From 1b3fb60cb0ad9d7f22f4f97006cac652f8f1883b Mon Sep 17 00:00:00 2001
From: Michelle Tang <mtang@signal.org>
Date: Mon, 16 Mar 2026 12:20:21 -0400
Subject: [PATCH] Add more pin message checks.

---
 .../securesms/messages/DataMessageProcessor.kt         | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/app/src/main/java/org/thoughtcrime/securesms/messages/DataMessageProcessor.kt b/app/src/main/java/org/thoughtcrime/securesms/messages/DataMessageProcessor.kt
index 19ddcbc76f..8cc38a0f7d 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/messages/DataMessageProcessor.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/messages/DataMessageProcessor.kt
@@ -1316,6 +1316,11 @@ object DataMessageProcessor {
       return null
     }
 
+    if (targetThread.recipient.id != threadRecipient.id) {
+      warn(envelope.timestamp!!, "[handlePinMessage] Target message is in a different thread than the thread recipient! timestamp: ${pinMessage.targetSentTimestamp}")
+      return null
+    }
+
     val groupRecord = SignalDatabase.groups.getGroup(threadRecipient.id).orNull()
     if (groupRecord != null && !groupRecord.members.contains(senderRecipient.id)) {
       warn(envelope.timestamp!!, "[handlePinMessage] Sender is not in the group! timestamp: ${pinMessage.targetSentTimestamp}")
@@ -1408,6 +1413,11 @@ object DataMessageProcessor {
       return null
     }
 
+    if (targetThread.recipient.id != threadRecipient.id) {
+      warn(envelope.timestamp!!, "[handleUnpinMessage] Target message is in a different thread than the thread recipient! timestamp: ${unpinMessage.targetSentTimestamp}")
+      return null
+    }
+
     val groupRecord = SignalDatabase.groups.getGroup(threadRecipient.id).orNull()
     if (groupRecord != null && !groupRecord.members.contains(senderRecipient.id)) {
       warn(envelope.timestamp!!, "[handleUnpinMessage] Sender is not in the group! timestamp: ${unpinMessage.targetSentTimestamp}")