MM-58847 Sanitize User (#27471)

* add more fields to sanitizeInput on User

* add test for user sanoitizeInput

* add more fields

* remove line, lint fix

* additional fields and sanitize update

* Update user_test.go

* remove fields that are unnecessary to check

* add check to test

---------

Co-authored-by: Mattermost Build <build@mattermost.com>

server/public/model/user.go

@@ -686,6 +686,8 @@ func (u *User) SanitizeInput(isAdmin bool) {
 		u.EmailVerified = false
 	}
 	u.RemoteId = NewString("")
+	u.CreateAt = 0
+	u.UpdateAt = 0
 	u.DeleteAt = 0
 	u.LastPasswordUpdate = 0
 	u.LastPictureUpdate = 0
@@ -693,6 +695,7 @@ func (u *User) SanitizeInput(isAdmin bool) {
 	u.MfaActive = false
 	u.MfaSecret = ""
 	u.Email = strings.TrimSpace(u.Email)
+	u.LastActivityAt = 0
 }
 
 func (u *User) ClearNonProfileFields(asAdmin bool) {

server/public/model/user_test.go

@@ -311,6 +311,52 @@ func TestUserIsValid(t *testing.T) {
 	require.True(t, HasExpectedUserIsValidError(appErr, "roles_limit", user.Id, user.Roles), "expected user is valid error: %s", appErr.Error())
 }
 
+func TestUserSanitizeInput(t *testing.T) {
+	user := User{}
+	user.CreateAt = GetMillis()
+	user.UpdateAt = GetMillis()
+	user.DeleteAt = GetMillis()
+	user.LastPasswordUpdate = GetMillis()
+	user.LastPictureUpdate = GetMillis()
+
+	user.Username = "username"
+	user.Email = "  user@example.com "
+	user.Nickname = "nickname"
+	user.FirstName = "firstname"
+	user.LastName = "lastname"
+	user.RemoteId = NewString(NewId())
+	user.Position = "position"
+	user.Roles = "system_admin"
+	user.AuthData = NewString("authdata")
+	user.AuthService = "saml"
+	user.EmailVerified = true
+	user.FailedAttempts = 10
+	user.LastActivityAt = GetMillis()
+
+	user.SanitizeInput(false)
+
+	// these fields should be reset
+	require.Equal(t, NewString(""), user.AuthData)
+	require.Equal(t, "", user.AuthService)
+	require.False(t, user.EmailVerified)
+	require.Equal(t, NewString(""), user.RemoteId)
+	require.Equal(t, int64(0), user.CreateAt)
+	require.Equal(t, int64(0), user.UpdateAt)
+	require.Equal(t, int64(0), user.DeleteAt)
+	require.Equal(t, int64(0), user.LastPasswordUpdate)
+	require.Equal(t, int64(0), user.LastPictureUpdate)
+	require.Equal(t, int64(0), user.LastActivityAt)
+	require.Equal(t, 0, user.FailedAttempts)
+
+	// these fields should remain intact
+	require.Equal(t, "user@example.com", user.Email)
+	require.Equal(t, "username", user.Username)
+	require.Equal(t, "nickname", user.Nickname)
+	require.Equal(t, "firstname", user.FirstName)
+	require.Equal(t, "lastname", user.LastName)
+	require.Equal(t, "position", user.Position)
+}
+
 func HasExpectedUserIsValidError(err *AppError, fieldName, userId string, fieldValue any) bool {
 	if err == nil {
 		return false