From 52ceb4062db5197fa160028aeec62c56832a789b Mon Sep 17 00:00:00 2001 From: Cody Henthorne Date: Wed, 10 Jun 2026 15:40:12 -0400 Subject: [PATCH] Reject group call ring updates from senders who are not current group members. --- .../securesms/service/webrtc/SignalCallManager.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/app/src/main/java/org/thoughtcrime/securesms/service/webrtc/SignalCallManager.java b/app/src/main/java/org/thoughtcrime/securesms/service/webrtc/SignalCallManager.java index f8650d5374..c1884ade01 100644 --- a/app/src/main/java/org/thoughtcrime/securesms/service/webrtc/SignalCallManager.java +++ b/app/src/main/java/org/thoughtcrime/securesms/service/webrtc/SignalCallManager.java @@ -1003,11 +1003,12 @@ public final class SignalCallManager implements CallManager.Observer, GroupCall. if (group != null && group.isActive() && !Recipient.resolved(group.getRecipientId()).isBlocked() && + group.memberLevel(senderRecipient).isInGroup() && (!group.isAnnouncementGroup() || group.isAdmin(senderRecipient))) { process((s, p) -> p.handleGroupCallRingUpdate(s, new RemotePeer(group.getRecipientId()), groupId, ringId, senderAci, ringUpdate)); } else { - Log.w(TAG, "Unable to ring unknown/inactive/blocked group."); + Log.w(TAG, "Unable to ring unknown/inactive/blocked group, or sender is not a current member of the group."); } } catch (InvalidInputException e) { Log.w(TAG, "Unable to ring group due to invalid group id", e);