fix: only act on a panel message the caller is entitled to

Telegram lets a client send any callback data for any message it can see, not
only the buttons it was shown. The owner id inside the callback data stops one
person driving another's panel, but it does not stop somebody forging their own
id against a message that was never a panel.

In a group, Voicy's public messages are transcripts somebody asked for and
everyone can read. A crafted callback naming one of them could delete it, or
overwrite it with a settings screen.

An ephemeral message stays addressable: it is already visible to exactly one
person, so acting on it at that person's request destroys nothing that was not
theirs. In a direct chat every message is that person's own, so the panel is
still edited in place.

This is the hole branchy closed in the same release. It was not introduced
here, but shipping one bot with the guard and its sibling without it is not a
choice worth making by accident.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FxNv1rk7jMQtb9tMBREc5B

Author: amtiYo

CHANGELOG.md

@@ -13,6 +13,15 @@ See [`docs/versioning.md`](docs/versioning.md) for what the numbers mean and
 
 ### Changed
 
+- A panel callback only acts on a message it is entitled to act on. Telegram
+  lets a client send any callback data for any message it can see, not only the
+  buttons it was shown; the owner id inside the data stopped one person driving
+  another's panel, but not somebody forging their own id against a public
+  message. In a group Voicy's public messages are transcripts, so `close` could
+  have deleted someone else's, and opening a tab could have overwritten one.
+  Ephemeral messages are unaffected — they are already visible to one person —
+  and a direct chat is that person's own.
+
 - **The direct-chat command menu is one entry: `/start`.** `/stats`,
   `/language`, `/help` and `/about` were published as commands while already
   being buttons on the `/start` panel, so every one of them listed the same door

internal/bot/bot.go

@@ -708,17 +708,42 @@ func (b *Bot) handleCallback(ctx context.Context, act decide.Action, lang string
 	return nil
 }
 
+// panelIsAddressable reports whether a callback may act on the message it names.
+//
+// Telegram lets a client send any callback data for any message it can see, not
+// only the buttons it was shown. The owner id inside the data stops one person
+// driving another's panel, but not somebody forging their own id against a
+// message that was never a panel -- and in a group Voicy's public messages are
+// transcripts, which somebody asked for and everyone can read.
+//
+// So in a group only an ephemeral message is addressable: it is already visible
+// to one person, and acting on it at that person's request destroys nothing
+// that was not theirs. In a direct chat every message is that person's own, and
+// the panel is edited in place as before.
+func panelIsAddressable(act decide.Action) bool {
+	if act.Ephemeral && act.EphemeralMessageID != 0 {
+		return true
+	}
+	return act.Chat.Type == "private"
+}
+
 func (b *Bot) editPanel(ctx context.Context, act decide.Action, text string, markup *tg.InlineKeyboardMarkup) error {
 	if act.Ephemeral && act.EphemeralMessageID != 0 {
 		return b.tg.EditEphemeralMessageText(ctx, act.ChatID, act.UserID, act.EphemeralMessageID, text, markup)
 	}
+	if !panelIsAddressable(act) {
+		return nil
+	}
 	return b.tg.EditMessageText(ctx, act.ChatID, act.CallbackMessageID, text, markup)
 }
 
 func (b *Bot) deletePanel(ctx context.Context, act decide.Action) error {
 	if act.Ephemeral && act.EphemeralMessageID != 0 {
 		return b.tg.DeleteEphemeralMessage(ctx, act.ChatID, act.UserID, act.EphemeralMessageID)
 	}
+	if !panelIsAddressable(act) {
+		return nil
+	}
 	return b.tg.DeleteMessage(ctx, act.ChatID, act.CallbackMessageID)
 }