fix(history): handle sanitization when fetching versions

packages/core/content-manager/admin/src/history/components/VersionInputRenderer.tsx

@@ -59,16 +59,28 @@ const LinkEllipsis = styled(Link)`
 
 const CustomRelationInput = (props: RelationsFieldProps) => {
   const { formatMessage } = useIntl();
-  const field = useField<{ results: RelationResult[]; meta: { missingCount: number } }>(props.name);
-  const { results, meta } = field.value!;
+  const field = useField<
+    { results: RelationResult[]; meta: { missingCount: number } } | RelationResult[]
+  >(props.name);
+
+  const fieldValue = field.value!;
+
+  const res = Array.isArray(fieldValue)
+    ? {
+        results: fieldValue,
+        meta: { missingCount: 0 },
+      }
+    : fieldValue;
+
+  const { results, meta } = res;
 
   return (
     <Box>
       <FieldLabel>{props.label}</FieldLabel>
       {results.length > 0 && (
         <Flex direction="column" gap={2} marginTop={1} alignItems="stretch">
           {results.map((relationData) => {
-            // @ts-expect-error – targetModel does exist on the attribute. But it's not typed.
+            // @ts-expect-error - targetModel does exist on the attribute. But it's not typed.
             const href = `../${COLLECTION_TYPES}/${props.attribute.targetModel}/${relationData.documentId}`;
             const label = getRelationLabel(relationData, props.mainField);
 

packages/core/content-manager/server/src/history/controllers/history-version.ts

@@ -1,4 +1,4 @@
-import { errors } from '@strapi/utils';
+import { async, errors } from '@strapi/utils';
 import type { Core, UID } from '@strapi/types';
 import { getService as getContentManagerService } from '../../utils';
 import { getService } from '../utils';
@@ -68,13 +68,18 @@ const createHistoryVersionController = ({ strapi }: { strapi: Core.Strapi }) =>
         ...getValidPagination({ page: params.page, pageSize: params.pageSize }),
       });
 
+      const sanitizedResults = await async.map(results, async (version: any) => {
+        return {
+          ...version,
+          data: await permissionChecker.sanitizeOutput({
+            ...version.data,
+            locale: version.locale.code,
+          }),
+        };
+      });
+
       return {
-        data: await Promise.all(
-          results.map(async (result) => ({
-            ...result,
-            data: await permissionChecker.sanitizeOutput(result.data),
-          }))
-        ),
+        data: sanitizedResults,
         meta: { pagination },
       };
     },

packages/core/content-manager/server/src/history/services/history.ts

@@ -354,9 +354,43 @@ const createHistoryService = ({ strapi }: { strapi: Core.Strapi }) => {
       ): Promise<CreateHistoryVersion['data']> => {
         const entryWithRelations = await Object.entries(entry.schema).reduce(
           async (currentDataWithRelations, [attributeKey, attributeSchema]) => {
+            /**
+             * Don't build the relations response object for relations to admin users,
+             * because it breaks the pickAllowedAdminUserFields sanitization, as it looks for the
+             */
+            if (
+              attributeSchema.type === 'relation' &&
+              attributeSchema.relation !== 'morphToOne' &&
+              attributeSchema.relation !== 'morphToMany' &&
+              attributeSchema.target === 'admin::user'
+            ) {
+              const attributeValue = entry.data[attributeKey];
+              const attributeValues = Array.isArray(attributeValue)
+                ? attributeValue
+                : [attributeValue];
+
+              return {
+                ...(await currentDataWithRelations),
+                [attributeKey]: (
+                  await Promise.all(
+                    attributeValues.map((userToPopulate) => {
+                      if (userToPopulate == null) {
+                        return null;
+                      }
+
+                      return strapi
+                        .query('admin::user')
+                        .findOne({ where: { id: userToPopulate.id } });
+                    })
+                  )
+                ).filter((user) => user != null),
+              };
+            }
+
             // TODO: handle relations that are inside components
             if (['relation', 'media'].includes(attributeSchema.type)) {
               const attributeValue = entry.data[attributeKey];
+
               const relationResponse = await buildRelationReponse(
                 (Array.isArray(attributeValue)
                   ? attributeValue