Issue 8371: Ensure to always have permissions

[friendica.git] / mod / item.php

diff --git a/mod/item.php b/mod/item.php
index 717c656d186fbac3bd2a868f55c1edc08fe12293..3566e2150ceb66416585ba7935f8ade2163cada4 100644 (file)
--- a/mod/item.php
+++ b/mod/item.php
@@ -1,9 +1,22 @@
 <?php
 /**
- * @file mod/item.php
- */
-
-/*
+ * @copyright Copyright (C) 2020, Friendica
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
  * This is the POST destination for most all locally posted
  * text stuff. This function handles status, wall-to-wall status,
  * local comments, and remote coments that are posted on this site
@@ -231,10 +244,10 @@ function item_post(App $a) {
        $body = preg_replace('#\[url=([^\]]*?)\]\[/url\]#ism', '[url]$1[/url]', $body);
 
        if (!empty($orig_post)) {
-               $str_group_allow   = $orig_post['allow_gid'];
-               $str_contact_allow = $orig_post['allow_cid'];
-               $str_group_deny    = $orig_post['deny_gid'];
-               $str_contact_deny  = $orig_post['deny_cid'];
+               $str_group_allow   = $orig_post['allow_gid'] ?? '';
+               $str_contact_allow = $orig_post['allow_cid'] ?? '';
+               $str_group_deny    = $orig_post['deny_gid']  ?? '';
+               $str_contact_deny  = $orig_post['deny_cid']  ?? '';
                $location          = $orig_post['location'];
                $coord             = $orig_post['coord'];
                $verb              = $orig_post['verb'];
@@ -248,33 +261,13 @@ function item_post(App $a) {
                $network           = $orig_post['network'];
                $guid              = $orig_post['guid'];
                $extid             = $orig_post['extid'];
-
        } else {
+               $aclFormatter = DI::aclFormatter();
 
-               /*
-                * if coming from the API and no privacy settings are set,
-                * use the user default permissions - as they won't have
-                * been supplied via a form.
-                */
-               if ($api_source
-                       && !array_key_exists('contact_allow', $_REQUEST)
-                       && !array_key_exists('group_allow', $_REQUEST)
-                       && !array_key_exists('contact_deny', $_REQUEST)
-                       && !array_key_exists('group_deny', $_REQUEST)) {
-                       $str_group_allow   = $user['allow_gid'];
-                       $str_contact_allow = $user['allow_cid'];
-                       $str_group_deny    = $user['deny_gid'];
-                       $str_contact_deny  = $user['deny_cid'];
-               } else {
-                       // use the posted permissions
-
-                       $aclFormatter = DI::aclFormatter();
-
-                       $str_group_allow   = $aclFormatter->toString($_REQUEST['group_allow'] ?? '');
-                       $str_contact_allow = $aclFormatter->toString($_REQUEST['contact_allow'] ?? '');
-                       $str_group_deny    = $aclFormatter->toString($_REQUEST['group_deny'] ?? '');
-                       $str_contact_deny  = $aclFormatter->toString($_REQUEST['contact_deny'] ?? '');
-               }
+               $str_group_allow   = isset($_REQUEST['group_allow'])   ? $aclFormatter->toString($_REQUEST['group_allow'])    : $user['allow_gid'] ?? '';
+               $str_contact_allow = isset($_REQUEST['contact_allow']) ? $aclFormatter->toString($_REQUEST['contact__allow']) : $user['allow_cid'] ?? '';
+               $str_group_deny    = isset($_REQUEST['group_deny'])    ? $aclFormatter->toString($_REQUEST['group_deny'])     : $user['deny_gid']  ?? '';
+               $str_contact_deny  = isset($_REQUEST['contact_deny'])  ? $aclFormatter->toString($_REQUEST['contact_deny'])   : $user['deny_cid']  ?? '';
 
                $title             = Strings::escapeTags(trim($_REQUEST['title']    ?? ''));
                $location          = Strings::escapeTags(trim($_REQUEST['location'] ?? ''));
@@ -287,7 +280,13 @@ function item_post(App $a) {
 
                $postopts = $_REQUEST['postopts'] ?? '';
 
-               $private = ((strlen($str_group_allow) || strlen($str_contact_allow) || strlen($str_group_deny) || strlen($str_contact_deny)) ? 1 : 0);
+               if (strlen($str_group_allow) || strlen($str_contact_allow) || strlen($str_group_deny) || strlen($str_contact_deny)) {
+                       $private = Item::PRIVATE;
+               } elseif (DI::pConfig()->get($profile_uid, 'system', 'unlisted')) {
+                       $private = Item::UNLISTED;
+               } else {
+                       $private = Item::PUBLIC;
+               }
 
                // If this is a comment, set the permissions from the parent.
 
@@ -662,7 +661,7 @@ function item_post(App $a) {
                $datarray["item_id"] = -1;
                $datarray["author-network"] = Protocol::DFRN;
 
-               $o = conversation($a, [array_merge($contact_record, $datarray)], new Pager(DI::args()->getQueryString()), 'search', false, true);
+               $o = conversation($a, [array_merge($contact_record, $datarray)], 'search', false, true);
 
                System::jsonExit(['preview' => $o]);
        }
@@ -752,7 +751,7 @@ function item_post(App $a) {
        if ($toplevel_item_id) {
                if ($contact_record != $author) {
                        notification([
-                               'type'         => NOTIFY_COMMENT,
+                               'type'         => Type::COMMENT,
                                'notify_flags' => $user['notify-flags'],
                                'language'     => $user['language'],
                                'to_name'      => $user['username'],