fix version 1

module/social/relation/internal/logic/friend/apply_do_message.go

@@ -23,6 +23,14 @@ func ApplyDoMessage(ctx context.Context, in *pb.ApplyMessageRequest) (reply *pb.
 		return nil, errcode.ErrInvalidArgument
 	}
 
+	// 校验该申请存在且属于当前调用者（申请方或被申请方），避免污染他人申请会话
+	var apply models.FriendApply
+	err = impl.DBService.Where("id=? and (from_identity=? or to_identity=?)", in.ApplyId, auth.Identity, auth.Identity).First(&apply).Error
+	if err != nil {
+		printer.Error(err.Error())
+		return nil, errcode.ErrPermissionDenied
+	}
+
 	msg := models.FriendApplyMessage{
 		ApplyID: uint(in.ApplyId),
 		Body:    in.Body,
@@ -36,8 +44,8 @@ func ApplyDoMessage(ctx context.Context, in *pb.ApplyMessageRequest) (reply *pb.
 		return nil, errcode.ErrDB
 	}
 
-	//回写最后一次交流的消息ID
-	err = impl.DBService.Model(models.FriendApply{}).Where("id=?", msg.ApplyID).UpdateColumn("last_message_id", msg.ID).Error
+	//回写最后一次交流的消息ID（仍限定申请归属）
+	err = impl.DBService.Model(models.FriendApply{}).Where("id=? and (from_identity=? or to_identity=?)", msg.ApplyID, auth.Identity, auth.Identity).UpdateColumn("last_message_id", msg.ID).Error
 	if err != nil {
 		printer.Error(err.Error())
 		return nil, errcode.ErrDB