From 425d1505cf18ccfbee71e65bb1fb47425b894aae Mon Sep 17 00:00:00 2001
From: YoursFunny <admin@yoursfunny.top>
Date: Sat, 8 Aug 2026 19:59:27 +0800
Subject: [PATCH] handlers: fix /set_forward_channel admin checks

Compare the sender's user id (not the chat id, which only matches in
private chats) and require the bot to actually be an admin with post
rights instead of silently passing when it is missing from the list.
Also stops panicking on get_me network failures.
---
 crates/xmedia-bot/src/handlers.rs | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/crates/xmedia-bot/src/handlers.rs b/crates/xmedia-bot/src/handlers.rs
index 46ec0f4..8da3ada 100644
--- a/crates/xmedia-bot/src/handlers.rs
+++ b/crates/xmedia-bot/src/handlers.rs
@@ -190,19 +190,31 @@ async fn set_forward_channel_handler(
         return Err(SetForwardChannelError::NotChannel);
     }
     let channel_id = chat.id.0;
+    // The sender must be a channel administrator. Compare against the
+    // sender's user id, NOT the chat id (they only coincide in private
+    // chats, so the old check broke group usage).
+    let Some(sender) = message.from.as_ref() else {
+        return Err(SetForwardChannelError::NotAdmin);
+    };
     match bot.get_chat_administrators(channel.clone()).await {
         Err(e) => {
             log::error!("Failed to get channel administrators {}: {}", channel, e);
             return Err(SetForwardChannelError::NotBotAdmin(e));
         }
         Ok(admins) => {
-            if !admins.iter().any(|admin| admin.user.id == message.chat.id) {
+            if !admins.iter().any(|admin| admin.user.id == sender.id) {
                 return Err(SetForwardChannelError::NotAdmin);
             }
-            let bot_id = bot.get_me().await.expect("Failed get bot id").user.id;
-            if let Some(bot_admin) = admins.iter().find(|admin| admin.user.id == bot_id)
-                && !bot_admin.can_post_messages()
-            {
+            // The bot itself must be an admin that can post; a missing
+            // bot entry must not pass silently (copy would fail later).
+            let bot_id = match bot.get_me().await {
+                Ok(me) => me.user.id,
+                Err(e) => return Err(SetForwardChannelError::NotBotAdmin(e)),
+            };
+            let bot_ok = admins
+                .iter()
+                .any(|admin| admin.user.id == bot_id && admin.can_post_messages());
+            if !bot_ok {
                 return Err(SetForwardChannelError::NotBotCanPost);
             }
         }