Telegram icon indicating copy to clipboard operation
Telegram copied to clipboard

Fix saving files with the same names

Open dsatyanov opened this issue 1 year ago • 5 comments

@dkaraush Do you remember or could you help with understanding why do we need this removed code here? For me it looks like speed boost/optimization because we don't touch FilePathDatabase in this case - is it correct?

Because of the code there is the bug in the app: https://bugs.telegram.org/c/35162 https://bugs.telegram.org/c/32951 when there is more than one file with the same name we could "save to downloads" only the first of the cached files, because other files are saved internally with suffix " (number)" (see FileLoadOperation)

So it seems like we have to get file path from FilePathDatabase, where the file path is saved properly (see putPath) - is it correct?

dsatyanov avatar May 18 '24 15:05 dsatyanov

imho, if you want to stop using some code better remove it, don't comment it.

Aokromes avatar May 31 '24 03:05 Aokromes

better remove it, don't comment it

Agree 100% It's not the final fix it's just to highlight the cause of the bug. But yes - now I see that I could just remove the code and we'd still see it

Update: removed the code instead of commenting it

dsatyanov avatar May 31 '24 06:05 dsatyanov

I've also experienced this bug. What's worse, I do believe this bug poses a security vulnerability in Telegram for Android. I've tried to contact [email protected] and [email protected] but got no response in 2 weeks so I decieded to disclosure this. Here's my writeup: https://telegra.ph/Telegram-for-Android-Downloaded-Files-Cache-Poisoning-06-21

postboy avatar Jun 21 '24 09:06 postboy

Here's my writeup about this vulnerability in Russian: https://habr.com/ru/articles/823612/

postboy avatar Jun 21 '24 19:06 postboy

Status of one of the bugs on Telegram bug tracker ia changed to "Fix is coming". Telegram channel Beta Info (https://t.me/betainfo) published beta build with supposedly fixed bug.

postboy avatar Jun 24 '24 07:06 postboy

Fixed in version 10.14.3 (4927) from Google Play.

postboy avatar Jul 03 '24 14:07 postboy