Merge 4f7e933 into 71e6a42

api/channel.go

@@ -739,6 +739,10 @@ func autocompleteChannels(c *Context, w http.ResponseWriter, r *http.Request) {
 
 func viewChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 	view := model.ChannelViewFromJson(r.Body)
+	if view == nil {
+		c.SetInvalidParam("viewChannel", "channel_view")
+		return
+	}
 
 	if err := app.ViewChannel(view, c.Session.UserId, !c.Session.IsMobileApp()); err != nil {
 		c.Err = err

api/channel_test.go

@@ -863,7 +863,6 @@ func TestGetChannel(t *testing.T) {
 	if _, err := Client.GetChannels(""); err == nil {
 		t.Fatal("should have failed - wrong team id")
 	}
-
 }
 
 func TestGetMoreChannelsPage(t *testing.T) {
@@ -1963,6 +1962,10 @@ func TestViewChannel(t *testing.T) {
 		t.Log(rdata.Member.MsgCount)
 		t.Fatal("message counts don't match")
 	}
+
+	if _, err := Client.DoApiPost(Client.GetTeamRoute()+"/channels/view", "garbage"); err == nil {
+		t.Fatal("should have been an error")
+	}
 }
 
 func TestGetChannelMembersByIds(t *testing.T) {

api4/channel_test.go

@@ -4,6 +4,7 @@
 package api4
 
 import (
+	"fmt"
 	"net/http"
 	"strconv"
 	"testing"
@@ -504,6 +505,16 @@ func TestViewChannel(t *testing.T) {
 	_, resp = Client.ViewChannel(th.BasicUser2.Id, view)
 	CheckForbiddenStatus(t, resp)
 
+	if r, err := Client.DoApiPost(fmt.Sprintf("/channels/members/%v/view", th.BasicUser.Id), "garbage"); err == nil {
+		t.Fatal("should have errored")
+	} else {
+		if r.StatusCode != http.StatusBadRequest {
+			t.Log("actual: " + strconv.Itoa(r.StatusCode))
+			t.Log("expected: " + strconv.Itoa(http.StatusBadRequest))
+			t.Fatal("wrong status code")
+		}
+	}
+
 	Client.Logout()
 	_, resp = Client.ViewChannel(th.BasicUser.Id, view)
 	CheckUnauthorizedStatus(t, resp)

webapp/stores/post_store.jsx

@@ -99,11 +99,11 @@ class PostStoreClass extends EventEmitter {
             return null;
         }
 
-        const posts = postInfo.postList;
+        const postList = postInfo.postList;
         let post = null;
 
-        if (posts.posts.hasOwnProperty(postId)) {
-            post = posts.posts[postId];
+        if (postList && postList.posts && postList.posts.hasOwnProperty(postId)) {
+            post = postList.posts[postId];
         }
 
         return post;