[MM-15270] Add Team.InviteId sanitization (#12952)

* Filter out InviteId in Team sanitize function

* Keep InviteId for authorized users

* Update team sanitization tests

* Improve tests and revert conflicting lines

app/team.go

@@ -1333,10 +1333,19 @@ func (a *App) GetTeamIdFromQuery(query url.Values) (string, *model.AppError) {
 }
 
 func (a *App) SanitizeTeam(session model.Session, team *model.Team) *model.Team {
-	if !a.SessionHasPermissionToTeam(session, team.Id, model.PERMISSION_MANAGE_TEAM) {
-		team.Sanitize()
+	if a.SessionHasPermissionToTeam(session, team.Id, model.PERMISSION_MANAGE_TEAM) {
+		return team
 	}
 
+	if a.SessionHasPermissionToTeam(session, team.Id, model.PERMISSION_INVITE_USER) {
+		inviteId := team.InviteId
+		team.Sanitize()
+		team.InviteId = inviteId
+		return team
+	}
+
+	team.Sanitize()
+
 	return team
 }
 

app/team_test.go

@@ -419,6 +419,7 @@ func TestSanitizeTeam(t *testing.T) {
 	team := &model.Team{
 		Id:             model.NewId(),
 		Email:          th.MakeEmail(),
+		InviteId:       model.NewId(),
 		AllowedDomains: "example.com",
 	}
 
@@ -443,6 +444,7 @@ func TestSanitizeTeam(t *testing.T) {
 
 		sanitized := th.App.SanitizeTeam(session, copyTeam())
 		require.Empty(t, sanitized.Email, "should've sanitized team")
+		require.Empty(t, sanitized.InviteId, "should've sanitized inviteid")
 	})
 
 	t.Run("user of the team", func(t *testing.T) {
@@ -460,6 +462,7 @@ func TestSanitizeTeam(t *testing.T) {
 
 		sanitized := th.App.SanitizeTeam(session, copyTeam())
 		require.Empty(t, sanitized.Email, "should've sanitized team")
+		require.NotEmpty(t, sanitized.InviteId, "should have not sanitized inviteid")
 	})
 
 	t.Run("team admin", func(t *testing.T) {
@@ -477,6 +480,7 @@ func TestSanitizeTeam(t *testing.T) {
 
 		sanitized := th.App.SanitizeTeam(session, copyTeam())
 		require.NotEmpty(t, sanitized.Email, "shouldn't have sanitized team")
+		require.NotEmpty(t, sanitized.InviteId, "shouldn't have sanitized inviteid")
 	})
 
 	t.Run("team admin of another team", func(t *testing.T) {
@@ -494,6 +498,7 @@ func TestSanitizeTeam(t *testing.T) {
 
 		sanitized := th.App.SanitizeTeam(session, copyTeam())
 		require.Empty(t, sanitized.Email, "should've sanitized team")
+		require.Empty(t, sanitized.InviteId, "should've sanitized inviteid")
 	})
 
 	t.Run("system admin, not a user of team", func(t *testing.T) {
@@ -511,6 +516,7 @@ func TestSanitizeTeam(t *testing.T) {
 
 		sanitized := th.App.SanitizeTeam(session, copyTeam())
 		require.NotEmpty(t, sanitized.Email, "shouldn't have sanitized team")
+		require.NotEmpty(t, sanitized.InviteId, "shouldn't have sanitized inviteid")
 	})
 
 	t.Run("system admin, user of team", func(t *testing.T) {
@@ -528,6 +534,7 @@ func TestSanitizeTeam(t *testing.T) {
 
 		sanitized := th.App.SanitizeTeam(session, copyTeam())
 		require.NotEmpty(t, sanitized.Email, "shouldn't have sanitized team")
+		require.NotEmpty(t, sanitized.InviteId, "shouldn't have sanitized inviteid")
 	})
 }