Fix SQL syntax error when a non-existant channelId is attemted to be viewed. (#9975)

api4/channel.go

@@ -917,7 +917,7 @@ func viewChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	view := model.ChannelViewFromJson(r.Body)
-	if view == nil {
+	if view == nil || !model.IsValidId(view.ChannelId) || (view.PrevChannelId != "" && !model.IsValidId(view.PrevChannelId)) {
 		c.SetInvalidParam("channel_view")
 		return
 	}

api4/channel_test.go

@@ -1416,7 +1416,17 @@ func TestViewChannel(t *testing.T) {
 
 	view.PrevChannelId = "junk"
 	_, resp = Client.ViewChannel(th.BasicUser.Id, view)
-	CheckNoError(t, resp)
+	CheckBadRequestStatus(t, resp)
+
+	view.PrevChannelId = ""
+	view.ChannelId = "junk"
+	_, resp = Client.ViewChannel(th.BasicUser.Id, view)
+	CheckBadRequestStatus(t, resp)
+
+	view.ChannelId = "correctlysizedjunkdddfdfdf"
+	_, resp = Client.ViewChannel(th.BasicUser.Id, view)
+	CheckBadRequestStatus(t, resp)
+	view.ChannelId = th.BasicChannel.Id
 
 	member, resp := Client.GetChannelMember(th.BasicChannel.Id, th.BasicUser.Id, "")
 	CheckNoError(t, resp)

app/channel.go

@@ -1600,7 +1600,6 @@ func (a *App) MarkChannelsAsViewed(channelIds []string, userId string, clearPush
 	channelsToClearPushNotifications := []string{}
 	if *a.Config().EmailSettings.SendPushNotifications && clearPushNotifications {
 		for _, channelId := range channelIds {
-			if model.IsValidId(channelId) {
 			result := <-a.Srv.Store.Channel().GetMember(channelId, userId)
 			if result.Err != nil {
 				mlog.Warn(fmt.Sprintf("Failed to get membership %v", result.Err))
@@ -1628,7 +1627,6 @@ func (a *App) MarkChannelsAsViewed(channelIds []string, userId string, clearPush
 			}
 		}
 	}
-	}
 	result := <-a.Srv.Store.Channel().UpdateLastViewedAt(channelIds, userId)
 	if result.Err != nil {
 		return nil, result.Err
@@ -1637,13 +1635,11 @@ func (a *App) MarkChannelsAsViewed(channelIds []string, userId string, clearPush
 	times := result.Data.(map[string]int64)
 	if *a.Config().ServiceSettings.EnableChannelViewedMessages {
 		for _, channelId := range channelIds {
-			if model.IsValidId(channelId) {
 			message := model.NewWebSocketEvent(model.WEBSOCKET_EVENT_CHANNEL_VIEWED, "", "", userId, nil)
 			message.Add("channel_id", channelId)
 			a.Publish(message)
 		}
 	}
-	}
 	for _, channelId := range channelsToClearPushNotifications {
 		a.ClearPushNotification(userId, channelId)
 	}

store/sqlstore/channel_store.go

@@ -1734,8 +1734,16 @@ func (s SqlChannelStore) UpdateLastViewedAt(channelIds []string, userId string)
 
 		selectQuery := "SELECT Id, LastPostAt, TotalMsgCount FROM Channels WHERE (" + selectIdQuery + ")"
 
-		if _, err := s.GetMaster().Select(&lastPostAtTimes, selectQuery, props); err != nil {
+		if _, err := s.GetMaster().Select(&lastPostAtTimes, selectQuery, props); err != nil || len(lastPostAtTimes) <= 0 {
-			result.Err = model.NewAppError("SqlChannelStore.UpdateLastViewedAt", "store.sql_channel.update_last_viewed_at.app_error", nil, "channel_ids="+strings.Join(channelIds, ",")+", user_id="+userId+", "+err.Error(), http.StatusInternalServerError)
+			var extra string
+			status := http.StatusInternalServerError
+			if err == nil {
+				status = http.StatusBadRequest
+				extra = "No channels found"
+			} else {
+				extra = err.Error()
+			}
+			result.Err = model.NewAppError("SqlChannelStore.UpdateLastViewedAt", "store.sql_channel.update_last_viewed_at.app_error", nil, "channel_ids="+strings.Join(channelIds, ",")+", user_id="+userId+", "+extra, status)
 			return
 		}