds[0].Data = nil
-						}
 					}
+					userThread.Post = sanitizedPost
 
 					payload, jsonErr := json.Marshal(userThread)
 					if jsonErr != nil {

app/post.go

@@ -721,24 +721,19 @@ func (a *App) publishWebsocketEventForPermalinkPost(post *model.Post, message *m
 		return false, err
 	}
 
-	previewedChannel, err := a.GetChannel(previewedPost.ChannelId)
-	if err != nil {
-		if err.StatusCode == http.StatusNotFound {
-			mlog.Warn("channel containing permalinked post not found", mlog.String("referenced_channel_id", previewedPost.ChannelId))
-			return false, nil
-		}
-		return false, err
-	}
-
 	channelMembers, err := a.GetChannelMembersPage(post.ChannelId, 0, 10000000)
 	if err != nil {
 		return false, err
 	}
 
 	for _, cm := range channelMembers {
-		postForUser := post.Clone()
+		postForUser, err := a.SanitizePostMetadataForUser(post, cm.UserId)
-		if !a.HasPermissionToReadChannel(cm.UserId, previewedChannel) {
+		if err != nil {
-			postForUser.Metadata.Embeds[0].Data = nil
+			if err.StatusCode == http.StatusNotFound {
+				mlog.Warn("channel containing permalinked post not found", mlog.String("referenced_channel_id", previewedPost.ChannelId))
+				return false, nil
+			}
+			return false, err
 		}
 		messageCopy := message.Copy()
 		broadcastCopy := messageCopy.GetBroadcast()