From 85fcdacee743f0001e013b8233656b446537c096 Mon Sep 17 00:00:00 2001
From: Kohei Adachi <KohheiAdachi@users.noreply.github.com>
Date: Wed, 1 Oct 2025 23:00:55 +0900
Subject: [PATCH] [GH-8911] Fix file upload request when CSRF protection is
 enabled (#8912)

* Fix file upload for csrf protection

* Fix use profile upload for csrf protection

* Fix tests

* Fix files.test.ts
---
 app/actions/remote/user.test.ts | 1 +
 app/actions/remote/user.ts      | 1 +
 app/client/rest/files.test.ts   | 2 ++
 app/client/rest/files.ts        | 1 +
 4 files changed, 5 insertions(+)

diff --git a/app/actions/remote/user.test.ts b/app/actions/remote/user.test.ts
index 4e910acdb..33c6611ad 100644
--- a/app/actions/remote/user.test.ts
+++ b/app/actions/remote/user.test.ts
@@ -58,6 +58,7 @@ const user1 = {id: 'userid1', username: 'user1', email: 'user1@mattermost.com',
 const user2 = {id: 'userid2', username: 'user2', email: 'user2@mattermost.com', roles: ''} as UserProfile;
 
 const mockClient = {
+    getRequestHeaders: jest.fn(() => ({})),
     getMe: jest.fn(() => ({id: 'userid1', username: 'user1', email: 'user1@mattermost.com', roles: ''})),
     getStatus: jest.fn((id: string) => ({user_id: id === 'me' ? 'userid1' : id, status: 'online'})),
     getProfilesInChannel: jest.fn(() => ([user1, user2])),
diff --git a/app/actions/remote/user.ts b/app/actions/remote/user.ts
index 6ca69769f..9d984c129 100644
--- a/app/actions/remote/user.ts
+++ b/app/actions/remote/user.ts
@@ -774,6 +774,7 @@ export const uploadUserProfileImage = async (serverUrl: string, localPath: strin
                 multipart: {
                     fileKey: 'image',
                 },
+                headers: client.getRequestHeaders('POST'),
             });
         }
         return {};
diff --git a/app/client/rest/files.test.ts b/app/client/rest/files.test.ts
index 0bd4f48ca..bf4c6dda7 100644
--- a/app/client/rest/files.test.ts
+++ b/app/client/rest/files.test.ts
@@ -87,6 +87,7 @@ test('uploadAttachment', () => {
             },
         },
         timeoutInterval: 180000,
+        headers: {Accept: 'application/json'},
     };
 
     (client.apiClient.upload as jest.Mock).mockReturnValue({
@@ -110,6 +111,7 @@ test('uploadAttachment', () => {
             },
         },
         timeoutInterval: 180000,
+        headers: {Accept: 'application/json'},
     };
     client.uploadAttachment(file, channelId, onProgress, onComplete, onError);
     expect(client.apiClient.upload).toHaveBeenCalledWith(client.getFilesRoute(), file.localPath, expectedDefaultOptions);
diff --git a/app/client/rest/files.ts b/app/client/rest/files.ts
index a5608f800..6d8af553a 100644
--- a/app/client/rest/files.ts
+++ b/app/client/rest/files.ts
@@ -81,6 +81,7 @@ const ClientFiles = <TBase extends Constructor<ClientBase>>(superclass: TBase) =
                 },
             },
             timeoutInterval: toMilliseconds({minutes: 3}),
+            headers: this.getRequestHeaders('POST'),
         };
         if (!file.localPath) {
             throw new Error('file does not have local path defined');