Cancelled file transfers still work
I just tried to send a file to a friend. He then mentioned that it might not work as he resides behind a strict NAT and asked me to send it using email. Here's what happened:
- I initiate the file request in Gajim
- He tells me to use email instead
- I click 'cancel' and then 'clean' in the transfer list
- I switch to Firefox to use GMail
- A minute later I see a "transfer finished" popup
- My friend confirms that the transfer was complete
- I say 'WTF' ;)
This might seem like a little glitch but might be a serious security bug. If the file gets modified between clicking 'cancel' and starting actual transfer (up to the receiving party to pick the right moment), you might disclose critical information.