diff --git a/api4/channel.go b/api4/channel.go index 3dbba93368..9dafab4a10 100644 --- a/api4/channel.go +++ b/api4/channel.go @@ -917,11 +917,22 @@ func viewChannel(c *Context, w http.ResponseWriter, r *http.Request) { } view := model.ChannelViewFromJson(r.Body) - if view == nil || !model.IsValidId(view.ChannelId) || (view.PrevChannelId != "" && !model.IsValidId(view.PrevChannelId)) { + if view == nil { c.SetInvalidParam("channel_view") return } + // Validate view struct + // Check IDs are valid or blank. Blank IDs are used to denote focus loss or inital channel view. + if view.ChannelId != "" && !model.IsValidId(view.ChannelId) { + c.SetInvalidParam("channel_view.channel_id") + return + } + if view.PrevChannelId != "" && !model.IsValidId(view.PrevChannelId) { + c.SetInvalidParam("channel_view.prev_channel_id") + return + } + times, err := c.App.ViewChannel(view, c.Params.UserId, !c.App.Session.IsMobileApp()) if err != nil { c.Err = err diff --git a/api4/channel_test.go b/api4/channel_test.go index 36b774668a..3e3a24ffb7 100644 --- a/api4/channel_test.go +++ b/api4/channel_test.go @@ -1418,6 +1418,12 @@ func TestViewChannel(t *testing.T) { _, resp = Client.ViewChannel(th.BasicUser.Id, view) CheckBadRequestStatus(t, resp) + // All blank is OK we use it for clicking off of the browser. + view.PrevChannelId = "" + view.ChannelId = "" + _, resp = Client.ViewChannel(th.BasicUser.Id, view) + CheckNoError(t, resp) + view.PrevChannelId = "" view.ChannelId = "junk" _, resp = Client.ViewChannel(th.BasicUser.Id, view)