Skip to content

Conversation

@RaspberryProgramming
Copy link

@RaspberryProgramming RaspberryProgramming commented Nov 25, 2025

There was an issue I noticed with the Exchange Position functionality where it would send my exact position to the mesh when my position was disabled or when the precision was modified. I hadn't opened an issue as I already discovered where this is happening.

The issue

In the android app when the user activated the Exchange Position button, a POSITION_APP packet is generated and sent by the android app. This is different from the firmware which would have sent an imprecise position based on the precision setting of that channel or would not include position if disabled on the channel.

I replicated how the firmware generates POSITION_APP packets to ensure that this functions similarly.

Testing

After making the change I built and ran the app on my phone, connected to a node and set the primary channel precision to 13.
image
You can see that the position app with precision 13 was sent and I also received a response from the destination.

I then sent the request with position disabled on my primary channel.
image

You can see that the request was sent without the position and a response was received.

I ran the unit tests via android studio and ran the other gradle commands required by the contribution guide.

RaspberryProgramming and others added 2 commits November 24, 2025 19:56
…n or not send position at all based on settings

This is replicated based on the firmware
@CLAassistant
Copy link

CLAassistant commented Nov 25, 2025

CLA assistant check
All committers have signed the CLA.

@jamesarich jamesarich requested a review from Copilot November 25, 2025 14:18
Copilot finished reviewing on behalf of jamesarich November 25, 2025 14:26
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a privacy vulnerability in the Exchange Position functionality where the Android app was sending exact GPS coordinates regardless of channel precision settings or position-sharing preferences. The fix replicates the firmware's position precision masking algorithm to ensure that imprecise positions are sent based on channel settings.

Key Changes:

  • Adds position precision masking logic that respects channel-specific precision settings
  • Supports sending no position data when precision is set to 0 (position disabled)
  • Applies bit masking and offset calculations to reduce position accuracy based on precision value

You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants