Skip to content

Do not allow voting if user is not in conv where the poll is #356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
michalz-zoom merged 2 commits into from
Sep 1, 2026
Merged

Do not allow voting if user is not in conv where the poll is #356

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3a57be8
Do not allow voting if user is not in conv where the poll is
michalz-zoom Aug 31, 2026
2279768
Do not allow votes by RestrictedBots
michalz-zoom Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ require (
github.com/gorilla/mux v1.7.3
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
github.com/keybase/go-codec v0.0.0-20180928230036-164397562123
github.com/keybase/go-keybase-chat-bot v0.0.0-20260714190752-406d338a3ba3
github.com/keybase/go-keybase-chat-bot v0.0.0-20260901173658-7d1dd4bcaca8
github.com/keybase/showtrends-sdk/go v0.0.0-20260416134812-fab649f0dcd6
github.com/opensearch-project/opensearch-go/v4 v4.5.0
github.com/stretchr/testify v1.11.1
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,8 +100,8 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNU
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
github.com/keybase/go-codec v0.0.0-20180928230036-164397562123 h1:yg56lYPqh9suJepqxOMd/liFgU/x+maRPiB30JNYykM=
github.com/keybase/go-codec v0.0.0-20180928230036-164397562123/go.mod h1:r/eVVWCngg6TsFV/3HuS9sWhDkAzGG8mXhiuYA+Z/20=
github.com/keybase/go-keybase-chat-bot v0.0.0-20260714190752-406d338a3ba3 h1:b9O4pu49GbvV+6Gb5JZ+heshUqZr0E3OjZpzgp3IlmU=
github.com/keybase/go-keybase-chat-bot v0.0.0-20260714190752-406d338a3ba3/go.mod h1:SOGuqjCQ9xEgLnDM4V3Tq8LAXWJZiZpLMeqBH3yk0So=
github.com/keybase/go-keybase-chat-bot v0.0.0-20260901173658-7d1dd4bcaca8 h1:uGkqftjpCoblvqahUU/WM3zzZFTQbDp2ui1YI4zYiDQ=
github.com/keybase/go-keybase-chat-bot v0.0.0-20260901173658-7d1dd4bcaca8/go.mod h1:SOGuqjCQ9xEgLnDM4V3Tq8LAXWJZiZpLMeqBH3yk0So=
github.com/keybase/showtrends-sdk/go v0.0.0-20260416134812-fab649f0dcd6 h1:EdvpU9BuWL2e7IAysp2poRlYaxOQUJhmwCn0Y6b7jSg=
github.com/keybase/showtrends-sdk/go v0.0.0-20260416134812-fab649f0dcd6/go.mod h1:Sw53KzqVYBoB3AAaZLyyLcBTqQxQXDFOHp/lWg2hVOM=
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
Expand Down
26 changes: 26 additions & 0 deletions pollbot/pollbot/http.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ import (
"time"

"github.com/keybase/go-keybase-chat-bot/kbchat"
"github.com/keybase/go-keybase-chat-bot/kbchat/types/chat1"
"github.com/keybase/managed-bots/base"
)

Expand Down Expand Up @@ -102,6 +103,17 @@ func (h *HTTPSrv) handleVote(w http.ResponseWriter, r *http.Request) {
h.showError(w)
return
}
members, err := h.kbc.ListMembersByConvID(convID)
if err != nil {
h.Errorf("failed to list conv members: %s", err)
h.showError(w)
return
}
if !isConvMember(members, username) {
h.Debug("vote rejected: %q is not a member of %q", username, convID)
h.showError(w)
return
}
if vote.Choice < 1 || vote.Choice > numChoices {
h.Debug("vote choice %d out of range for poll %q", vote.Choice, vote.ID)
h.showError(w)
Expand Down Expand Up @@ -159,3 +171,17 @@ func (h *HTTPSrv) handleImage(w http.ResponseWriter, r *http.Request) {
}

func (h *HTTPSrv) handleHealthCheck(_ http.ResponseWriter, _ *http.Request) {}

func isConvMember(members chat1.ChatMembersDetails, username string) bool {
allMembers := [][]chat1.ChatMemberDetails{
members.Owners, members.Admins, members.Writers, members.Readers, members.Bots,
}
for _, group := range allMembers {
for _, m := range group {
if m.Username == username {
return true
}
}
}
return false
}
3 changes: 1 addition & 2 deletions triviabot/triviabot/session.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ import (

"github.com/keybase/go-keybase-chat-bot/kbchat"
"github.com/keybase/go-keybase-chat-bot/kbchat/types/chat1"
"github.com/keybase/go-keybase-chat-bot/kbchat/types/keybase1"
"github.com/keybase/managed-bots/base"
)

Expand Down Expand Up @@ -225,7 +224,7 @@ func (s *session) getNextQuestion() error {
return nil
}

func (s *session) isBotRole(members keybase1.TeamMembersDetails) bool {
func (s *session) isBotRole(members chat1.ChatMembersDetails) bool {
for _, member := range append(members.Bots, members.RestrictedBots...) {
if member.Username == s.kbc.GetUsername() {
return true
Expand Down
Loading