Check sender of bookmark:1 updates

2 files changed, 12 insertions, 0 deletions

diff --git a/BACKPORT b/BACKPORT
index abbc05f5..44b0d216 100644
--- a/BACKPORT
+++ b/BACKPORT
@@ -341,3 +341,5 @@ source code. Maybe a similar commit can be provided independently.
 
 5568bbc6bf505c4f8ea93fc460dbeff6f4d36e15: Partially applied.
 Changes related to libadwaita are out of scope for this fork.
+
+ef8fb0e94ce79d5fde2943e433ad0422eb7f70ec: Applied.
diff --git a/xmpp-vala/src/module/xep/0402_bookmarks2.vala b/xmpp-vala/src/module/xep/0402_bookmarks2.vala
index 406f37f4..d1e53e6e 100644
--- a/xmpp-vala/src/module/xep/0402_bookmarks2.vala
+++ b/xmpp-vala/src/module/xep/0402_bookmarks2.vala
@@ -68,6 +68,11 @@ public class Module : BookmarksProvider, XmppStreamModule {
     }
 
     private void on_pupsub_item(XmppStream stream, Jid jid, string id, StanzaNode? node) {
+        if (!jid.equals(stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid)) {
+            warning("Received alleged bookmarks:1 item from %s, ignoring", jid.to_string());
+            return;
+        }
+
         Conference conference = parse_item_node(node, id);
         Flag? flag = stream.get_flag(Flag.IDENTITY);
         if (flag != null) {
@@ -77,6 +82,11 @@ public class Module : BookmarksProvider, XmppStreamModule {
     }
 
     private void on_pupsub_retract(XmppStream stream, Jid jid, string id) {
+        if (!jid.equals(stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid)) {
+            warning("Received alleged bookmarks:1 retract from %s, ignoring", jid.to_string());
+            return;
+        }
+
         try {
             Jid jid_parsed = new Jid(id);
             Flag? flag = stream.get_flag(Flag.IDENTITY);