Skip to content

Commit

Permalink
download map preview via https
Browse files Browse the repository at this point in the history
  • Loading branch information
DrKLO committed Dec 24, 2013
1 parent d2a6fa4 commit 4f9384a
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion TMessagesProj/src/main/java/org/telegram/ui/ChatActivity.java
View file
Expand Up @@ -3075,7 +3075,7 @@ public void update() {
} else if (type == 4 || type == 5) { } else if (type == 4 || type == 5) {
double lat = message.messageOwner.media.geo.lat; double lat = message.messageOwner.media.geo.lat;
double lon = message.messageOwner.media.geo._long; double lon = message.messageOwner.media.geo._long;
String url = String.format(Locale.US, "http://maps.googleapis.com/maps/api/staticmap?center=%f,%f&zoom=13&size=100x100&maptype=roadmap&scale=%d&markers=color:red|size:big|%f,%f&sensor=false", lat, lon, Math.min(2, (int)Math.ceil(displayDensity)), lat, lon); String url = String.format(Locale.US, "https://maps.googleapis.com/maps/api/staticmap?center=%f,%f&zoom=13&size=100x100&maptype=roadmap&scale=%d&markers=color:red|size:big|%f,%f&sensor=false", lat, lon, Math.min(2, (int)Math.ceil(displayDensity)), lat, lon);
photoImage.setImage(url, null, message.messageOwner.out ? R.drawable.photo_placeholder_out : R.drawable.photo_placeholder_in); photoImage.setImage(url, null, message.messageOwner.out ? R.drawable.photo_placeholder_out : R.drawable.photo_placeholder_in);
} else if (type == 11 || type == 10) { } else if (type == 11 || type == 10) {
int width = (int)(displaySize.x - (30 * displayDensity)); int width = (int)(displaySize.x - (30 * displayDensity));
Expand Down

14 comments on commit 4f9384a

@3mph4515
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

major fix :D

@ysokolovsky
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so, what's the price of this bug? ;)

@DrKLO
Copy link
Owner

@DrKLO DrKLO commented on 4f9384a Dec 26, 2013

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

who said that it's a bug?

@slaFFik
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

http://blog.hackapp.com/2013/12/telegram-secret-chat-geolocation-leak.html?showComment=1387922480431

@shums
Copy link

@shums shums commented on 4f9384a Dec 26, 2013

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Geo-location data from user to user was unencrypted and could be stolen

@DrKLO
Copy link
Owner

@DrKLO DrKLO commented on 4f9384a Dec 26, 2013

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So what? All geo-location data from mtproto server to client is encrypted, it's just map preview around some geo location. There is no information in which app it was opened or something else. This could be you browser or other app. This is not bug at all. Discussion closed.

@naryl
Copy link

@naryl naryl commented on 4f9384a Dec 26, 2013

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder how many more backdoors does Telegram have disguised as "bugs" or even "not bugs".
Or, if it really was a "not bug", you clearly have no idea about how privacy can be compromised and therefore can't be trusted with protecting it.

@OShine
Copy link

@OShine OShine commented on 4f9384a Dec 26, 2013

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The human factor in this case is not good.

@bdbch
Copy link

@bdbch bdbch commented on 4f9384a Jan 30, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dudes, as he said, the location is encrypted with mtproto,
its just the connection to the maps servers which wasn't protected. You could also visit maps and share location without https and it would have the same effect.

@bdbch
Copy link

@bdbch bdbch commented on 4f9384a Jan 30, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bytheway nice security fix. :)
it was only one s! :D 👍

@ZongerX
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hardest fix ever :D

@soloveiko
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

motherOfGod.. what a fix!

@positively
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What a price for this major fix?) Who knows?)

@verylonely
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

omg
i'm sorry
but he genial

Please sign in to comment.