Fixing #10699 (prohibits blocking and ignoreing from the photo menu)

[friendica.git] / src / Object / Post.php

diff --git a/src/Object/Post.php b/src/Object/Post.php
index 8ffe4bbafdfa64690460aab6cc3f0416cfb2ba36..5722582d2104fa67cd524267ae224906bb52e91d 100644 (file)
--- a/src/Object/Post.php
+++ b/src/Object/Post.php
@@ -125,6 +125,7 @@ class Post
         * Get data in a form usable by a conversation template
         *
         * @param array   $conv_responses conversation responses
+        * @param string $formSecurityToken A security Token to avoid CSF attacks
         * @param integer $thread_level   default = 1
         *
         * @return mixed The data requested on success
@@ -132,7 +133,7 @@ class Post
         * @throws \Friendica\Network\HTTPException\InternalServerErrorException
         * @throws \ImagickException
         */
-       public function getTemplateData(array $conv_responses, $thread_level = 1)
+       public function getTemplateData(array $conv_responses, string $formSecurityToken, $thread_level = 1)
        {
                $a = DI::app();
 
@@ -236,7 +237,7 @@ class Post
                        ];
                }
 
-               $filer = (($conv->getProfileOwner() == local_user() && ($item['uid'] != 0)) ? DI::l10n()->t('Save to folder') : false);
+               $filer = local_user() ? DI::l10n()->t('Save to folder') : false;
 
                $profile_name = $item['author-name'];
                if (!empty($item['author-link']) && empty($item['author-name'])) {
@@ -296,7 +297,7 @@ class Post
                $tagger = '';
 
                if ($this->isToplevel()) {
-                       if(local_user()) {
+                       if (local_user()) {
                                $ignored = PostModel\ThreadUser::getIgnored($item['uri-id'], local_user());
                                if ($item['mention'] || $ignored) {
                                        $ignore = [
@@ -309,6 +310,17 @@ class Post
                                        ];
                                }
 
+                               $isstarred = (($item['starred']) ? "starred" : "unstarred");
+
+                               $star = [
+                                       'do'        => DI::l10n()->t('Add star'),
+                                       'undo'      => DI::l10n()->t('Remove star'),
+                                       'toggle'    => DI::l10n()->t('Toggle star status'),
+                                       'classdo'   => $item['starred'] ? "hidden" : "",
+                                       'classundo' => $item['starred'] ? "" : "hidden",
+                                       'starred'   => DI::l10n()->t('Starred'),
+                               ];
+
                                if ($conv->getProfileOwner() == local_user() && ($item['uid'] != 0)) {
                                        if ($origin) {
                                                $ispinned = ($item['pinned'] ? 'pinned' : 'unpinned');
@@ -323,17 +335,6 @@ class Post
                                                ];
                                        }
 
-                                       $isstarred = (($item['starred']) ? "starred" : "unstarred");
-
-                                       $star = [
-                                               'do'        => DI::l10n()->t('Add star'),
-                                               'undo'      => DI::l10n()->t('Remove star'),
-                                               'toggle'    => DI::l10n()->t('Toggle star status'),
-                                               'classdo'   => $item['starred'] ? "hidden" : "",
-                                               'classundo' => $item['starred'] ? "" : "hidden",
-                                               'starred'   => DI::l10n()->t('Starred'),
-                                       ];
-
                                        $tagger = [
                                                'add'   => DI::l10n()->t('Add tag'),
                                                'class' => "",
@@ -366,7 +367,7 @@ class Post
 
                $body_html = Item::prepareBody($item, true);
 
-               list($categories, $folders) = DI::contentItem()->determineCategoriesTerms($item);
+               list($categories, $folders) = DI::contentItem()->determineCategoriesTerms($item, local_user());
 
                if (!empty($item['content-warning']) && DI::pConfig()->get(local_user(), 'system', 'disable_cw', false)) {
                        $title = ucfirst($item['content-warning']);
@@ -458,7 +459,7 @@ class Post
                        'vwall'           => DI::l10n()->t('via Wall-To-Wall:'),
                        'profile_url'     => $profile_link,
                        'name'            => $profile_name,
-                       'item_photo_menu_html' => item_photo_menu($item),
+                       'item_photo_menu_html' => item_photo_menu($item, $formSecurityToken),
                        'thumb'           => DI::baseUrl()->remove(Contact::getAvatarUrlForUrl($item['author-link'], $item['uid'], Proxy::SIZE_THUMB)),
                        'osparkle'        => $osparkle,
                        'sparkle'         => $sparkle,
@@ -532,7 +533,7 @@ class Post
                $nb_children = count($children);
                if ($nb_children > 0) {
                        foreach ($children as $child) {
-                               $result['children'][] = $child->getTemplateData($conv_responses, $thread_level + 1);
+                               $result['children'][] = $child->getTemplateData($conv_responses, $formSecurityToken, $thread_level + 1);
                        }
 
                        // Collapse
@@ -870,7 +871,7 @@ class Post
                        return '';
                }
 
-               $owner = User::getOwnerDataById($a->getUserId());
+               $owner = User::getOwnerDataById($a->getLoggedInUserId());
 
                if (!Feature::isEnabled(local_user(), 'explicit_mentions')) {
                        return '';