1435 Коммитов

Автор SHA1 Сообщение Дата
Rajat Dabade
707f7ba42b Cherry-pick PR for guest-user-file-upload-permission for release-10.11 (#35073)
Automatic Merge
2026-01-27 14:53:28 +02:00
Alejandro García Montoro
0655a63354 Check password length (#35062)
Automatic Merge
2026-01-27 08:53:29 +02:00
Christopher Poile
51f2e2fdd5 Manual cherrypick MM-67055: Fix permalink embeds in ws msg (#34893) (#35059)
Automatic Merge
2026-01-26 19:23:30 +02:00
Daniel Espino García
21a86506f9 Manual Cherrypick: Add audits for accessing posts without membership (#31266) (#35022)
Automatic Merge
2026-01-26 12:23:28 +02:00
Rajat Dabade
4b8b1e5ca0 Cherry picker search-api-filter-guest-permission to release-10.11 (#35018)
Automatic Merge
2026-01-22 12:18:51 +02:00
Mattermost Build
3b1b8d9114 Automated cherry pick of #34693 (#34972)
Automatic Merge
2026-01-22 07:18:51 +02:00
Pablo Vélez
43e797010b MM-66092 - enhance user permissions data structure validations (#34654) (#35006)
Automatic Merge
2026-01-21 12:48:52 +02:00
Christopher Poile
ebe1bd4e31 MM-67077: Remove PSD file previews (#34898) (#35000)
Automatic Merge
2026-01-21 12:18:54 +02:00
Mattermost Build
17635d33d8 MM-67049: Fix unauthorized access to public channels in private teams (#34886) (#34994)
Automatic Merge
2026-01-20 13:54:38 +02:00
Mattermost Build
06c6ee2566 [MM-66789] Restrict ImportSettings.Directory changes via API and add validation (#34653) (#34987)
Automatic Merge
2026-01-20 12:54:28 +02:00
Mattermost Build
ba27ba1f8c Automated cherry pick of #34715 (#34849)
Automatic Merge
2026-01-12 19:47:30 +02:00
M-ZubairAhmed
d6d3d5447e Cherry pick of #34679 (#34880)
Automatic Merge
2026-01-08 16:17:31 +02:00
Mattermost Build
fc8b22242d Automated cherry pick of #34441 (#34848)
Automatic Merge
2026-01-07 14:17:32 +02:00
Jesse Hallam
a07b1d7a8c MM-66424: Improve team filtering in common teams API (#34454) (#34854)
Cherry-pick 6404ab29acc04901c5cb1cf5ad97fc3c0693e2cd into release-10.11
2026-01-06 12:50:30 -04:00
Jesse Hallam
989f3a36dc MM-66757: Improve WebSocket user update events (#34600) (#34856)
* improve TestUserUpdateEvents

* improve CheckUserSanitization

* check user sanitization in TestUserUpdateEvents

* minimally sanitize user sent to event creator
2026-01-06 11:22:05 -05:00
Jesse Hallam
c9d60357db MM-65575: Fix server panic when bot posts trigger persistent notifications (#34174) (#34778)
* reproduce panic with test

* allow bots in the profile map

* explicitly prevent sending notifications to bots

* persistent notifications: handle senders not in the channel
2025-12-17 15:06:57 +00:00
Mattermost Build
46b5c436bb MM-66372: Improve OAuth state token validation (#34296) (#34300) 2025-10-28 00:46:33 +00:00
Mattermost Build
f361e7d75a Automated cherry pick of #34247 (#34257)
Automatic Merge
2025-10-27 12:59:15 +02:00
Ibrahim Serdar Acikgoz
9f54e5cdc3 [MM-65684] Sanitize teams for /api/v4/channels/{channel_id}/common_teams endpoint (#34110) (#34182) 2025-10-17 16:55:42 +03:00
Mattermost Build
83a5be3f9e MM-65743: Sanitize in email verification endpoint (#33914) (#34121)
(cherry picked from commit 057efca74ee29862bca6ef6336bfbf3456f65bf6)

Co-authored-by: Jesse Hallam <jesse.hallam@gmail.com>
2025-10-13 06:38:25 +00:00
JG Heithcock
375ce229f4 MM 65084 server-side (#33861) (#34006) (#34044)
* MM 65084 server-side (#33861) (#34006)

Automatic Merge

* Add ConsumeOnce method to store layers

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2025-10-06 15:20:08 -07:00
Jesse Hallam
9dd2c6f54f [MM-65837], [MM-65824] - Update Dependencies (#33972) (#34052)
* Update github.com/mholt/archives

