Repository navigation
fix(download): only return a message from the requested chat - #290
Open
ApexAiOfficial wants to merge 2 commits into
Open
ApexAiOfficial wants to merge 2 commits into
ApexAiOfficial wants to merge 2 commits into
Conversation
For users and basic groups getMessage calls messages.getMessages, which looks an id up across all of the account's private chats and basic groups: it is not scoped to the peer. `tg download @alice 123` (and `tg reactions`) could therefore act on message 123 of a different chat. Check that the returned message belongs to the requested peer; channel lookups were already scoped, and Saved Messages (self) is left unchecked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The chat check skipped "me", so `tg download me 123` still returned message 123 of whichever private chat or basic group held that id. A Saved Messages hit is accepted only when the response marks the message's user as the current user, without an extra RPC. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
For users and basic groups
getMessagecallsmessages.getMessages, which looks an id up across all of the account's private chats and basic groups: it isn't scoped to the peer. Sotg download @alice 123,tg download me 123andtg reactionscould act on message 123 of a different chat.The returned message must now belong to the requested chat:
me): the response must mark the message's user as the current user (Self), so no extra RPC is needed.channels.getMessageswas already scoped.Tests cover another chat, the same chat, and Saved Messages versus another private chat.
go test -raceand golangci-lint v2.12.1 (Go 1.25) pass.🤖 Generated with Claude Code