<?php
/**
- * @copyright Copyright (C) 2010-2022, the Friendica project
+ * @copyright Copyright (C) 2010-2023, the Friendica project
*
* @license GNU AGPL version 3 or any later version
*
namespace Friendica\Security;
use Friendica\Database\DBA;
+use Friendica\DI;
use Friendica\Model\Contact;
-use Friendica\Model\Group;
+use Friendica\Model\Circle;
use Friendica\Model\User;
-use Friendica\Core\Session;
/**
* Secures that User is allow to do requests
{
static $verified = 0;
- if (!Session::isAuthenticated()) {
+ if (!DI::userSession()->isAuthenticated()) {
return false;
}
- $uid = local_user();
+ $uid = DI::userSession()->getLocalUserId();
if ($uid == $owner) {
return true;
}
- if (local_user() && ($owner == 0)) {
+ if (DI::userSession()->getLocalUserId() && ($owner == 0)) {
return true;
}
- if (!empty($cid = Session::getRemoteContactID($owner))) {
+ if (!empty($cid = DI::userSession()->getRemoteContactID($owner))) {
// use remembered decision and avoid a DB lookup for each and every display item
// DO NOT use this function if there are going to be multiple owners
// We have a contact-id for an authenticated remote user, this block determines if the contact
$verified = 1;
return false;
}
-
+
if (in_array($contact['rel'], [Contact::SHARING, Contact::FRIEND]) || ($user['page-flags'] == User::PAGE_FLAGS_COMMUNITY)) {
$verified = 2;
return true;
*/
public static function getPermissionsSQLByUserId(int $owner_id, bool $accessible = false)
{
- $local_user = local_user();
- $remote_contact = Session::getRemoteContactID($owner_id);
+ $local_user = DI::userSession()->getLocalUserId();
+ $remote_contact = DI::userSession()->getRemoteContactID($owner_id);
$acc_sql = '';
if ($accessible) {
if ($local_user && $local_user == $owner_id) {
$sql = '';
/*
- * Authenticated visitor. Load the groups the visitor belongs to.
+ * Authenticated visitor. Load the circles the visitor belongs to.
*/
} elseif ($remote_contact) {
- $gs = '<<>>'; // should be impossible to match
-
- $groups = Group::getIdsByContactId($remote_contact);
+ $circleIds = '<<>>'; // should be impossible to match
- if (is_array($groups)) {
- foreach ($groups as $g) {
- $gs .= '|<' . intval($g) . '>';
- }
+ foreach (Circle::getIdsByContactId($remote_contact) as $circleId) {
+ $circleIds .= '|<' . intval($circleId) . '>';
}
$sql = sprintf(
AND (allow_cid REGEXP '<%d>' OR allow_gid REGEXP '%s'
OR (allow_cid = '' AND allow_gid = ''))" . $acc_sql . ") ",
intval($remote_contact),
- DBA::escape($gs),
+ DBA::escape($circleIds),
intval($remote_contact),
- DBA::escape($gs)
+ DBA::escape($circleIds)
);
}
return $sql;