Check timestamp before notifying users

packages/rocketchat-lib/server/lib/notifyUsersOnMessage.js

@@ -4,6 +4,10 @@ RocketChat.callbacks.add('afterSaveMessage', function(message, room) {
 		return message;
 	}
 
+	if (message.ts && (moment(message.ts).subtract(5, 'seconds').isBefore(new Date) || moment(message.ts).isAfter(moment().add(5, 'seconds')))) {
+		return message;
+	}
+
 	/**
 	 * Chechs if a messages contains a user highlight
 	 *

packages/rocketchat-lib/server/lib/sendEmailOnMessage.js

@@ -4,6 +4,10 @@ RocketChat.callbacks.add('afterSaveMessage', function(message, room) {
 		return message;
 	}
 
+	if (message.ts && (moment(message.ts).subtract(5, 'seconds').isBefore(new Date) || moment(message.ts).isAfter(moment().add(5, 'seconds')))) {
+		return message;
+	}
+
 	var emailSubject, usersToSendEmail = {};
 	var directMessage = room.t === 'd';
 

packages/rocketchat-lib/server/methods/sendMessage.coffee

 Meteor.methods
 	sendMessage: (message) ->
+		if message.ts and (moment(message.ts).subtract(5, 'seconds').isBefore(new Date) or moment(message.ts).isAfter(moment().add(5, 'seconds')))
+			throw new Meteor.Error('error-message-ts-out-of-sync', 'Message timestamp is out of sync', { method: 'sendMessage', message_ts: message.ts, server_ts: new Date().getTime() })
+
 		if message.msg?.length > RocketChat.settings.get('Message_MaxAllowedSize')
 			throw new Meteor.Error('error-message-size-exceeded', 'Message size exceeds Message_MaxAllowedSize', { method: 'sendMessage' })