* Update github.com/spf13/viper

* make batch migration worker tests less flaky

---------

Co-authored-by: Eva Sarafianou <eva.sarafianou@gmail.com>
2025-10-03 11:12:25 -03:00
Mattermost Build
fcd316844e Improve self checks when adding a new channel member (#33404) (#33925)
Automatic Merge
2025-09-18 10:19:15 +03:00
Mattermost Build
98acefe911 Sanatize LastViewedAt and LastUpdateAt for other users on channel member object (#33835) (#33905)
Automatic Merge
2025-09-16 13:19:10 +03:00
Mattermost Build
27fadafead Constant time comparison (#33588) (#33822)
Automatic Merge
2025-09-01 16:34:06 +03:00
Mattermost Build
ef896a4ea6 Mm 64925 - prevent slack import email auto validation for non admin users (#33609) (#33779)
Automatic Merge
2025-08-22 12:34:05 +03:00
Mattermost Build
e8c7e7d025 [MM-64453] Guest shouldn't discover public channels that they are not member of (#31327) (#33778)
Automatic Merge
2025-08-22 12:04:05 +03:00
Mattermost Build
24c4a3677b [MM-64445] api4/channels_test: Add tests cases for guest user private channels (#31319) (#33776)
Automatic Merge
2025-08-22 11:34:05 +03:00
Mattermost Build
2d5cdc6e21 [MM-64896][MM-64898] Pass inviteid/tokenid to relay state/props for external auth when auto-joining a team (#33545) (#33666)
Automatic Merge
2025-08-13 13:04:00 +03:00
Mattermost Build
e14175eb65 [MM-65015] Restore Mobile redirection on oauth login (#33626) (#33633) 2025-08-07 17:47:01 +00:00
Mattermost Build
8f6b6f1d0d [MM-64911] Ensure redirect URL is validated before redirecting (#33559) (#33596)
Automatic Merge
2025-07-31 09:34:00 +03:00
Mattermost Build
38208b8f06 MM-64755: Fix redirect in oauth login (#33388) (#33569)
Automatic Merge
2025-07-28 09:33:59 +03:00
Mattermost Build
f21005e359 Add URL validation to LinkMetadata cache and store (#31814) (#33453)
Automatic Merge
2025-07-17 20:58:42 +03:00
Mattermost Build
2fceeceba6 MM-64675: Enable modification of plugin settings in local mode (#33376) (#33452)
Automatic Merge
2025-07-17 20:28:42 +03:00
Mattermost Build
07a34f02b6 MM-64531: [Shared Channels] Users on different remote servers should not communicate unless the remotes have established secure connection. (#30985) (#33434)
Automatic Merge
2025-07-15 11:58:41 +03:00
Mattermost Build
7f4fbd803a MM-62745: [Shared Channels] Fix duplicate mentioning - local user with the same username as someone on the remote server - Part2 (#32101) (#33414)
Automatic Merge
2025-07-14 19:28:42 +03:00
Agniva De Sarker
c4dde3d0ab MM-64632: Fix a panic in bulk import (#33360)
We were incorrect de-referencing the channels slice
without checking for nil pointer first.

https://mattermost.atlassian.net/browse/MM-64632
```release-note
NONE
```
2025-07-09 09:37:36 +05:30
Harrison Healey
ad38971dd6 MM-64658 Fix handling of upload sessions (#32141)
* MM-64658 Fix handling of upload sessions

* Fix style issue
2025-07-08 16:46:00 +00:00
Harrison Healey
4b77485e8f MM-64718 Improve validation of thread follower imports (#33287)
* MM-64718 Improve validation of thread follower imports

* Add additional test cases and restucture tests
2025-07-08 11:57:48 -04:00
Jesse Hallam
d2188ce1dd remove spurious user limits log (#33038)
Only log a warning when the created user exceeds the `MaxUserLimits` if
`MaxUsersLimit > 0`. This was showing up spuriously on licensed servers
for which no limit applied.

Note that this is distinct from blocking user creation past
`MaxHardUsersLimit`.
2025-07-02 13:29:48 -03:00
Jesse Hallam
ebe03c1d45 Channel Store: No SELECT * (#32167)
* Replace SELECT * with explicit column lists in channel store

Migrates channel_store.go away from SELECT * patterns to explicit column
lists for better performance, maintainability, and schema safety.

- Replace GetPinnedPosts raw SQL with query builder using postSliceColumns()
- Replace "cc.*" in group channel search with channelSliceColumns()
- Replace GetChannelsBatchForIndexing raw SQL with query builder
- Replace channel member and team queries with respective column helpers
- Use SelectBuilder helper instead of manual ToSql() calls

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Replace SELECT * with COUNT(*) in user_test.go

Replaces unnecessary SELECT * queries with SELECT COUNT(*) in
TestPermanentDeleteUser bot count verification. Only needs to check
the count of bots, not retrieve full bot records.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>
2025-07-02 15:35:54 +00:00
Pablo Vélez
e99aa4e430 MM-64428 - user tag invite filtering (#31226)
* MM-64428 - user tag invite filtering

* fix lint issues

* remove unnecesary line

* update translations and skip mysql tests

* simplify the solution so in abac channels the invitation link is never shown

* finish clean up of unnecessary code

* clean up and remove no longer necessary translations

* remove leftover props and remove no longer needed tests after simplification

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2025-07-02 14:55:02 +02:00
Ibrahim Serdar Acikgoz
0809ce7a62 [MM-64630] Fix an issue where multiple channels can't be removed from policies (#32164)
* Fix an issue where multiple channels can't be removed from policies

