mirror of
https://github.com/mattermost/mattermost.git
synced 2026-09-19 10:12:47 +08:00
Maria A NunezandCursor
1e0bdaf068
The inbound shared-channel sync handler applied edits and deletes from a remote cluster without checking that the existing post belonged to that remote, allowing a remote to modify or delete posts it did not own. Enforce the same ownership check already used for reactions and acknowledgements before editing or deleting a synced post, and add regression tests for the cross-remote cases. Co-authored-by: Cursor <cursoragent@cursor.com>