Merge branch 'pull'

[friendica.git] / mod / photos.php

diff --git a/mod/photos.php b/mod/photos.php
index 2cd4e262282552c706c64bd06aa95473774def18..cb13b760364e72df276db5c3db5dc8eeeef0e074 100644 (file)
--- a/mod/photos.php
+++ b/mod/photos.php
@@ -3,6 +3,7 @@ require_once('include/Photo.php');
 require_once('include/items.php');
 require_once('include/acl_selectors.php');
 require_once('include/bbcode.php');
+require_once('include/security.php');
 
 function photos_init(&$a) {
 
@@ -23,7 +24,9 @@ function photos_init(&$a) {
 
                $a->data['user'] = $r[0];
 
-               $albums = q("SELECT distinct(`album`) AS `album` FROM `photo` WHERE `uid` = %d",
+               $sql_extra = permissions_sql($a->data['user']['uid']);
+
+               $albums = q("SELECT distinct(`album`) AS `album` FROM `photo` WHERE `uid` = %d $sql_extra ",
                        intval($a->data['user']['uid'])
                );
 
@@ -380,6 +383,8 @@ function photos_post(&$a) {
 
                        if(count($tags)) {
                                foreach($tags as $tag) {
+                                       if(isset($profile))
+                                               unset($profile);
                                        if(strpos($tag,'@') === 0) {
                                                $name = substr($tag,1);
                                                if((strpos($name,'@')) || (strpos($name,'http://'))) {
@@ -401,7 +406,7 @@ function photos_post(&$a) {
                                                }
                                                else {
                                                        $newname = $name;
-                                                       if(strstr($name,'_')) {
+                                                       if(strstr($name,'_') || strstr($name,' ')) {
                                                                $newname = str_replace('_',' ',$name);
                                                                $r = q("SELECT * FROM `contact` WHERE `name` = '%s' AND `uid` = %d LIMIT 1",
                                                                        dbesc($newname),
@@ -770,8 +775,6 @@ function photos_content(&$a) {
 
        $owner_uid = $a->data['user']['uid'];
 
-
-
        $community_page = (($a->data['user']['page-flags'] == PAGE_COMMUNITY) ? true : false);
 
        if((local_user()) && (local_user() == $owner_uid))
@@ -813,43 +816,12 @@ function photos_content(&$a) {
                }
        }
 
-       $r = q("SELECT `hidewall` FROM `profile` WHERE `uid` = %d AND `is-default` = 1 LIMIT 1",
-               intval($owner_uid)
-       );
-
-       if(count($r) && $r[0]['hidewall'] && (local_user() != $owner_uid) && (! $remote_contact)) {
+       if($a->data['user']['hidewall'] && (local_user() != $owner_uid) && (! $remote_contact)) {
                notice( t('Access to this item is restricted.') . EOL);
                return;
        }
 
-       // default permissions - anonymous user
-
-       $sql_extra = " AND `allow_cid` = '' AND `allow_gid` = '' AND `deny_cid` = '' AND `deny_gid` = '' ";
-
-       // Profile owner - everything is visible
-
-       if(local_user() && (local_user() == $owner_uid)) {
-               $sql_extra = '';        
-       }
-       elseif(remote_user()) {
-               // authenticated visitor - here lie dragons
-               $gs = '<<>>'; // should be impossible to match
-               if(count($groups)) {
-                       foreach($groups as $g)
-                               $gs .= '|<' . intval($g) . '>';
-               } 
-               $sql_extra = sprintf(
-                       " AND ( `allow_cid` = '' OR `allow_cid` REGEXP '<%d>' ) 
-                         AND ( `deny_cid`  = '' OR  NOT `deny_cid` REGEXP '<%d>' ) 
-                         AND ( `allow_gid` = '' OR `allow_gid` REGEXP '%s' )
-                         AND ( `deny_gid`  = '' OR NOT `deny_gid` REGEXP '%s') ",
-
-                       intval(remote_user()),
-                       intval(remote_user()),
-                       dbesc($gs),
-                       dbesc($gs)
-               );
-       }
+       $sql_extra = permissions_sql($owner_uid,$remote_contact,$groups);
 
        $o = "";
 
@@ -931,7 +903,7 @@ function photos_content(&$a) {
                $album = hex2bin($datum);
 
                $r = q("SELECT `resource-id`, max(`scale`) AS `scale` FROM `photo` WHERE `uid` = %d AND `album` = '%s' 
-                       $sql_extra GROUP BY `resource-id`",
+                       AND `scale` <= 4 $sql_extra GROUP BY `resource-id`",
                        intval($owner_uid),
                        dbesc($album)
                );
@@ -941,7 +913,7 @@ function photos_content(&$a) {
                }
 
                $r = q("SELECT `resource-id`, `id`, `filename`, max(`scale`) AS `scale`, `desc` FROM `photo` WHERE `uid` = %d AND `album` = '%s' 
-                       $sql_extra GROUP BY `resource-id` ORDER BY `created` DESC LIMIT %d , %d",
+                       AND `scale` <= 4 $sql_extra GROUP BY `resource-id` ORDER BY `created` DESC LIMIT %d , %d",
                        intval($owner_uid),
                        dbesc($album),
                        intval($a->pager['start']),
@@ -1134,6 +1106,7 @@ function photos_content(&$a) {
                }
 
                $tags=Null;
+
                if(count($linked_items) && strlen($link_item['tag'])) {
                        $arr = explode(',',$link_item['tag']);
                        // parse tags and add links