From dc148dde69f03900687cc88ef67c3cd102d91b62 Mon Sep 17 00:00:00 2001 From: Jean Date: Sun, 19 Jul 2026 17:45:04 +0000 Subject: [PATCH] Stop a bare nick from cancelling an account's help ticket --- modules/helpserv/src/cancel.rs | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/modules/helpserv/src/cancel.rs b/modules/helpserv/src/cancel.rs index 8900c66..b11e4d0 100644 --- a/modules/helpserv/src/cancel.rs +++ b/modules/helpserv/src/cancel.rs @@ -3,7 +3,15 @@ use echo_api::{Sender, ServiceCtx, Store}; // CANCEL: withdraw your own newest open ticket. pub fn handle(me: &str, from: &Sender, ctx: &mut ServiceCtx, db: &mut dyn Store) { let who = from.account.unwrap_or(from.nick); - let mine = db.help_tickets(true).into_iter().find(|t| t.requester.eq_ignore_ascii_case(who)); + let identified = from.account.is_some(); + // An unidentified caller may only cancel a ticket whose requester isn't a + // registered account — otherwise anyone taking the nick `bob` could withdraw + // account bob's ticket (the requester is stored as the account when the + // opener was identified, or the bare nick when they weren't). + let mine = db + .help_tickets(true) + .into_iter() + .find(|t| t.requester.eq_ignore_ascii_case(who) && (identified || !db.exists(&t.requester))); match mine { Some(t) => { db.help_close(t.id);