From 207d6bac14eb808ff24244f66537776b0a7708f2 Mon Sep 17 00:00:00 2001
From: DeFiDude <59237470+DeFiDude@users.noreply.github.com>
Date: Sat, 13 Jun 2026 18:02:49 -0600
Subject: [PATCH] identity: harden import candidate handling

---
 src/reticulum/IdentityManager.cpp   | 18 ++++++++++++++++--
 src/ui/screens/LvSettingsScreen.cpp |  1 +
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/reticulum/IdentityManager.cpp b/src/reticulum/IdentityManager.cpp
index ce4aa8a..7a6ff53 100644
--- a/src/reticulum/IdentityManager.cpp
+++ b/src/reticulum/IdentityManager.cpp
@@ -89,10 +89,16 @@ String IdentityManager::importIdentityPath() const {
         bool importCandidate = !reservedIdentityFile &&
             (lower.endsWith(".identity") || lower.endsWith(".key"));
         if (importCandidate) {
-            candidate = name.startsWith("/") ? name : String(SD_PATH_IDENTITY_DIR) + "/" + name;
+            candidate = name;
+            if (!candidate.startsWith("/")) {
+                int slash = candidate.lastIndexOf('/');
+                if (slash >= 0) candidate = candidate.substring(slash + 1);
+                candidate = String(SD_PATH_IDENTITY_DIR) + "/" + candidate;
+            }
             candidates++;
         }
     }
+    dir.close();
     if (candidates == 1) return candidate;
     if (candidates > 1) Serial.println("[IDMGR] Multiple import identity files found on SD");
     return "";
@@ -122,6 +128,14 @@ int IdentityManager::importIdentity(const String& displayName) {
         Serial.println("[IDMGR] Import identity key failed validation");
         return -1;
     }
+    std::string importedHash = imported.hexhash();
+    for (const auto& slot : _slots) {
+        if (slot.hash == importedHash) {
+            Serial.printf("[IDMGR] Imported identity already exists: %s\n",
+                          importedHash.substr(0, 16).c_str());
+            return -1;
+        }
+    }
 
     int slotNum = (int)_slots.size();
     String keyPath = slotKeyPath(slotNum);
@@ -131,7 +145,7 @@ int IdentityManager::importIdentity(const String& displayName) {
     }
 
     IdentitySlot slot;
-    slot.hash = imported.hexhash();
+    slot.hash = importedHash;
     slot.displayName = "";
     slot.keyPath = keyPath;
     slot.active = false;
diff --git a/src/ui/screens/LvSettingsScreen.cpp b/src/ui/screens/LvSettingsScreen.cpp
index d2bb8c1..e2c1b3a 100644
--- a/src/ui/screens/LvSettingsScreen.cpp
+++ b/src/ui/screens/LvSettingsScreen.cpp
@@ -490,6 +490,7 @@ void LvSettingsScreen::buildItems() {
                     }
                     entry.close();
                 }
+                dir.close();
                 if (identityFiles == 0) {
                     if (_ui) _ui->lvStatusBar().showToast("Missing identity file", 1200);
                     return;