From aa6f2499b9f3e2d08125edc19bffdb3c91f8708e Mon Sep 17 00:00:00 2001
From: Sarah Jamie Lewis <sarah@openprivacy.ca>
Date: Wed, 9 Jun 2021 13:26:02 -0700
Subject: [PATCH] reject group invites without a corresponding key bundle

---
 model/profile.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/model/profile.go b/model/profile.go
index f434ae5..b55feb0 100644
--- a/model/profile.go
+++ b/model/profile.go
@@ -8,6 +8,7 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"git.openprivacy.ca/openprivacy/connectivity/tor"
 	"golang.org/x/crypto/ed25519"
 	"io"
@@ -390,6 +391,9 @@ func (p *Profile) GetGroup(groupID string) (g *Group) {
 func (p *Profile) ProcessInvite(invite string) (string, error) {
 	gci, err := ValidateInvite(invite)
 	if err == nil {
+		if _, exists := p.GetContact(gci.ServerHost); !exists {
+			return "", fmt.Errorf("unknown server. a server key bundle needs to be imported before this group can be verified")
+		}
 		group := new(Group)
 		group.Version = CurrentGroupVersion
 		group.GroupID = gci.GroupID