* fix: ensuring that webapp and mobile notifications decode special characters
* fix: linter error
* Replacing anonymous function with existing utility to escape regex
* Added missing characters to webapp handling, excluded markdown renderer from being affected
- Added tests that explicitly check for script injection
Instead of wiring the unused ExperimentalAuditSettings fields
(FileMaxSizeMB, FileMaxAgeDays, FileMaxBackups, FileCompress,
FileMaxQueueSize) to the logger, remove them entirely. The simple
audit config uses hardcoded defaults via makeSimpleFileTarget, and
users who need fine-grained control can use AdvancedLoggingJSON.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* MM-66909 - Fix BoR sender not seeing priority label on new post
* Use RequestContextWithMaster for BoR priority fetching
* fix linter
* Add BoR post priority unit test
* unique error code and remove webapp workaround
* fix translation
* remove unnecessary line
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* Respect user display preferences for date and time formatting
User Preference Support:
- Read isUseMilitaryTime preference from user settings
- Apply 24-hour format when enabled (14:00 instead of 2:00 PM)
- Apply 12-hour format when disabled (2:00 PM instead of 14:00)
- Pass useTime prop to Timestamp component with correct hourCycle/hour12
Date Formatting Consistency:
- Create formatDateForDisplay() utility in date_utils.ts
- Centralize date formatting logic (month: 'short', day/year: 'numeric')
- Use consistent "Jan 15, 2025" format across all date/datetime fields
- Replace DateTime.fromJSDate().toLocaleString() which varies by browser
Components Updated:
- DateTimeInput: Use isMilitaryTime for dropdown and selected time display
- DateTimeInput: Use formatDateForDisplay for date display
- AppsFormDateField: Use formatDateForDisplay instead of inline Intl code
Tests Added:
- 4 tests for user preference handling (military time, locale)
- 5 tests for formatDateForDisplay utility
- Updated snapshot for Timestamp changes
Benefits:
- Single source of truth for date formatting
- Easy to change format globally by updating one function
- Respects user preferences consistently
- Fixes inconsistency where datetime showed "1/1/2026" vs date showing "Jan 1, 2026"
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* Add timezone and manual time entry support for datetime fields
Object Model:
- Create DialogDateTimeConfig with TimeInterval, LocationTimezone, AllowManualTimeEntry
- Add DateTimeConfig field to DialogElement
- Keep legacy MinDate, MaxDate, TimeInterval for fallback
Timezone Support (location_timezone):
- Display datetime in specific IANA timezone (e.g., "Europe/London", "Asia/Tokyo")
- Show timezone indicator: "🌍 Times in GMT"
- Preserve timezone through all operations
- Fix momentToString to clone before converting to UTC (prevents mutation)
- Use moment.tz array syntax for timezone-safe moment creation
- Generate time intervals starting at midnight in display timezone
Manual Time Entry (allow_manual_time_entry):
- Add parseTimeString() function supporting multiple formats:
- 12-hour: 12a, 12:30p, 3:45pm
- 24-hour: 14:30, 9:15
- Add TimeInputManual component with text input
- Conditional rendering: manual input OR dropdown
- No rounding for manual entry (exact minutes preserved)
- No auto-advance (validation only, show error for invalid format)
- Respects user's 12h/24h preference for placeholder
Critical Bug Fixes:
- Fix getTimeInIntervals to return Moment[] instead of Date[] (preserves timezone)
- Fix momentToString mutation: use .clone() before .utc()
- Use .clone() when calling .startOf('day') to preserve timezone
- Use moment.tz([...], timezone) array syntax instead of .tz().hour() mutation
- Display selected time using .format() instead of Timestamp component
- Fix null handling: optional fields start empty, show '--:--'
- Manual entry gets exact current time, dropdown gets rounded time
Component Updates:
- DateTimeInput: Add TimeInputManual component, parseTimeString, timezone handling
- AppsFormDateTimeField: Extract config, timezone indicator, pass timezone to child
- Modal components: Handle Moment | null signatures
- CSS: Add manual entry input styles with error states
Features:
- Timezone-aware time generation (dropdown starts at midnight in display TZ)
- Manual entry works with timezones (creates moments in correct TZ)
- Optional fields start empty (null value, no display default)
- Required datetime fields get rounded default from apps_form_component
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* Fix momentToString mutation - clone before converting to UTC
Prevents .utc() from mutating the original moment object.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* Add E2E test for 12h/24h time preference support
Test MM-T2530H verifies that datetime fields respect user's display preference:
- Sets preference to 24-hour format
- Verifies dropdown shows times as 14:00, 15:00, etc.
