mirror of
https://github.com/hanzoai/team.git
synced 2026-09-30 01:57:35 +00:00
232a48482b
The inbound shared-channel sync handler applied edits and deletes from a remote cluster without checking that the existing post belonged to that remote, allowing a remote to modify or delete posts it did not own. Enforce the same ownership check already used for reactions and acknowledgements before editing or deleting a synced post, and add regression tests for the cross-remote cases. Co-authored-by: Hanzo Dev <[email protected]>