* adds team member data sanitizing (#35562)
* adds team member data sanitizing
* assert using require
* adds data sanitizing to team members for user endpoint
* team admin data visibility now tests with different user
(cherry picked from commit 2be57a7ec0c67004b77c76386f20a630920196e3)
* removes wrong argument in test helper calls
* fix: add explicit permission grant in team members test (#36007)
* fix: add explicit permission grant in team members test
TestGetTeamMembersForUserRoleDataSanitization was relying on a permission
side-effect leaked from concurrent tests. Under fullyparallel, another test
temporarily adds PermissionReadOtherUsersTeams to system_user role, which
the team admin subtest accidentally benefits from. Under sequential execution
(binary parameters mode), no concurrent test leaks this permission, so the
team admin correctly gets 403.
Fix by explicitly granting ReadOtherUsersTeams in the subtest setup, matching
the pattern used in adjacent subtests.
Release Note
NONE
Co-authored-by: Claude <claude@anthropic.com>
* fix: remove explanatory comment per review feedback
---------
Co-authored-by: Claude <claude@anthropic.com>
* removes extra arg from test helper call
---------
Co-authored-by: Carlos Garcia <carlos.garcia@mattermost.com>
Co-authored-by: Pavel Zeman <pavel.zeman@mattermost.com>
Co-authored-by: Claude <claude@anthropic.com>
This commit exposes audit logging functionality to plugins via the plugin API, allowing plugins to create and log audit records. Additionally, it addresses a gob encoding issue that could cause plugin crashes when audit data contains nil pointers or unregistered types.
* ensure user has invite team permission in order to change setting
* add tests and handle UI
* lint fixes
* revert changes to invite section input
* update tests
* revert bad merge
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* POC for API handler opts modifier
* Made upload POSt api a file upload API
* Specified file upload local API
* Specified file upload local API
* Specified file upload API
* Simplified handler params
* Added basic security checks
* Fixed i18n
* used type for API handler options
* Removed limited reader from util deserializers (#26263)
* check for invite_guest permission when inviting guests
* update description for invite_guest
* check team permission first
* update returned error
* update from review comments
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* update ArrayFromJSON to use LimitedReader
* update for bad merge
* fix lint errors
* update test code
* update unit tests
* update unit tests
* fix unit tests
* use consts, other cleanup
* add non sorting duplicate check
* set config to default value, then config setting if available
* fix lint errors
* fixes and debugs
* fix log test
* remove setting from Client, add unlimited Parser to client
* a couple more fixes
* another fix
* rename some variables
* remove superflous call
* check for valid MaximumPayloadSize
* update language file
* fix for e2e-tests
* update util function to return error
* lint fix
* update config property name to include unit
* fix for unit test
* add new config to telemetry
* call function to create LimitedReader
* Deprecate old function, use new function name
* return new AppError on failed parse
* return new AppError on failed parse
* return new AppError on failed parse
* add constant for i18n valid constants
* Update server/public/model/utils_test.go
Co-authored-by: Miguel de la Cruz <mgdelacroix@gmail.com>
* Apply suggestions from code review
Co-authored-by: Miguel de la Cruz <mgdelacroix@gmail.com>
* update error variable, remove unnecessary check
* Update function names
* fix errors from merge
* update unit test to create unique ids
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
Co-authored-by: Miguel de la Cruz <mgdelacroix@gmail.com>
It was a good decision in hindsight to keep the public module as 0.x
because this would have been a breaking change again.
https://mattermost.atlassian.net/browse/MM-53032
```release-note
Changed the Go module path from github.com/mattermost/mattermost-server/server/v8 to github.com/mattermost/mattermost/server/v8.
For the public facing module, it's path is also changed from github.com/mattermost/mattermost-server/server/public to github.com/mattermost/mattermost/server/public
```