- Verifies selected time displays in 24-hour format
- Changes preference to 12-hour format
- Verifies dropdown shows times as 2:00 PM, 3:00 PM, etc.
Uses cy.apiSaveClockDisplayModeTo24HourPreference() to set user preference.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* Auto-round time to interval boundaries in DateTimeInput
Automatically rounds displayed time to timePickerInterval to ensure
consistent behavior across all callers.
Problem:
- DND modal and Custom Status modal showed unrounded times (e.g., 13:47)
- Should show rounded times (e.g., 14:00) to match dropdown intervals
- Some callers pre-rounded, others didn't (inconsistent)
Solution:
- Add useEffect in DateTimeInput that auto-rounds on mount
- Only calls handleChange if time needs rounding
- Uses timePickerInterval prop or 30-minute default
- Harmless for callers that already pre-round (no change triggered)
Behavior:
- DND modal: Now shows 14:00 instead of 13:47
- Custom Status: Still works (already pre-rounded, so no-op)
- Post Reminder: Still works (already pre-rounded, so no-op)
- Interactive Dialog: Still works (uses custom intervals)
Added 3 unit tests for auto-rounding behavior.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* lint fix
* Add deferred login cleanup to post_test.go 'not logged in' test
Ensures the test helper is logged back in after the logout test completes, preventing test state issues for subsequent tests.
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* Add unit tests for parseTimeString and timezone handling
parseTimeString tests (9 test cases):
- 12-hour format with AM/PM (12a, 3:30pm, etc.)
- 24-hour format (14:30, 23:59, etc.)
- Time without minutes (defaults to :00)
- Invalid hours, minutes, and formats
- Edge cases (midnight 12:00am, noon 12:00pm)
Timezone handling tests (3 test cases):
- Preserve timezone in getTimeInIntervals
- Generate intervals starting at midnight in timezone
- Timezone conversion pattern verification
Total: 12 new tests added (32 total in file)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* Add E2E tests and webhook support for timezone/manual entry
E2E Tests Added (MM-T2530O through MM-T2530S):
- MM-T2530O: Manual time entry basic functionality
- MM-T2530P: Manual time entry multiple formats (12a, 14:30, 9pm)
- MM-T2530Q: Manual time entry invalid format handling
- MM-T2530R: Timezone support dropdown (London GMT)
- MM-T2530S: Timezone support manual entry (London GMT)
Webhook Server Support:
- Added getTimezoneManualDialog() to webhook_utils.js
- Added 'timezone-manual' case to webhook_serve.js
- Dialog with 3 fields: local manual, London dropdown, London manual
Bug Fixes:
- Skip auto-rounding for allowManualTimeEntry fields (preserve exact minutes)
- Generate dropdown options even when displayTime is null (use currentTime fallback)
- Scope Cypress selectors with .within() to avoid duplicate ID issues
All tests passing (13 total datetime tests).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* Fix ESLint no-multi-spaces in apps.ts
Remove extra spacing before comments to comply with ESLint rules.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* Fix gofmt formatting in integration_action.go
Align Options, MultiSelect, and Refresh field spacing to match Go formatting standards.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* more lint fixes
* css lint fix
* i18n-extract
* lint fixes
* update snapshot
* Fix modal scroll containment for datetime fields
The .modal-overflow class was applying overflow: visible to .modal-body,
which broke scroll containment when datetime fields were present. This
caused the entire form to scroll instead of scrolling within the modal-body
viewport.
