Merge pull request #9711 from MrPetovan/bug/fatal-errors

[friendica.git] / mod / item.php

diff --git a/mod/item.php b/mod/item.php
index f192d9525a0e56489400938dc3ec95ee29031bb8..ed4e50348d0d0d00263864c9b05fb1ba92c15694 100644 (file)
--- a/mod/item.php
+++ b/mod/item.php
@@ -50,6 +50,7 @@ use Friendica\Model\Notify\Type;
 use Friendica\Model\Photo;
 use Friendica\Model\Post;
 use Friendica\Model\Tag;
+use Friendica\Model\User;
 use Friendica\Network\HTTPException;
 use Friendica\Object\EMail\ItemCCEMail;
 use Friendica\Protocol\Activity;
@@ -81,8 +82,6 @@ function item_post(App $a) {
 
        $api_source = $_REQUEST['api_source'] ?? false;
 
-       $message_id = ((!empty($_REQUEST['message_id']) && $api_source) ? strip_tags($_REQUEST['message_id']) : '');
-
        $return_path = $_REQUEST['return'] ?? '';
        $preview = intval($_REQUEST['preview'] ?? 0);
 
@@ -176,14 +175,6 @@ function item_post(App $a) {
                $profile_uid = $toplevel_user_id;
        }
 
-       // Check for multiple posts with the same message id (when the post was created via API)
-       if (($message_id != '') && ($profile_uid != 0)) {
-               if (Item::exists(['uri' => $message_id, 'uid' => $profile_uid])) {
-                       Logger::info('Message already exists for user', ['uri' => $message_id, 'uid' => $profile_uid]);
-                       return 0;
-               }
-       }
-
        // Allow commenting if it is an answer to a public post
        $allow_comment = local_user() && ($profile_uid == 0) && $toplevel_item_id && in_array($toplevel_item['network'], Protocol::FEDERATED);
 
@@ -205,8 +196,7 @@ function item_post(App $a) {
                $orig_post = Item::selectFirst(Item::ITEM_FIELDLIST, ['id' => $post_id]);
        }
 
-       $user = DBA::selectFirst('user', [], ['uid' => $profile_uid]);
-
+       $user = User::getById($profile_uid, ['allow_cid', 'allow_gid', 'deny_cid', 'deny_gid']);
        if (!DBA::isResult($user) && !$toplevel_item_id) {
                return 0;
        }
@@ -271,17 +261,21 @@ function item_post(App $a) {
                $guid              = $orig_post['guid'];
                $extid             = $orig_post['extid'];
        } else {
-               $str_contact_allow = '';
-               $str_group_allow   = '';
-               $str_contact_deny  = '';
-               $str_group_deny    = '';
-
-               if (($_REQUEST['visibility'] ?? '') !== 'public') {
-                       $aclFormatter = DI::aclFormatter();
-                       $str_contact_allow = isset($_REQUEST['contact_allow']) ? $aclFormatter->toString($_REQUEST['contact_allow']) : $user['allow_cid'] ?? '';
-                       $str_group_allow   = isset($_REQUEST['group_allow'])   ? $aclFormatter->toString($_REQUEST['group_allow'])   : $user['allow_gid'] ?? '';
-                       $str_contact_deny  = isset($_REQUEST['contact_deny'])  ? $aclFormatter->toString($_REQUEST['contact_deny'])  : $user['deny_cid']  ?? '';
-                       $str_group_deny    = isset($_REQUEST['group_deny'])    ? $aclFormatter->toString($_REQUEST['group_deny'])    : $user['deny_gid']  ?? '';
+               $aclFormatter = DI::aclFormatter();
+               $str_contact_allow = isset($_REQUEST['contact_allow']) ? $aclFormatter->toString($_REQUEST['contact_allow']) : $user['allow_cid'] ?? '';
+               $str_group_allow   = isset($_REQUEST['group_allow'])   ? $aclFormatter->toString($_REQUEST['group_allow'])   : $user['allow_gid'] ?? '';
+               $str_contact_deny  = isset($_REQUEST['contact_deny'])  ? $aclFormatter->toString($_REQUEST['contact_deny'])  : $user['deny_cid']  ?? '';
+               $str_group_deny    = isset($_REQUEST['group_deny'])    ? $aclFormatter->toString($_REQUEST['group_deny'])    : $user['deny_gid']  ?? '';
+
+               $visibility = $_REQUEST['visibility'] ?? '';
+               if ($visibility === 'public') {
+                       // The ACL selector introduced in version 2019.12 sends ACL input data even when the Public visibility is selected
+                       $str_contact_allow = $str_group_allow = $str_contact_deny = $str_group_deny = '';
+               } else if ($visibility === 'custom') {
+                       // Since we know from the visibility parameter the item should be private, we have to prevent the empty ACL
+                       // case that would make it public. So we always append the author's contact id to the allowed contacts.
+                       // See https://github.com/friendica/friendica/issues/9672
+                       $str_contact_allow .= $aclFormatter->toString(Contact::getPublicIdByUserId($uid));
                }
 
                $title             = trim($_REQUEST['title']    ?? '');
@@ -562,7 +556,7 @@ function item_post(App $a) {
                $origin = $_REQUEST['origin'];
        }
 
-       $uri = ($message_id ? $message_id : Item::newURI($api_source ? $profile_uid : $uid, $guid));
+       $uri = Item::newURI($api_source ? $profile_uid : $uid, $guid);
 
        // Fallback so that we alway have a parent uri
        if (!$thr_parent_uri || !$toplevel_item_id) {
@@ -628,7 +622,7 @@ function item_post(App $a) {
        $datarray['api_source'] = $api_source;
 
        // This field is for storing the raw conversation data
-       $datarray['protocol'] = Conversation::PARCEL_DFRN;
+       $datarray['protocol'] = Conversation::PARCEL_DIRECT;
 
        $conversation = DBA::selectFirst('conversation', ['conversation-uri', 'conversation-href'], ['item-uri' => $datarray['thr-parent']]);
        if (DBA::isResult($conversation)) {
@@ -760,7 +754,7 @@ function item_post(App $a) {
                                'type'  => Type::COMMENT,
                                'otype' => Notify\ObjectType::ITEM,
                                'verb'  => Activity::POST,
-                               'uid'   => $user['uid'],
+                               'uid'   => $profile_uid,
                                'cid'   => $datarray['author-id'],
                                'item'  => $datarray,
                                'link'  => DI::baseUrl() . '/display/' . urlencode($datarray['guid']),
@@ -770,7 +764,7 @@ function item_post(App $a) {
                                'type'  => Type::WALL,
                                'otype' => Notify\ObjectType::ITEM,
                                'verb'  => Activity::POST,
-                               'uid'   => $user['uid'],
+                               'uid'   => $profile_uid,
                                'cid'   => $datarray['author-id'],
                                'item'  => $datarray,
                                'link'  => DI::baseUrl() . '/display/' . urlencode($datarray['guid']),