Merge pull request #10731 from annando/profile-writable

[friendica.git] / src / Object / Thread.php

diff --git a/src/Object/Thread.php b/src/Object/Thread.php
index f62b14c71e665ef9bb996d5a9e376ad12e118cec..a2504a2ad170385ec9ba9bf4638bf5b5db249634 100644 (file)
--- a/src/Object/Thread.php
+++ b/src/Object/Thread.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * @copyright Copyright (C) 2020, Friendica
+ * @copyright Copyright (C) 2010-2021, the Friendica project
  *
  * @license GNU AGPL version 3 or any later version
  *
@@ -25,7 +25,7 @@ use Friendica\Core\Logger;
 use Friendica\Core\Protocol;
 use Friendica\DI;
 use Friendica\Protocol\Activity;
-use Friendica\Util\Security;
+use Friendica\Security\Security;
 
 /**
  * A list of threads
@@ -79,11 +79,11 @@ class Thread
                                $this->writable = true;
                                break;
                        case 'profile':
-                               $this->profile_owner = $a->profile['uid'];
-                               $this->writable = Security::canWriteToUserWall($this->profile_owner);
+                               $this->profile_owner = $a->getProfileOwner();
+                               $this->writable = Security::canWriteToUserWall($this->profile_owner) || $writable;
                                break;
                        case 'display':
-                               $this->profile_owner = $a->profile['uid'];
+                               $this->profile_owner = $a->getProfileOwner();
                                $this->writable = Security::canWriteToUserWall($this->profile_owner) || $writable;
                                break;
                        case 'community':
@@ -190,12 +190,13 @@ class Thread
         * We should find a way to avoid using those arguments (at least most of them)
         *
         * @param array $conv_responses data
+        * @param string $formSecurityToken A security Token to avoid CSF attacks
         *
         * @return mixed The data requested on success
         *               false on failure
         * @throws \Exception
         */
-       public function getTemplateData($conv_responses)
+       public function getTemplateData($conv_responses, string $formSecurityToken)
        {
                $result = [];
 
@@ -204,7 +205,7 @@ class Thread
                                continue;
                        }
 
-                       $item_data = $item->getTemplateData($conv_responses);
+                       $item_data = $item->getTemplateData($conv_responses, $formSecurityToken);
 
                        if (!$item_data) {
                                Logger::log('[ERROR] Conversation::getTemplateData : Failed to get item template data ('. $item->getId() .').', Logger::DEBUG);