when sync'ing users make sure the user's remoteid matches the remote issuing the update (#27203)

server/platform/services/sharedchannel/sync_recv.go

@@ -17,6 +17,10 @@ import (
 	"github.com/mattermost/mattermost/server/v8/platform/services/remotecluster"
 )
 
+var (
+	ErrRemoteIDMismatch = errors.New("remoteID mismatch")
+)
+
 func (scs *Service) onReceiveSyncMessage(msg model.RemoteClusterMsg, rc *model.RemoteCluster, response *remotecluster.Response) error {
 	if msg.Topic != TopicSync {
 		return fmt.Errorf("wrong topic, expected `%s`, got `%s`", TopicSync, msg.Topic)
@@ -167,7 +171,7 @@ func (scs *Service) processSyncMessage(c request.CTX, syncMsg *model.SyncMsg, rc
 
 func (scs *Service) upsertSyncUser(c request.CTX, user *model.User, channel *model.Channel, rc *model.RemoteCluster) (*model.User, error) {
 	var err error
-	if user.RemoteId == nil || *user.RemoteId == "" {
+	if SafeString(user.RemoteId) == "" {
 		user.RemoteId = model.NewString(rc.RemoteId)
 	}
 
@@ -185,6 +189,16 @@ func (scs *Service) upsertSyncUser(c request.CTX, user *model.User, channel *mod
 			return nil, err
 		}
 	} else {
+		// check if existing user belongs to the remote that issued the update
+		if SafeString(euser.RemoteId) != SafeString(user.RemoteId) {
+			scs.server.Log().Log(mlog.LvlSharedChannelServiceError, "RemoteID mismatch sync'ing user",
+				mlog.String("remote", rc.Name),
+				mlog.String("user_id", user.Id),
+				mlog.String("existing_user_remote_id", SafeString(euser.RemoteId)),
+				mlog.String("update_user_remote_id", SafeString(user.RemoteId)),
+			)
+			return nil, fmt.Errorf("error updating user: %w", ErrRemoteIDMismatch)
+		}
 		patch := &model.UserPatch{
 			Username:  &user.Username,
 			Nickname:  &user.Nickname,

server/platform/services/sharedchannel/util.go

@@ -148,3 +148,10 @@ func reducePostsSliceInCache(posts []*model.Post, cache map[string]*model.Post)
 	}
 	return reduced
 }
+
+func SafeString(p *string) string {
+	if p == nil {
+		return ""
+	}
+	return *p
+}