From 5a7956524472f189c32906cb85d8e6f149ab9319 Mon Sep 17 00:00:00 2001
From: Doug Lauder <wiggin77@warpmail.net>
Date: Thu, 16 May 2024 08:21:12 -0400
Subject: [PATCH] Check user belongs to remote when updating profile image
 (#27008)

---
 server/channels/api4/remote_cluster.go | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/server/channels/api4/remote_cluster.go b/server/channels/api4/remote_cluster.go
index 14fdb6ae3b..e316d3690f 100644
--- a/server/channels/api4/remote_cluster.go
+++ b/server/channels/api4/remote_cluster.go
@@ -271,6 +271,15 @@ func remoteSetProfileImage(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.SetInvalidURLParam("user_id")
 		return
 	}
+
+	// ensure the user being modified belongs to the remote requesting the change.
+	requesterRemoteID := c.GetRemoteID(r)
+	if user.GetRemoteID() != requesterRemoteID {
+		c.Err = model.NewAppError("remoteSetProfileImage", "api.context.remote_id_mismatch.app_error",
+			nil, "", http.StatusUnauthorized)
+		return
+	}
+
 	audit.AddEventParameterAuditable(auditRec, "user", user)
 
 	imageData := imageArray[0]