Prevent settings/userexport to be used by anonymous users

[friendica.git] / src / Repository / PermissionSet.php

diff --git a/src/Repository/PermissionSet.php b/src/Repository/PermissionSet.php
index 27c77d605254b2b4778bce65e92daf629e2e9cbd..c83e901765daa05e546993d7e6d68ff492d42267 100644 (file)
--- a/src/Repository/PermissionSet.php
+++ b/src/Repository/PermissionSet.php
@@ -1,4 +1,23 @@
 <?php
+/**
+ * @copyright Copyright (C) 2010-2021, the Friendica project
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ */
 
 namespace Friendica\Repository;
 
@@ -6,13 +25,15 @@ use Friendica\BaseRepository;
 use Friendica\Collection;
 use Friendica\Database\Database;
 use Friendica\Model;
-use Friendica\Model\Group;
 use Friendica\Network\HTTPException;
 use Friendica\Util\ACLFormatter;
 use Psr\Log\LoggerInterface;
 
 class PermissionSet extends BaseRepository
 {
+       /** @var int Virtual permission set id for public permission */
+       const PUBLIC = 0;
+
        protected static $table_name = 'permissionset';
 
        protected static $model_class = Model\PermissionSet::class;
@@ -47,7 +68,7 @@ class PermissionSet extends BaseRepository
        {
                if (isset($condition['id']) && !$condition['id']) {
                        return $this->create([
-                               'id' => 0,
+                               'id' => self::PUBLIC,
                                'uid' => $condition['uid'] ?? 0,
                                'allow_cid' => '',
                                'allow_gid' => '',
@@ -61,29 +82,27 @@ class PermissionSet extends BaseRepository
 
        /**
         * @param array $condition
-        * @param array $order An optional array with order information
-        * @param int|array $limit Optional limit information
-        *
+        * @param array $params
         * @return Collection\PermissionSets
         * @throws \Exception
         */
-       public function select(array $condition = [], array $order = [], $limit = null)
+       public function select(array $condition = [], array $params = [])
        {
-               return parent::select($condition, $order, $limit);
+               return parent::select($condition, $params);
        }
 
        /**
-        * @param array $condition
-        * @param array $order
+        * @param array    $condition
+        * @param array    $params
+        * @param int|null $min_id
         * @param int|null $max_id
-        * @param int|null $since_id
-        * @param int|array $limit
+        * @param int      $limit
         * @return Collection\PermissionSets
         * @throws \Exception
         */
-       public function selectByBoundaries(array $condition = [], array $order = [], int $max_id = null, int $since_id = null, int $limit = self::LIMIT)
+       public function selectByBoundaries(array $condition = [], array $params = [], int $min_id = null, int $max_id = null, int $limit = self::LIMIT)
        {
-               return parent::selectByBoundaries($condition, $order, $max_id, $since_id, $limit);
+               return parent::selectByBoundaries($condition, $params, $min_id, $max_id, $limit);
        }
 
        /**
@@ -111,7 +130,7 @@ class PermissionSet extends BaseRepository
 
                // Public permission
                if (!$allow_cid && !$allow_gid && !$deny_cid && !$deny_gid) {
-                       return 0;
+                       return self::PUBLIC;
                }
 
                $condition = [
@@ -142,9 +161,19 @@ class PermissionSet extends BaseRepository
         */
        public function selectByContactId($contact_id, $uid)
        {
+               $cdata = Model\Contact::getPublicAndUserContacID($contact_id, $uid);
+               if (!empty($cdata)) {
+                       $public_contact_str = '<' . $cdata['public'] . '>';
+                       $user_contact_str = '<' . $cdata['user'] . '>';
+                       $contact_id = $cdata['user'];
+               } else {
+                       $public_contact_str = '<' . $contact_id . '>';
+                       $user_contact_str = '';
+               }
+
                $groups = [];
-               if ($this->dba->exists('contact', ['id' => $contact_id, 'uid' => $uid, 'blocked' => false])) {
-                       $groups = Group::getIdsByContactId($contact_id);
+               if (!empty($user_contact_str) && $this->dba->exists('contact', ['id' => $contact_id, 'uid' => $uid, 'blocked' => false])) {
+                       $groups = Model\Group::getIdsByContactId($contact_id);
                }
 
                $group_str = '<<>>'; // should be impossible to match
@@ -152,11 +181,16 @@ class PermissionSet extends BaseRepository
                        $group_str .= '|<' . preg_quote($group_id) . '>';
                }
 
-               $contact_str = '<' . $contact_id . '>';
-
-               $condition = ["`uid` = ? AND (NOT (`deny_cid` REGEXP ? OR deny_gid REGEXP ?)
-                       AND (allow_cid REGEXP ? OR allow_gid REGEXP ? OR (allow_cid = '' AND allow_gid = '')))",
-                       $uid, $contact_str, $group_str, $contact_str, $group_str];
+               if (!empty($user_contact_str)) {
+                       $condition = ["`uid` = ? AND (NOT (`deny_cid` REGEXP ? OR `deny_cid` REGEXP ? OR deny_gid REGEXP ?)
+                               AND (allow_cid REGEXP ? OR allow_cid REGEXP ? OR allow_gid REGEXP ? OR (allow_cid = '' AND allow_gid = '')))",
+                               $uid, $user_contact_str, $public_contact_str, $group_str,
+                               $user_contact_str, $public_contact_str, $group_str];
+               } else {
+                       $condition = ["`uid` = ? AND (NOT (`deny_cid` REGEXP ? OR deny_gid REGEXP ?)
+                               AND (allow_cid REGEXP ? OR allow_gid REGEXP ? OR (allow_cid = '' AND allow_gid = '')))",
+                               $uid, $public_contact_str, $group_str, $public_contact_str, $group_str];
+               }
 
                return $this->select($condition);
        }