mirror of
https://github.com/openclaw/openclaw.git
synced 2026-06-07 01:23:31 +00:00
a7f6e0a921
* fix(telegram): support negative IDs in groupAllowFrom for group/channel whitelist (#36753) When configuring Telegram group restrictions with groupAllowFrom, negative group/channel IDs (e.g., -1001234567890) are rejected with 'authorization requires numeric Telegram sender IDs only' error, even though the field name suggests it should accept group IDs. Root cause: - normalizeAllowFrom() uses regex /^\d+$/ to validate IDs - Telegram group/channel IDs are negative integers - Regex only matches positive integers, rejecting all group IDs Impact: - Users cannot whitelist specific groups using groupAllowFrom - Workaround requires groupPolicy: "open" (security risk) - Field name is misleading (suggests group IDs, but only accepts user IDs) Fix: - Change regex from /^\d+$/ to /^-?\d+$/ (support optional minus sign) - Apply to both invalidEntries filter and ids filter - Add comment explaining negative ID support for groups/channels Testing: - Positive user IDs (745123456) → ✅ still work - Negative group IDs (-1001234567890) → ✅ now accepted - Invalid entries (@username) → ⚠️ still warned Fixes #36753 * test(telegram): add signed ID runtime regression --------- Co-authored-by: Martin Qiu <qiuyuemartin@gmail.com> Co-authored-by: Vincent Koc <vincentkoc@ieee.org>