+ $validated = in_array($item['private'], [Item::PUBLIC, Item::UNLISTED]);
+
+ if (!$validated) {
+ $requester = HTTPSignature::getSigner('', $_SERVER);
+ if (!empty($requester) && $item['origin']) {
+ $requester_id = Contact::getIdForURL($requester, $item['uid']);
+ if (!empty($requester_id)) {
+ $permissionSets = DI::permissionSet()->selectByContactId($requester_id, $item['uid']);
+ if (!empty($permissionSets)) {
+ $psid = array_merge($permissionSets->column('id'),
+ [DI::permissionSet()->getIdFromACL($item['uid'], '', '', '', '')]);
+ $validated = in_array($item['psid'], $psid);
+ }
+ }
+ }