From f787fd63368ac43ebb242cb9a967372d7cbe7795 Mon Sep 17 00:00:00 2001 From: Elias Nahum Date: Fri, 25 Aug 2023 19:31:48 -0400 Subject: [PATCH] Sanitize user in update user response (#24362) --- server/channels/app/user.go | 2 ++ server/channels/app/user_test.go | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/server/channels/app/user.go b/server/channels/app/user.go index 79d2dab001..9bee2682f5 100644 --- a/server/channels/app/user.go +++ b/server/channels/app/user.go @@ -1285,6 +1285,8 @@ func (a *App) UpdateUser(c request.CTX, user *model.User, sendNotifications bool }(user.Id) } + newUser.Sanitize(map[string]bool{}) + return newUser, nil } diff --git a/server/channels/app/user_test.go b/server/channels/app/user_test.go index 0fd0d439be..f80eae0896 100644 --- a/server/channels/app/user_test.go +++ b/server/channels/app/user_test.go @@ -205,6 +205,7 @@ func TestUpdateUser(t *testing.T) { require.Nil(t, err) require.NotNil(t, u) require.Less(t, u.LastPictureUpdate, iLastPictureUpdate) + require.Empty(t, u.Password) }) t.Run("fails if profile picture is updated when user has custom profile picture and username is changed", func(t *testing.T) { @@ -1731,11 +1732,12 @@ func TestPatchUser(t *testing.T) { }) t.Run("Patch username with a new username", func(t *testing.T) { - _, err := th.App.PatchUser(th.Context, testUser.Id, &model.UserPatch{ + u, err := th.App.PatchUser(th.Context, testUser.Id, &model.UserPatch{ Username: model.NewString(model.NewId()), }, true) require.Nil(t, err) + require.Empty(t, u.Password) }) }