MM-64779: Upload type validation. (#33351)

server/i18n/en.json

@@ -3914,6 +3914,10 @@
     "id": "api.upload.get_upload.forbidden.app_error",
     "translation": "Failed to get upload."
   },
+  {
+    "id": "api.upload.invalid_type_for_shared_channel.app_error",
+    "translation": "Failed to upload file. Upload channel is not shared with remote."
+  },
   {
     "id": "api.upload.upload_data.invalid_content_length",
     "translation": "Invalid Content-Length."

server/platform/services/sharedchannel/attachment.go

@@ -191,6 +191,12 @@ func (scs *Service) onReceiveUploadCreate(msg model.RemoteClusterMsg, rc *model.
 			map[string]any{"channelId": us.ChannelId}, "", http.StatusRequestEntityTooLarge)
 	}
 
+	// validate upload type for shared channels - only allow attachments
+	if us.Type != model.UploadTypeAttachment {
+		return model.NewAppError("onReceiveUploadCreate", "api.upload.invalid_type_for_shared_channel.app_error",
+			nil, "", http.StatusBadRequest)
+	}
+
 	us.RemoteId = rc.RemoteId // don't let remotes try to impersonate each other
 
 	// create upload session.