Changes:
- Remove .modal-body overflow override from .modal-overflow class to
preserve scroll containment while still allowing date/time popups to
display correctly via z-index
- Remove italic styling from timezone indicator for cleaner appearance
- Remove redundant "Time" label from manual time entry input (aria-label
is sufficient for accessibility)
- Add CSS rule to ensure "(optional)" label text is not bold
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
* fixes for cypress tests
* fix for using timezone crossing dates
* fix dateonly strings parse failures
* regex fix
* linter fix
---------
Co-authored-by: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
* Add support for channel mentions in webhook attachments
Implement client-side channel mention rendering in incoming webhook
attachments. Channel mentions (~channel-name) now render as clickable
links in attachment content fields (pretext, text, field values) while
correctly remaining as plain text in title/label fields.
* feat: filewillbedonwloaded hook
* feat: error popup
* chore: make generated pluginapi
* tests
* feat: different errors for different download types
* feat: allow toast positions
* fix: avoid using deprecated i18n function
* feat: add plugin API to show toasts
* feat: downloadType parameter
* tests: updated tests
* chore: make check-style
* chore: i18n
* chore: missing fields in tests
* chore: sorted i18n for webapp
* chore: run mmjstool
* test: fixed webapp tests with new changes
* test: missing mocks
* fix: ensure one-file attachments (previews) are handler properly as thumbnails
* chore: lint
* test: added new logic to tests
* chore: lint
* Add SendToastMessage API and FileWillBeDownloaded hook
- Introduced SendToastMessage method for sending toast notifications to users with customizable options.
- Added FileWillBeDownloaded hook to handle file download requests, allowing plugins to control access to files.
- Updated related types and constants for file download handling.
- Enhanced PluginSettings to include HookTimeoutSeconds for better timeout management.
* Update webapp/channels/src/components/single_image_view/single_image_view.tsx
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* chore: copilot reviews
* test: head requests
* chore: linted the webapp
* tests: fixed path
* test: fixed mocked args
* allow sending message to a connection directly
* fix: hook thread safety
* chore: formatting
* chore: remove configuration from system console
* chore: release version
* chore: update signature
* chore: update release version
* chore: addressed comments
* fix: update file rejection handling to use 403 Forbidden status and include rejection reason header
* Fix nil pointer panic in runFileWillBeDownloadedHook
The atomic.Value in runFileWillBeDownloadedHook can be nil if no
plugins implement the FileWillBeDownloaded hook. This causes a panic
when trying to assert the nil interface to string.
This fix adds a nil check before the type assertion, defaulting to
an empty string (which allows the download) when no hooks have run.
Fixes:
- TestUploadDataMultipart/success panic
- TestUploadDataMultipart/resume_success panic
* test: move the logout test last
* chore: restored accidential deletion
* chore: lint
* chore: make generated
* refactor: move websocket events to new package
* chore: go vet
* chore: missing mock
* chore: revert incorrect fmt
* chore: import ordering
* chore: npm i18n-extract
* chore: update constants.tsx from master
* chore: make i18n-extract
* revert: conflict merge
* fix: add missing isFileRejected prop to SingleImageView tests
* fix: mock fetch in SingleImageView tests for async thumbnail check
The component now performs an async fetch to check thumbnail availability
before rendering. Tests need to mock fetch and use waitFor to handle
the async state updates.
* refactor: move hook logic to app layer
* chore: update version to 11.5
* Scope file download rejection toast to the requesting connection
Thread the Connection-Id header through RunFileWillBeDownloadedHook and
sendFileDownloadRejectedEvent so the WebSocket event is sent only to the
connection that initiated the download, instead of all connections for
the user.
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* MM-66813 - Add server origin verification to mobile SSO callbacks
* Enhance mobile SSO security and deprecate code-exchange
* Update code-exchange deprecation to follow MM standards
* Use config SiteURL for srv param, fix flow terminology
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
The generation of notice-file is failing with
```
2026/02/16 10:20:39 NPM load failed @mattermost/shared
2026/02/16 10:20:39 Error occured while generating notice.txt @mattermost/shared:http status code 404 when downloading "https://registry.npmjs.org/@mattermost/shared"
```
This relates with https://github.com/mattermost/mattermost/pull/35065 because
the package is still local and isn't yet published in npm
So, this is ignores the shared package while it isn't published.
