From 8d2750bfede4d7ef69a7365092a01d99be011b85 Mon Sep 17 00:00:00 2001 From: Morgan Pretty Date: Mon, 2 Dec 2024 15:03:04 +1100 Subject: [PATCH] Fixed an issue where non-admins would attempt to update group configs --- Session.xcodeproj/project.pbxproj | 4 ++-- .../LibSession/Config Handling/LibSession+GroupInfo.swift | 8 ++++++-- .../Config Handling/LibSession+GroupMembers.swift | 4 +++- 3 files changed, 11 insertions(+), 5 deletions(-) diff --git a/Session.xcodeproj/project.pbxproj b/Session.xcodeproj/project.pbxproj index 2854a0040..e98463320 100644 --- a/Session.xcodeproj/project.pbxproj +++ b/Session.xcodeproj/project.pbxproj @@ -7873,7 +7873,7 @@ CLANG_WARN__ARC_BRIDGE_CAST_NONARC = YES; CLANG_WARN__DUPLICATE_METHOD_MATCH = YES; CODE_SIGN_IDENTITY = "iPhone Developer"; - CURRENT_PROJECT_VERSION = 498; + CURRENT_PROJECT_VERSION = 499; ENABLE_BITCODE = NO; ENABLE_STRICT_OBJC_MSGSEND = YES; ENABLE_TESTABILITY = YES; @@ -7949,7 +7949,7 @@ CLANG_WARN__ARC_BRIDGE_CAST_NONARC = YES; CLANG_WARN__DUPLICATE_METHOD_MATCH = YES; CODE_SIGN_IDENTITY = "iPhone Distribution"; - CURRENT_PROJECT_VERSION = 498; + CURRENT_PROJECT_VERSION = 499; ENABLE_BITCODE = NO; ENABLE_MODULE_VERIFIER = YES; ENABLE_STRICT_OBJC_MSGSEND = YES; diff --git a/SessionMessagingKit/LibSession/Config Handling/LibSession+GroupInfo.swift b/SessionMessagingKit/LibSession/Config Handling/LibSession+GroupInfo.swift index 3152aaf68..df1ac56d9 100644 --- a/SessionMessagingKit/LibSession/Config Handling/LibSession+GroupInfo.swift +++ b/SessionMessagingKit/LibSession/Config Handling/LibSession+GroupInfo.swift @@ -267,9 +267,11 @@ internal extension LibSession { ) throws -> [T] { guard let updatedGroups: [ClosedGroup] = updated as? [ClosedGroup] else { throw StorageError.generic } - // Exclude legacy groups as they aren't managed via LibSession + // Exclude legacy groups as they aren't managed via LibSession and groups where the current user isn't an + // admin (non-admins can't update `GroupInfo` anyway) let targetGroups: [ClosedGroup] = updatedGroups .filter { (try? SessionId(from: $0.id))?.prefix == .group } + .filter { isAdmin(groupSessionId: SessionId(.group, hex: $0.id), using: dependencies) } // If we only updated the current user contact then no need to continue guard !targetGroups.isEmpty else { return updated } @@ -310,9 +312,11 @@ internal extension LibSession { ) throws -> [T] { guard let updatedDisappearingConfigs: [DisappearingMessagesConfiguration] = updated as? [DisappearingMessagesConfiguration] else { throw StorageError.generic } - // Filter out any disappearing config changes not related to updated groups + // Filter out any disappearing config changes not related to updated groups and groups where + // the current user isn't an admin (non-admins can't update `GroupInfo` anyway) let targetUpdatedConfigs: [DisappearingMessagesConfiguration] = updatedDisappearingConfigs .filter { (try? SessionId.Prefix(from: $0.id)) == .group } + .filter { isAdmin(groupSessionId: SessionId(.group, hex: $0.id), using: dependencies) } guard !targetUpdatedConfigs.isEmpty else { return updated } diff --git a/SessionMessagingKit/LibSession/Config Handling/LibSession+GroupMembers.swift b/SessionMessagingKit/LibSession/Config Handling/LibSession+GroupMembers.swift index f9825ff75..987bd9693 100644 --- a/SessionMessagingKit/LibSession/Config Handling/LibSession+GroupMembers.swift +++ b/SessionMessagingKit/LibSession/Config Handling/LibSession+GroupMembers.swift @@ -366,9 +366,11 @@ internal extension LibSession { ) throws -> [T] { guard let updatedMembers: [GroupMember] = updated as? [GroupMember] else { throw StorageError.generic } - // Exclude legacy groups as they aren't managed via SessionUtil + // Exclude legacy groups as they aren't managed via SessionUtil and groups where the current user + // isn't an admin (non-admins can't update `GroupMembers` anyway) let targetMembers: [GroupMember] = updatedMembers .filter { (try? SessionId(from: $0.groupId))?.prefix == .group } + .filter { isAdmin(groupSessionId: SessionId(.group, hex: $0.groupId), using: dependencies) } // If we only updated the current user contact then no need to continue guard