From b5d30cc326af3e040adb70e8a19ef2ced614d6f2 Mon Sep 17 00:00:00 2001
From: Ali <>
Date: Tue, 28 Apr 2020 15:22:27 +0400
Subject: [PATCH] Don't allow random access to secret media [skip ci]

---
 submodules/Postbox/Sources/MediaBox.swift        |  5 +++++
 submodules/Postbox/Sources/MediaResource.swift   |  4 +++-
 .../Sources/FetchedMediaResource.swift           | 16 ++++++++++++++--
 3 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/submodules/Postbox/Sources/MediaBox.swift b/submodules/Postbox/Sources/MediaBox.swift
index 43da45a7c8..d2a33e2a8e 100644
--- a/submodules/Postbox/Sources/MediaBox.swift
+++ b/submodules/Postbox/Sources/MediaBox.swift
@@ -535,6 +535,11 @@ public final class MediaBox {
                     return
                 }
                 
+                var range = range
+                if let parameters = parameters, !parameters.isRandomAccessAllowed {
+                    range = 0 ..< range.upperBound
+                }
+                
                 let fetchResource = self.wrappedFetchResource.get()
                 let fetchedDisposable = fileContext.fetched(range: Int32(range.lowerBound) ..< Int32(range.upperBound), priority: priority, fetch: { intervals in
                     return fetchResource
diff --git a/submodules/Postbox/Sources/MediaResource.swift b/submodules/Postbox/Sources/MediaResource.swift
index 730c666386..7206597d1b 100644
--- a/submodules/Postbox/Sources/MediaResource.swift
+++ b/submodules/Postbox/Sources/MediaResource.swift
@@ -64,9 +64,11 @@ public protocol MediaResourceFetchInfo {
 public struct MediaResourceFetchParameters {
     public let tag: MediaResourceFetchTag?
     public let info: MediaResourceFetchInfo?
+    public let isRandomAccessAllowed: Bool
     
-    public init(tag: MediaResourceFetchTag?, info: MediaResourceFetchInfo?) {
+    public init(tag: MediaResourceFetchTag?, info: MediaResourceFetchInfo?, isRandomAccessAllowed: Bool) {
         self.tag = tag
         self.info = info
+        self.isRandomAccessAllowed = isRandomAccessAllowed
     }
 }
diff --git a/submodules/TelegramCore/Sources/FetchedMediaResource.swift b/submodules/TelegramCore/Sources/FetchedMediaResource.swift
index 8ab6ae7d41..d7682a0414 100644
--- a/submodules/TelegramCore/Sources/FetchedMediaResource.swift
+++ b/submodules/TelegramCore/Sources/FetchedMediaResource.swift
@@ -31,16 +31,28 @@ public func fetchedMediaResource(mediaBox: MediaBox, reference: MediaResourceRef
 }
 
 public func fetchedMediaResource(mediaBox: MediaBox, reference: MediaResourceReference, ranges: [(Range<Int>, MediaBoxFetchPriority)]?, statsCategory: MediaResourceStatsCategory = .generic, reportResultStatus: Bool = false, preferBackgroundReferenceRevalidation: Bool = false, continueInBackground: Bool = false) -> Signal<FetchResourceSourceType, FetchResourceError> {
+    var isRandomAccessAllowed = true
+    switch reference {
+    case let .media(media, _):
+        if let file = media.media as? TelegramMediaFile {
+            if file.fileId.namespace == Namespaces.Media.CloudSecretFile {
+                isRandomAccessAllowed = false
+            }
+        }
+    default:
+        break
+    }
+    
     if let ranges = ranges {
         let signals = ranges.map { (range, priority) -> Signal<Void, FetchResourceError> in
-            return mediaBox.fetchedResourceData(reference.resource, in: range, priority: priority, parameters: MediaResourceFetchParameters(tag: TelegramMediaResourceFetchTag(statsCategory: statsCategory), info: TelegramCloudMediaResourceFetchInfo(reference: reference, preferBackgroundReferenceRevalidation: preferBackgroundReferenceRevalidation, continueInBackground: continueInBackground)))
+            return mediaBox.fetchedResourceData(reference.resource, in: range, priority: priority, parameters: MediaResourceFetchParameters(tag: TelegramMediaResourceFetchTag(statsCategory: statsCategory), info: TelegramCloudMediaResourceFetchInfo(reference: reference, preferBackgroundReferenceRevalidation: preferBackgroundReferenceRevalidation, continueInBackground: continueInBackground), isRandomAccessAllowed: isRandomAccessAllowed))
         }
         return combineLatest(signals)
         |> ignoreValues
         |> map { _ -> FetchResourceSourceType in .local }
         |> then(.single(.local))
     } else {
-        return mediaBox.fetchedResource(reference.resource, parameters: MediaResourceFetchParameters(tag: TelegramMediaResourceFetchTag(statsCategory: statsCategory), info: TelegramCloudMediaResourceFetchInfo(reference: reference, preferBackgroundReferenceRevalidation: preferBackgroundReferenceRevalidation, continueInBackground: continueInBackground)), implNext: reportResultStatus)
+        return mediaBox.fetchedResource(reference.resource, parameters: MediaResourceFetchParameters(tag: TelegramMediaResourceFetchTag(statsCategory: statsCategory), info: TelegramCloudMediaResourceFetchInfo(reference: reference, preferBackgroundReferenceRevalidation: preferBackgroundReferenceRevalidation, continueInBackground: continueInBackground), isRandomAccessAllowed: isRandomAccessAllowed), implNext: reportResultStatus)
     }
 }