* fix guest user import when guest user doesn't have any memberships
This PR fixes an issue where a guest user without channel or team memberships
is not being imported and the importer will then throw an error and abort.
Key changes:
1. Updated validateGuestRoles function to allow system guests without any teams/channels
2. Improved error handling with specific error messages for different validation failures
3. Updated tests to reflect new behavior allowing system guests with no team memberships
4. Added new i18n error messages for better user feedback
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Extract i18n strings and update English locale
- Ran 'make i18n-extract' to extract translation strings from source code
- Alphabetically sorted translation keys in server/i18n/en.json
- Moved guest user validation error messages to proper alphabetical positions
- Removed obsolete/unused translation entries for cleaner locale file
Co-authored-by: Jesse Hallam <lieut-data@users.noreply.github.com>
* Revert "Extract i18n strings and update English locale"
This reverts commit 9d3887cb2e.
* actually fix i18n, needs enterprise access
* add integration test for importing guest user without team/channel memberships
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Jesse Hallam <lieut-data@users.noreply.github.com>
Co-authored-by: Jesse Hallam <jesse@mattermost.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
The Active() check was incorrectly preventing the slash command from working on non-leader nodes in HA clusters. Active() only returns true on the cluster leader (which runs the sync loop), but slash commands can be routed to any node via the load balancer. A nil check is sufficient to verify the service is licensed and configured.
* MM-67312: Restrict Burn-on-Read for self DMs and bot users
* fix lint issues
* use utility function to make code more reliable
* add test case for deleted user and handle restrictively that scenario
* fix i18n
* Allow bots to send BoR; block only self-DMs & DMs with bots
* Refactor BoR validation to API layer with individual params
* adjust comment
* Fix BoR validation to fail-closed when context unavailable
* Fix variable shadowing in CreatePost burn-on-read validation
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* remove translation entry
* fix linter
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
Co-authored-by: Claude <noreply@anthropic.com>
* Draft changes for BoR post soft-deletion
* Handled the case for author's BoR post read receipt
* lint fix
* Updated text
* Updated tests
* review fixes
* review fixes
* Paginated and batched temperory post deletion
* Updated test
* unmocked store
* logged instead of erroring out
* i18n fix
* review fixes
* support for Elastic(Open)search CJK analysis plugins
* addresses PR review comments
* addresses PR comments
* moves CJK based tests to own file and adds some more
Dockerfile for open and elasticsearch are changed to install required
plugins for testing or running locally.
* properly sort error messages
* fix style issues
* removes trailing space
* Add default agent support and App Bar integration
- Add Agents section to App Bar, separating it from Core Products.
- Implement Default Agent logic in AtMentionProvider:
- Promote default agent to top of suggestions for empty '@' prefix.
- Filter duplicate agent entry from main list when default is shown.
- Add `AgentTag` component for UI distinction.
- Update `mattermost-plugin-ai` and `server/public` dependencies.
- Add unit tests for default agent suggestion logic.
