Mirrors/chatmail-core
1
0
Fork 0
mirror of https://github.com/chatmail/core.git synced 2026-04-25 01:16:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix: Don't verify contacts by others having an unknown verifier

Browse Source 
If this happens, mark the contact as verified by an unknown contact instead. This avoids introducing
incorrect reverse chains: if the verifier itself has an unknown verifier, it may be `contact_id`
actually (directly or indirectly) on the other device (which is needed for getting "verified by
unknown contact" in the first place).
This commit is contained in:
iequidoo
2025-08-29 15:14:36 -03:00
committed by iequidoo
parent bd15d90e77
commit 5da6976bf9
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/contact.rs
View File

@@ -1962,7 +1962,7 @@ pub(crate) async fn mark_contact_id_as_verified(
"Contact cannot be verified by self",
);
let update = verifier_id == Some(ContactId::SELF);
let verifier_id = verifier_id.unwrap_or(contact_id);
let mut verifier_id = verifier_id.unwrap_or(contact_id);
context
.sql
.transaction(|transaction| {
@@ -1990,6 +1990,13 @@ pub(crate) async fn mark_contact_id_as_verified(
verifier_id == contact_id || verifier_verifier_id != ContactId::UNDEFINED,
"Contact {contact_id} cannot be verified by unverified contact {verifier_id}",
);
if verifier_verifier_id == verifier_id {
// Avoid introducing incorrect reverse chains: if the verifier itself has an
// unknown verifier, it may be `contact_id` actually (directly or indirectly) on
// the other device (which is needed for getting "verified by unknown contact"
// in the first place).
verifier_id = contact_id;
}
}
transaction.execute(
"UPDATE contacts SET verifier=?1