Restricting groupmsg command to only allow to create group chats with know people (#12148)

* Restricting groupmsg command to only allow to create group chats with know people

* More generic response to the users about user he can't see

* Making the code more clean

app/command_groupmsg.go

@@ -47,14 +47,26 @@ func (me *groupmsgProvider) DoCommand(a *App, args *model.CommandArgs, message s
 	for _, username := range users {
 		username = strings.TrimSpace(username)
 		username = strings.TrimPrefix(username, "@")
-		if targetUser, err := a.Srv.Store.User().GetByUsername(username); err != nil {
+		targetUser, err := a.Srv.Store.User().GetByUsername(username)
+		if err != nil {
 			invalidUsernames = append(invalidUsernames, username)
-		} else {
-			_, exists := targetUsers[targetUser.Id]
-			if !exists && targetUser.Id != args.UserId {
-				targetUsers[targetUser.Id] = targetUser
-				targetUsersSlice = append(targetUsersSlice, targetUser.Id)
-			}
+			continue
+		}
+
+		canSee, err := a.UserCanSeeOtherUser(args.UserId, targetUser.Id)
+		if err != nil {
+			return &model.CommandResponse{Text: args.T("api.command_groupmsg.fail.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}
+		}
+
+		if !canSee {
+			invalidUsernames = append(invalidUsernames, username)
+			continue
+		}
+
+		_, exists := targetUsers[targetUser.Id]
+		if !exists && targetUser.Id != args.UserId {
+			targetUsers[targetUser.Id] = targetUser
+			targetUsersSlice = append(targetUsersSlice, targetUser.Id)
 		}
 	}