* Add missing files (server deps, types)
* Fix pre-commit check failures
- Fix TypeScript errors in test files:
- Add missing displayName property to defaultAgent in at_mention_provider test
- Add missing fetchAgents mock in textbox test
- Fix Go assignment mismatch in integration_action_test.go (CreatePostAsUser returns 3 values)
- Fix license copyright year in plugins/mattermost-ai/assets/embed.go
- Update i18n translations (add tag.default.agent)
- Regenerate Go serialized files, mmctl docs, and update go.mod/go.sum
* Update snapshot tests for textbox and at_mention_suggestion
* Undo mmctl docs changes
* Undo more changes
* revert package-lock.json
* Update dep for ai plugin
* Update again
* Update at_mention_provider to filter out agent duplicates and add .cursor/ to gitignore
- Filter agent usernames from priorityProfiles and localAndRemoteMembers to prevent duplicate entries in autocomplete suggestions
- Add .cursor/ directory to .gitignore
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
* Include log viewer (system console) in log root path validation
* Add informative message to log viewer when no logs are displayed
-----
Co-authored-by: Mattermost Build <build@mattermost.com>
* add authentication status to audit log for logouts
* improve audit log testing for other tests
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* AutoTranslate config settings
* comment out Agents provider
* Add auto translate timeout config validation
* i18n messages for autotranslation config validation
* fix test
* validate url for libreTranslate
* Feedback review
* Admin Console UI for Auto-Translation
* fix admin console conditional section display
* i18n
* removed unintentional change
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* update admin.general.localization.autoTranslateProviderDescription newline
* fix lint
* Fix types
* UX feedback review
* fix typo in i18n
* Fix AutoTranslation feature flag
* feedback review
* Fix test default values
* feedback review
* re-add isHidden property to feature discovery
* Database Migrations, Indexes and Methods for Auto-Translation
* i18n
* fix retrylayer and storetest
* Fix search query
* fix lint
* remove the request.CTX and modify Translation model
* fix lint and external url
* Add settings to playwright
* Add empty as a valid value for the Provider
* Update jsonb queries
* Fix queries and add model methods
* fix go lint
* go lint fix 2
* fix db migrations
* feedback review + store cache
* increase migration number
* cleanup autotranslation store cache
* use NULL as objectType for posts
* fix bad merge
* fix tests
* add missing i18n
* Active WebSocket Connection User Tracking
* copilot feedback and fix styles
* remove duplicate calls
* remove early return to mitigate timing attacks
* Switch prop bags column to boolean
* fix lint
* fix tests
* Remove database search
* use Builder methods
* review feedback
* AutoTranslation interface with Core Translation Logic
* update timeouts to use short/medium/long translations
* external exports
* add configured languages to autotranslations
* added post prop for detected language
* fix bugs for storing translation and call translation service
* clean up interface
* add translations to GetPost repsonses and in the create post response
* use metadata for translation information and add new column for state of a translation
* change websocket event name
* change metadata to a map
* single in memory queue in the cluster leader
* remove unused definition
* Revert "remove unused definition"
This reverts commit e3e50cef30.
* remove webhub changes
* remove last webhub bit
* tidy up interface
* Frontend integration
* tidy up
* fix api response for translations
* Add Agents provider for auto translations (#34706)
* Add LLM backed autotranslation support
* Remove AU changes
* Remove orphaned tests for deleted GetActiveUserIDsForChannel
The GetActiveUserIDsForChannel function was removed from PlatformService
as part of the autotranslations refactoring, but its tests were left behind
causing linter/vet errors. This removes the orphaned test code:
- BenchmarkGetActiveUserIDsForChannel
- TestGetActiveUserIDsForChannel
- waitForActiveConnections helper
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Add missing i18n translations and fix linter errors
- Add 17 missing translation strings for autotranslation feature
- Fix shadow variable declarations in post.go and autotranslation.go
- Remove unused autoQueueMaxAge constant
- Remove unused setupWithFastIteration test function
- Use slices.Contains instead of manual loop
- Use maps.Copy instead of manual loop
- Remove empty if branch
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix tests
* Fixes for PR review
* add files
* Update webapp/channels/src/components/admin_console/localization/localization.scss
Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>
* fixes
* Fixes
* Didn't save
* Add a translation
* Fix translations
* Fix shadow err
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>
* tidy up code for review
* add support for editing posts
* i18n-extract
* i18n
* Rename show translations and add util to get message
* Fix get posts, migrations, websockets and configuration styles
* Fix CI
* i18n-extract
* Fix webapp tests
* Address UX feedback
* i18n-extract
* Fix lint
* updated shimmer animation, fixed issue with the width on compact icon buttons
* fix migrations
* fix markdown masking for bold, italics and strikethrough
* Address feedback
* Add missing changes
* Fix and add tests
* Fix circular dependencies
* lint
* lint
* lint and i18n
* Fix lint
* Fix i18n
* Minor changes
* Add check for whether the channel is translated or not for this user
* Fix lint and add missing change
* Fix lint
* Fix test
* Remove uneeded console log
* Fix duplicated code
* Fix small screen show translation modal
* Remove interactions on show translation modal
* Disable auto translation when the language is not supported
* Fix typo
* Fix copy text
* Fix updating autotranslation for normal users
* Fix autotranslate button showing when it shouldn't
* Fix styles
* Fix test
* Fix frontend member related changes
* Revert post improvements and remove duplicated code from bad merge
* Address feedback
* Fix test and i18n
* Fix e2e tests
* Revert lingering change from post improvements
* Fix lint
---------
Co-authored-by: Elias Nahum <nahumhbl@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: BenCookie95 <benkcooke@gmail.com>
Co-authored-by: Nick Misasi <nick.misasi@mattermost.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
* rebased all prev commits into one (see commit desc)
add UsePreferredUsername support to gitlab; tests
resort en.json
update an out of date comment
webapp i18n
simplify username logic
new arguments needed in tests
debug statements -- revert
* merge conflicts
* fix i18n
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* MM-67372: Filter SVG images from OpenGraph metadata to prevent DoS
This commit adds server-side filtering of SVG images from OpenGraph
metadata to mitigate a DoS vulnerability where malicious SVG images
in og:image tags can crash Chromium-based browsers and Safari.
