fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Stop a bare nick from cancelling an account's help ticket

Browse source
This commit is contained in:
Jean Chevronnet 2026-07-19 17:45:04 +00:00
parent fa9eaece45
commit dc148dde69
No known key found for this signature in database
1 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
modules/helpserv/src/cancel.rs
View file

@ -3,7 +3,15 @@ use echo_api::{Sender, ServiceCtx, Store};
// CANCEL: withdraw your own newest open ticket.
pub fn handle(me: &str, from: &Sender, ctx: &mut ServiceCtx, db: &mut dyn Store) {
let who = from.account.unwrap_or(from.nick);
let mine = db.help_tickets(true).into_iter().find(|t| t.requester.eq_ignore_ascii_case(who));
let identified = from.account.is_some();
// An unidentified caller may only cancel a ticket whose requester isn't a
// registered account — otherwise anyone taking the nick `bob` could withdraw
// account bob's ticket (the requester is stored as the account when the
// opener was identified, or the bare nick when they weren't).
let mine = db
.help_tickets(true)
.into_iter()
.find(|t| t.requester.eq_ignore_ascii_case(who) && (identified || !db.exists(&t.requester)));
match mine {
Some(t) => {
db.help_close(t.id);