MM-64926: Membership sync sends sensitive data to remote (#33560) (#33577)

Automatic Merge

server/platform/services/sharedchannel/membership.go

@@ -322,7 +322,7 @@ func (scs *Service) syncMembershipBatchToRemotes(syncMsg *model.SyncMsg, remotes
 				// Check if user profile needs to be synced
 				doSync, _, sErr := scs.shouldUserSync(user, syncMsg.ChannelId, rc)
 				if sErr == nil && doSync {
-					enrichedSyncMsg.Users[user.Id] = user
+					enrichedSyncMsg.Users[user.Id] = sanitizeUserForSyncSafe(user)
 				}
 			}
 		}

server/platform/services/sharedchannel/util.go

@@ -48,6 +48,12 @@ func sanitizeUserForSync(user *model.User) *model.User {
 	return user
 }
 
+func sanitizeUserForSyncSafe(user *model.User) *model.User {
+	// Create a copy to avoid modifying the original user object
+	userCopy := *user
+	return sanitizeUserForSync(&userCopy)
+}
+
 const MungUsernameSeparator = "-"
 
 // mungUsername creates a new username by combining username and remote cluster name, plus