Changes:
- Add IsSVGImageURL() helper function in model package to detect SVG URLs
- Filter SVG images in parseOpenGraphMetadata() for regular HTML pages
- Filter SVG images in parseOpenGraphFromOEmbed() for oEmbed responses
- Add defense-in-depth filtering in TruncateOpenGraph() and getImagesForPost()
- Add comprehensive tests for all SVG filtering functionality
SVG detection is based on:
- File extension (.svg, .svgz) - case-insensitive
- MIME type (image/svg+xml)
Reference: https://issues.chromium.org/issues/40057345
* MM-67372: Filter SVG images from cache/DB and direct SVG URLs
This commit addresses remaining attack vectors for the SVG DoS vulnerability:
1. Cache/DB filtering: Apply TruncateOpenGraph when returning OpenGraph
from cache or database to filter stale data that was stored before
the initial fix was deployed.
2. Direct SVG URLs: Filter PostImage entries with Format="svg" to prevent
browser crashes when someone posts a direct link to an SVG file.
3. Embed creation: Skip creating image embeds for SVG images and create
link embeds instead.
4. New SVG detection: Return nil instead of creating PostImage when
fetching direct SVG URLs to prevent storing them in the database.
These changes ensure that even environments with pre-existing malicious
link metadata will be protected after a server restart.
* MM-67372: Fix test expectation for SVG image handling
* Removed duplicate logic in favor of already implemented FilterSVGImages in model
* Addressing PR comments
* Replacing exact match comparison with prefix check
* Added new test cases for unit tests
The reliance on ViewUsersRestrictions was causing a SQL bug, since the
original query did not join with the Users table. Instead, use
model.GroupSearchOpts to rely on AllowReference, which should be used to
filter the results in all cases, except when the user is a sysadmin (has
the PermissionSysconsoleReadUserManagementGroups permission).
Co-authored-by: Mattermost Build <build@mattermost.com>
Updates all Custom Profile Attribute endpoints and app layer methods to pass caller user IDs through to the PropertyAccessService. This connects the access control service introduced in #34812 to the REST API, Plugin API, and internal app operations.
Also updates the OpenAPI spec to document the new field attributes (protected, source_plugin_id, access_mode) and adds notes about protected field restrictions.
Custom profile attributes (properties) in Mattermost need to support security-critical use cases like Attribute-Based Access Control (ABAC), external identity system synchronization, and privacy-preserving collaboration. Without access controls on these properties, any user or component could modify property fields and values, making them unsuitable for security decisions. Additionally, different properties require different visibility patterns - some need to be publicly readable, some should only be visible to their managing system, and some require privacy-preserving visibility where users can only see shared values.
This change introduces the PropertyAccessService, a wrapper around PropertyService that enforces access control for all property operations. This service is introduced in isolation and is not yet hooked up to the Plugin API, REST API, or app layer. It provides the foundation for a single enforcement point that will apply access restrictions consistently across all code paths once integrated.
Ben Schumacher