From a8fa77f107efe83f09a779f8e67cbecf236b0032 Mon Sep 17 00:00:00 2001
From: catalintomai <56169943+catalintomai@users.noreply.github.com>
Date: Tue, 8 Jul 2025 00:13:02 +0200
Subject: [PATCH] MM-64779: Upload type validation. (#33351)

---
 server/i18n/en.json                                  | 4 ++++
 server/platform/services/sharedchannel/attachment.go | 6 ++++++
 2 files changed, 10 insertions(+)

diff --git a/server/i18n/en.json b/server/i18n/en.json
index 4c6195b578..889d77d2d3 100644
--- a/server/i18n/en.json
+++ b/server/i18n/en.json
@@ -3914,6 +3914,10 @@
     "id": "api.upload.get_upload.forbidden.app_error",
     "translation": "Failed to get upload."
   },
+  {
+    "id": "api.upload.invalid_type_for_shared_channel.app_error",
+    "translation": "Failed to upload file. Upload channel is not shared with remote."
+  },
   {
     "id": "api.upload.upload_data.invalid_content_length",
     "translation": "Invalid Content-Length."
diff --git a/server/platform/services/sharedchannel/attachment.go b/server/platform/services/sharedchannel/attachment.go
index 717e0a8455..a3dc16acfd 100644
--- a/server/platform/services/sharedchannel/attachment.go
+++ b/server/platform/services/sharedchannel/attachment.go
@@ -191,6 +191,12 @@ func (scs *Service) onReceiveUploadCreate(msg model.RemoteClusterMsg, rc *model.
 			map[string]any{"channelId": us.ChannelId}, "", http.StatusRequestEntityTooLarge)
 	}
 
+	// validate upload type for shared channels - only allow attachments
+	if us.Type != model.UploadTypeAttachment {
+		return model.NewAppError("onReceiveUploadCreate", "api.upload.invalid_type_for_shared_channel.app_error",
+			nil, "", http.StatusBadRequest)
+	}
+
 	us.RemoteId = rc.RemoteId // don't let remotes try to impersonate each other
 
 	// create upload session.