Save access on plugin env during ServePluginPublicRequest (#16854)

* Save access on plugin env during ServePluginPublicRequest

* Cover solution with the offending specs

* Apply PR suggestions

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

app/plugin_requests.go

@@ -89,7 +89,15 @@ func (a *App) ServePluginPublicRequest(w http.ResponseWriter, r *http.Request) {
 	vars := mux.Vars(r)
 	pluginID := vars["plugin_id"]
 
-	publicFilesPath, err := a.GetPluginsEnvironment().PublicFilesPath(pluginID)
+	pluginsEnv := a.GetPluginsEnvironment()
+
+	// Check if someone has nullified the pluginsEnv in the meantime
+	if pluginsEnv == nil {
+		http.NotFound(w, r)
+		return
+	}
+
+	publicFilesPath, err := pluginsEnv.PublicFilesPath(pluginID)
 	if err != nil {
 		http.NotFound(w, r)
 		return

app/plugin_requests_test.go

@@ -0,0 +1,48 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package app
+
+import (
+	"hash/maphash"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/mattermost/mattermost-server/v5/config"
+	"github.com/mattermost/mattermost-server/v5/model"
+)
+
+func TestServePluginPublicRequest(t *testing.T) {
+	t.Run("returns not found when plugins environment is nil", func(t *testing.T) {
+		cfg := model.Config{}
+		cfg.SetDefaults()
+		configStore := config.NewTestMemoryStore()
+		configStore.Set(&cfg)
+
+		srv := &Server{
+			goroutineExitSignal: make(chan struct{}, 1),
+			RootRouter:          mux.NewRouter(),
+			LocalRouter:         mux.NewRouter(),
+			licenseListeners:    map[string]func(*model.License, *model.License){},
+			hashSeed:            maphash.MakeSeed(),
+			uploadLockMap:       map[string]bool{},
+			configStore:         configStore,
+		}
+		app := New(ServerConnector(srv))
+		app.UpdateConfig(func(cfg *model.Config) { *cfg.PluginSettings.Enable = true })
+
+		req, err := http.NewRequest("GET", "/plugins", nil)
+		require.NoError(t, err)
+
+		rr := httptest.NewRecorder()
+		handler := http.HandlerFunc(app.ServePluginPublicRequest)
+		handler.ServeHTTP(rr, req)
+
+		assert.Equal(t, http.StatusNotFound, rr.Code)
+	})
+}