* actually fix the issue

* use hardcoded limit

* simplify removal
2025-07-01 20:48:57 +02:00
Miguel de la Cruz
d8758f8984 Improve response on team restore (#32118)
Co-authored-by: Miguel de la Cruz <miguel@ctrlz.es>
Co-authored-by: Mattermost Build <build@mattermost.com>
2025-07-01 16:54:30 +00:00
Daniel Espino García
1b7d27707d Fix MM64178 (#30957)
Co-authored-by: Mattermost Build <build@mattermost.com>
2025-06-30 16:43:59 -05:00
catalintomai
2b8f7743b6 MM-64687: Racy tests in TestSharedChannelPostMetadataSync (#32144) 2025-06-27 09:11:54 +02:00
Nick Misasi
9e7849647c [CLD-9238] Direct preview user to proper team based on use case (#31784)
* Remove pricing modal. Adjust everywhere to instead open mattermost.com/pricing. When air gapped, don't show buttons to view plans.

* Fix lint

* Further clean up of unused code. Fixes for linter

* Remove onboarding tasklist for previews, add Cloud previer banner

* Fixes for linter, i18n

* Revert dev lines

* Fix lint

* When below one minute, switch to seconds

* fix linter

* Add scaffolding for new Cloud Preview Modal

* Style updates

* Fix tests

* fixes for PR feedback

* useExternalLink for opening pricing modal with enriched params

* Fix i17n

* fix style

* Fix style, tests

* Fix linter, types

* Add file

* Make types even more fixed

* fix: correct test case for SKU label not provided scenario

The test "should not render SKU label when not provided" was incorrectly using baseContent which includes a SKU label. Fixed by creating contentWithoutSku that explicitly sets skuLabel to undefined to properly test the scenario where no SKU label is provided.

Co-authored-by: Nick Misasi <nickmisasi@users.noreply.github.com>

* Fine I'll do it myself

* fix linter

* Refactors

* Adjustments from PR review. Adjustments to video experience (poster/play button) and starting to translate

* Fix i18n

* Accept use case in CWS login, redirect to proper team, with filtered content in preview modal

* Wrap translation strings with defineMessage for i18n extraction

- Add import for defineMessage and MessageDescriptor from react-intl
- Update type definition to use MessageDescriptor for better type safety  
- Wrap all skuLabel, title, and subtitle objects with defineMessage() calls
- This ensures the i18n-extract tool can properly detect translation strings

Co-authored-by: Nick Misasi <nickmisasi@users.noreply.github.com>

* Fix i18n

* Hiding modal will presist through refreshes

* Fix linter

* Add exception to notification permission bar for cloud previews

* Use regular modal close button

* Fix pipelines

* Fix i18n

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_content.scss

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_content.scss

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_content.scss

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_content.tsx

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_content.scss

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_content.scss

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_controller.tsx

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_controller.tsx

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_controller.scss

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_controller.tsx

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_controller.tsx

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_controller.tsx

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_controller.tsx

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_controller.scss

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_controller.scss

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_content.scss

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_content.scss

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_content.scss

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_content.scss

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_content.scss

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Update webapp/channels/src/components/cloud_preview_modal/preview_modal_content.scss

Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>

* Remove unnecessary CSS properties from preview modal content

Remove display: flex, height: 100%, and flex-direction: column from .preview-modal-content selector as they have no effect per code review feedback.

Co-authored-by: Nick Misasi <nickmisasi@users.noreply.github.com>

* feat: use getBool selector instead of get for boolean preference check

- Replace getPreference with getBool to avoid explicit === 'true' comparison
- Follows Harrison's review suggestion for cleaner boolean handling

Co-authored-by: Nick Misasi <nickmisasi@users.noreply.github.com>

* fix linter

* Fixes for PR review

* Fix linter

* Fix i18n

* fix linter

* Changes to address Harrison's feedback

* Change file name, remove index.tsx

* change file name, remove index.tsx

* Add the new files

---------

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Nick Misasi <nickmisasi@users.noreply.github.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>
2025-06-26 20:30:26 -04:00
Miguel de la Cruz
d042d242dd Use master to fetch user profiles when creating a GM (#32152)
Co-authored-by: Miguel de la Cruz <miguel@ctrlz.es>
2025-06-26 13:47:29 +00:00
Miguel de la Cruz
0704500609 Update shared channel app layer to make active check optional (#29602)
The `getSharedChannelsService` method was checking as well for the
Shared Channels to be active, which only the lead node of a cluster
is, so API operations that should run correctly like sharing/unsharing
a channel or inviting/uninviting a remote were returning a 400 bad
request.

This change updates the method to check for the Shared Channel service
to be active only on request, and on doing so it changes the error and
status code returned to indicate specifically that the service is
running but inactive, and returns a 500 as the situation is not an
error on the requester.

Co-authored-by: Mattermost Build <build@mattermost.com>
2025-06-26 10:54:17 +00:00
Miguel de la Cruz
d9a083dc82 Use master to get remotes to avoid race conditions in cloud (#31221)
Co-authored-by: Miguel de la Cruz <miguel@ctrlz.es>
2025-06-26 12:52:02 +02:00