From ec49112ae06cdc428f5848c5757ce2d8ac068e61 Mon Sep 17 00:00:00 2001 From: Doug Lauder Date: Fri, 7 May 2021 11:49:47 -0400 Subject: [PATCH] sanitize user before creation (#17582) Sanitize incoming user records created via shared channel sync. --- services/sharedchannel/sync_recv.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/services/sharedchannel/sync_recv.go b/services/sharedchannel/sync_recv.go index ffc5f41608..452e97253c 100644 --- a/services/sharedchannel/sync_recv.go +++ b/services/sharedchannel/sync_recv.go @@ -228,6 +228,9 @@ func (scs *Service) insertSyncUser(user *model.User, channel *model.Channel, rc var userSaved *model.User var suffix string + // ensure the new user is created with system_user role and random password. + user = sanitizeUserForSync(user) + // save the original username and email in props (if not already done by another remote) if _, ok := user.GetProp(KeyRemoteUsername); !ok { user.SetProp(KeyRemoteUsername, user.Username) @@ -290,6 +293,7 @@ func (scs *Service) updateSyncUser(patch *model.UserPatch, user *model.User, cha } user.Patch(patch) + user = sanitizeUserForSync(user) user.SetProp(KeyRemoteUsername, realUsername) user.SetProp(KeyRemoteEmail, realEmail)