Profile::getOwnedTags -> Profile::getLists, first argument is the current user, or...

[quix0rs-gnu-social.git] / actions / shownotice.php

diff --git a/actions/shownotice.php b/actions/shownotice.php
index f6074faddc3d80437601a410ada1b26216f30b69..b6d0625e13ec0f86c43ef11138e7476c54611661 100644 (file)
--- a/actions/shownotice.php
+++ b/actions/shownotice.php
@@ -77,21 +77,19 @@ class ShownoticeAction extends OwnerDesignAction
             StatusNet::setApi(true);
         }
 
-        $id = $this->arg('notice');
+        $this->notice = $this->getNotice();
 
-        $this->notice = Notice::staticGet($id);
+        $cur = common_current_user();
 
-        if (empty($this->notice)) {
-            // Did we used to have it, and it got deleted?
-            $deleted = Deleted_notice::staticGet($id);
-            if (!empty($deleted)) {
-                // TRANS: Client error displayed trying to show a deleted notice.
-                $this->clientError(_('Notice deleted.'), 410);
-            } else {
-                // TRANS: Client error displayed trying to show a non-existing notice.
-                $this->clientError(_('No such notice.'), 404);
-            }
-            return false;
+        if (!empty($cur)) {
+            $curProfile = $cur->getProfile();
+        } else {
+            $curProfile = null;
+        }
+
+        if (!$this->notice->inScope($curProfile)) {
+            // TRANS: Client exception thrown when trying a view a notice the user has no access to.
+            throw new ClientException(_('Not available.'), 403);
         }
 
         $this->profile = $this->notice->getProfile();
@@ -109,6 +107,33 @@ class ShownoticeAction extends OwnerDesignAction
         return true;
     }
 
+    /**
+     * Fetch the notice to show. This may be overridden by child classes to
+     * customize what we fetch without duplicating all of the prepare() method.
+     *
+     * @return Notice
+     */
+    function getNotice()
+    {
+        $id = $this->arg('notice');
+
+        $notice = Notice::staticGet('id', $id);
+
+        if (empty($notice)) {
+            // Did we used to have it, and it got deleted?
+            $deleted = Deleted_notice::staticGet($id);
+            if (!empty($deleted)) {
+                // TRANS: Client error displayed trying to show a deleted notice.
+                $this->clientError(_('Notice deleted.'), 410);
+            } else {
+                // TRANS: Client error displayed trying to show a non-existing notice.
+                $this->clientError(_('No such notice.'), 404);
+            }
+            return false;
+        }
+        return $notice;
+    }
+
     /**
      * Is this action read-only?
      *