[MM-49034] Team data broadcasted are not sanitized and not targeted to the team (#22063)

Co-authored-by: Mattermost Build <build@mattermost.com>

app/team.go

@@ -427,13 +427,8 @@ func (a *App) sendTeamEvent(team *model.Team, event string) *model.AppError {
 	*sanitizedTeam = *team
 	sanitizedTeam.Sanitize()
 
-	teamID := "" // no filtering by teamID by default
+	message := model.NewWebSocketEvent(event, sanitizedTeam.Id, "", "", nil, "")
-	if event == model.WebsocketEventUpdateTeam {
+	teamJSON, jsonErr := json.Marshal(sanitizedTeam)
-		// in case of update_team event - we send the message only to members of that team
-		teamID = team.Id
-	}
-	message := model.NewWebSocketEvent(event, teamID, "", "", nil, "")
-	teamJSON, jsonErr := json.Marshal(team)
 	if jsonErr != nil {
 		return model.NewAppError("sendTeamEvent", "api.marshal_error", nil, "", http.StatusInternalServerError).Wrap(jsonErr)
 	}

app/team_test.go

@@ -4,7 +4,9 @@
 package app
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"math/rand"
@@ -24,6 +26,7 @@ import (
 	"github.com/mattermost/mattermost-server/v6/store"
 	"github.com/mattermost/mattermost-server/v6/store/sqlstore"
 	"github.com/mattermost/mattermost-server/v6/store/storetest/mocks"
+	"github.com/mattermost/mattermost-server/v6/testlib"
 )
 
 func TestCreateTeam(t *testing.T) {
@@ -1835,3 +1838,44 @@ func TestGetNewTeamMembersSince(t *testing.T) {
 		})
 	})
 }
+
+func TestTeamSendEvents(t *testing.T) {
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	testCluster := &testlib.FakeClusterInterface{}
+	th.Server.Platform().SetCluster(testCluster)
+	defer th.Server.Platform().SetCluster(nil)
+
+	team := th.CreateTeam()
+
+	testCluster.ClearMessages()
+
+	wsEvents := []string{model.WebsocketEventUpdateTeam, model.WebsocketEventRestoreTeam, model.WebsocketEventDeleteTeam}
+	for _, wsEvent := range wsEvents {
+		appErr := th.App.sendTeamEvent(team, wsEvent)
+		require.Nil(t, appErr)
+	}
+
+	msgs := testCluster.GetMessages()
+	require.Len(t, msgs, len(wsEvents))
+
+	for _, msg := range msgs {
+		ev, err := model.WebSocketEventFromJSON(bytes.NewReader(msg.Data))
+		require.NoError(t, err)
+
+		// The event should be a team event.
+		require.Equal(t, team.Id, ev.GetBroadcast().TeamId)
+
+		// Make sure we're hiding the sensitive fields.
+		var teamFromEvent *model.Team
+		err = json.Unmarshal([]byte(ev.GetData()["team"].(string)), &teamFromEvent)
+		require.NoError(t, err)
+		require.Equal(t, team.Id, teamFromEvent.Id)
+		require.Equal(t, team.DisplayName, teamFromEvent.DisplayName)
+		require.Equal(t, team.Name, teamFromEvent.Name)
+		require.Equal(t, team.Description, teamFromEvent.Description)
+		require.Equal(t, "", teamFromEvent.Email)
+		require.Equal(t, "", teamFromEvent.InviteId)
+	}
+}