Issue 13221: Diaspora posts are now stored correctly

[friendica.git] / src / Security / Security.php

diff --git a/src/Security/Security.php b/src/Security/Security.php
index a75b9168b56c623dc16108a2fc542b47763427cd..0774491d02f8fb7b7284f27589dd148b811bb326 100644 (file)
--- a/src/Security/Security.php
+++ b/src/Security/Security.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * @copyright Copyright (C) 2020, Friendica
+ * @copyright Copyright (C) 2010-2023, the Friendica project
  *
  * @license GNU AGPL version 3 or any later version
  *
@@ -22,10 +22,10 @@
 namespace Friendica\Security;
 
 use Friendica\Database\DBA;
+use Friendica\DI;
 use Friendica\Model\Contact;
-use Friendica\Model\Group;
+use Friendica\Model\Circle;
 use Friendica\Model\User;
-use Friendica\Core\Session;
 
 /**
  * Secures that User is allow to do requests
@@ -36,20 +36,20 @@ class Security
        {
                static $verified = 0;
 
-               if (!Session::isAuthenticated()) {
+               if (!DI::userSession()->isAuthenticated()) {
                        return false;
                }
 
-               $uid = local_user();
+               $uid = DI::userSession()->getLocalUserId();
                if ($uid == $owner) {
                        return true;
                }
 
-               if (local_user() && ($owner == 0)) {
+               if (DI::userSession()->getLocalUserId() && ($owner == 0)) {
                        return true;
                }
 
-               if (!empty(Session::getRemoteContactID($owner))) {
+               if (!empty($cid = DI::userSession()->getRemoteContactID($owner))) {
                        // use remembered decision and avoid a DB lookup for each and every display item
                        // DO NOT use this function if there are going to be multiple owners
                        // We have a contact-id for an authenticated remote user, this block determines if the contact
@@ -60,22 +60,19 @@ class Security
                        } elseif ($verified === 1) {
                                return false;
                        } else {
-                               $cid = Session::getRemoteContactID($owner);
-                               if (!$cid) {
+                               $user = User::getById($owner);
+                               if (!$user || $user['blockwall']) {
+                                       $verified = 1;
                                        return false;
                                }
 
-                               $r = q("SELECT `contact`.*, `user`.`page-flags` FROM `contact` INNER JOIN `user` on `user`.`uid` = `contact`.`uid`
-                                       WHERE `contact`.`uid` = %d AND `contact`.`id` = %d AND `contact`.`blocked` = 0 AND `contact`.`pending` = 0
-                                       AND `user`.`blockwall` = 0 AND `readonly` = 0  AND (`contact`.`rel` IN (%d , %d) OR `user`.`page-flags` = %d) LIMIT 1",
-                                       intval($owner),
-                                       intval($cid),
-                                       intval(Contact::SHARING),
-                                       intval(Contact::FRIEND),
-                                       intval(User::PAGE_FLAGS_COMMUNITY)
-                               );
-
-                               if (DBA::isResult($r)) {
+                               $contact = Contact::getById($cid);
+                               if ($contact || $contact['blocked'] || $contact['readonly'] || $contact['pending']) {
+                                       $verified = 1;
+                                       return false;
+                               }
+
+                               if (in_array($contact['rel'], [Contact::SHARING, Contact::FRIEND]) || ($user['page-flags'] == User::PAGE_FLAGS_COMMUNITY)) {
                                        $verified = 2;
                                        return true;
                                } else {
@@ -96,8 +93,8 @@ class Security
         */
        public static function getPermissionsSQLByUserId(int $owner_id, bool $accessible = false)
        {
-               $local_user = local_user();
-               $remote_contact = Session::getRemoteContactID($owner_id);
+               $local_user = DI::userSession()->getLocalUserId();
+               $remote_contact = DI::userSession()->getRemoteContactID($owner_id);
                $acc_sql = '';
 
                if ($accessible) {
@@ -120,17 +117,13 @@ class Security
                if ($local_user && $local_user == $owner_id) {
                        $sql = '';
                /*
-                * Authenticated visitor. Load the groups the visitor belongs to.
+                * Authenticated visitor. Load the circles the visitor belongs to.
                 */
                } elseif ($remote_contact) {
-                       $gs = '<<>>'; // should be impossible to match
-
-                       $groups = Group::getIdsByContactId($remote_contact);
+                       $circleIds = '<<>>'; // should be impossible to match
 
-                       if (is_array($groups)) {
-                               foreach ($groups as $g) {
-                                       $gs .= '|<' . intval($g) . '>';
-                               }
+                       foreach (Circle::getIdsByContactId($remote_contact) as $circleId) {
+                               $circleIds .= '|<' . intval($circleId) . '>';
                        }
 
                        $sql = sprintf(
@@ -138,9 +131,9 @@ class Security
                                  AND (allow_cid REGEXP '<%d>' OR allow_gid REGEXP '%s'
                                  OR (allow_cid = '' AND allow_gid = ''))" . $acc_sql . ") ",
                                intval($remote_contact),
-                               DBA::escape($gs),
+                               DBA::escape($circleIds),
                                intval($remote_contact),
-                               DBA::escape($gs)
+                               DBA::escape($circleIds)
                        );
                }
                return $sql;