Users can't access Administration >> Users page - returns error:"Invalid attribute"

Description:

User without permission: "View Full Other User Info" can't access "Users Administration panel"
Error message: "Invalid attribute"
The user has permission: "View User Administration" enabled.

This problem started from rocketchat server version 4.8.0 and above. version 4.6.x works fine. (did not update to version 4.7.x)

Steps to reproduce:

1. User with "View User Administration" and without "View Full Other User Info" permissions goes to Administration >> Users

If the user gets "View Full Other User Info" permission. No error will be returned. when removing this permission again. The error returns.

Expected behavior:

User with "View User Administration" permission can enter Administration >> Users page without seeing all user info.

Actual behavior:

Error return. Users with "View User Administration" and without "View Full Other User Info" permission can't enter Administration >> Users page and edit/remove/deactivate users if needed.

Server Setup Information:

• 5.0.0
• Ubuntu 20.04 LTS
• Deployment Method: Docker
• Number of Running Instances: 1
• NodeJS Version: v14.19.3
• MongoDB Version: 4.4.10 / wiredTiger (oplog Enabled)

Client Setup Information

• Desktop App v3.8.7
• Browser Version: Chrome 103.0.5060.134
• Operating System: windows

Relevant logs:

{"level":35,"time":"2022-07-31T19:10:51.528Z","pid":10,"hostname":"meep","name":"API","method":"GET","url":"/api/v1/users.list?count=25&fields=%7B%22name%22%3A1%2C%22username%22%3A1%2C%22emails%22%3A1%2C%22roles%22%3A1%2C%22status%22%3A1%2C%22avatarETag%22%3A1%2C%22active%22%3A1%7D&offset=0&query=%7B%22%24or%22%3A%5B%7B%22emails.address%22%3A%7B%22%24regex%22%3A%22%22%2C%22%24options%22%3A%22i%22%7D%7D%2C%7B%22username%22%3A%7B%22%24regex%22%3A%22%22%2C%22%24options%22%3A%22i%22%7D%7D%2C%7B%22name%22%3A%7B%22%24regex%22%3A%22%22%2C%22%24options%22%3A%22i%22%7D%7D%5D%7D&sort=%7B%20%22name%22%3A%201%20%7D","userId":"meep","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36","host":"some.url","referer":"https://some.url/admin/users","remoteIP":"1.2.3.4","err":{"type":"errorClass","message":"Invalid attribute: emails.address [error-invalid-query]","stack":"Error: Invalid attribute: emails.address [error-invalid-query]<br> at app/api/server/v1/users.ts:422:11<br> at /app/bundle/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/fiber_pool.js:43:40<br> => awaited here:<br> at Function.Promise.await (/app/bundle/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/promise_server.js:56:12)<br> at app/api/server/api.js:459:75<br> at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1257:12)<br> at Object._internalRouteActionHandler [as action] (app/api/server/api.js:459:39)<br> at Route._callEndpoint (packages/rocketchat_restivus/lib/route.coffee:150:32)<br> at packages/rocketchat_restivus/lib/route.coffee:59:33<br> at packages/simple_json-routes.js:100:9","isClientSafe":true,"error":"error-invalid-query","reason":"Invalid attribute: emails.address","errorType":"Meteor.Error"},"status":400,"responseTime":8,"msg":"Invalid attribute: emails.address [error-invalid-query]"}

Start with the /api/v1/users.list request and app/api/server/v1/users.ts around line 422, using the reported permissions and query fields to reproduce the error. Verify the Administration > Users page works for a user with View User Administration but without View Full Other User Info, while preserving the intended restriction on user details.