New function "isAuthenticated"

[friendica.git] / src / Util / Security.php

diff --git a/src/Util/Security.php b/src/Util/Security.php
index 1c934d6fe617c741d9d6b47316570ea2ebe7b74b..043c59d84f20a0fd1ed1023dd48dcd1ff9829017 100644 (file)
--- a/src/Util/Security.php
+++ b/src/Util/Security.php
@@ -10,6 +10,7 @@ use Friendica\Database\DBA;
 use Friendica\Model\Contact;
 use Friendica\Model\Group;
 use Friendica\Model\User;
+use Friendica\Core\Session;
 
 /**
  * Secures that User is allow to do requests
@@ -20,7 +21,7 @@ class Security extends BaseObject
        {
                static $verified = 0;
 
-               if (!local_user() && !remote_user()) {
+               if (!Session::isAuthenticated()) {
                        return false;
                }
 
@@ -33,7 +34,7 @@ class Security extends BaseObject
                        return true;
                }
 
-               if (remote_user()) {
+               if (!empty(Session::getRemoteContactID($owner))) {
                        // use remembered decision and avoid a DB lookup for each and every display item
                        // DO NOT use this function if there are going to be multiple owners
                        // We have a contact-id for an authenticated remote user, this block determines if the contact
@@ -44,24 +45,14 @@ class Security extends BaseObject
                        } elseif ($verified === 1) {
                                return false;
                        } else {
-                               $cid = 0;
-
-                               if (!empty($_SESSION['remote'])) {
-                                       foreach ($_SESSION['remote'] as $visitor) {
-                                               if ($visitor['uid'] == $owner) {
-                                                       $cid = $visitor['cid'];
-                                                       break;
-                                               }
-                                       }
-                               }
-
+                               $cid = Session::getRemoteContactID($owner);
                                if (!$cid) {
                                        return false;
                                }
 
                                $r = q("SELECT `contact`.*, `user`.`page-flags` FROM `contact` INNER JOIN `user` on `user`.`uid` = `contact`.`uid`
                                        WHERE `contact`.`uid` = %d AND `contact`.`id` = %d AND `contact`.`blocked` = 0 AND `contact`.`pending` = 0
-                                       AND `user`.`blockwall` = 0 AND `readonly` = 0  AND ( `contact`.`rel` IN ( %d , %d ) OR `user`.`page-flags` = %d ) LIMIT 1",
+                                       AND `user`.`blockwall` = 0 AND `readonly` = 0  AND (`contact`.`rel` IN (%d , %d) OR `user`.`page-flags` = %d) LIMIT 1",
                                        intval($owner),
                                        intval($cid),
                                        intval(Contact::SHARING),
@@ -81,11 +72,10 @@ class Security extends BaseObject
                return false;
        }
 
-       /// @TODO $groups should be array
-       public static function getPermissionsSQLByUserId($owner_id, $remote_verified = false, $groups = null)
+       public static function getPermissionsSQLByUserId($owner_id)
        {
                $local_user = local_user();
-               $remote_user = remote_user();
+               $remote_contact = Session::getRemoteContactID($owner_id);
 
                /*
                 * Construct permissions
@@ -93,10 +83,9 @@ class Security extends BaseObject
                 * default permissions - anonymous user
                 */
                $sql = " AND allow_cid = ''
-                                AND allow_gid = ''
-                                AND deny_cid  = ''
-                                AND deny_gid  = ''
-               ";
+                        AND allow_gid = ''
+                        AND deny_cid  = ''
+                        AND deny_gid  = '' ";
 
                /*
                 * Profile owner - everything is visible
@@ -104,59 +93,28 @@ class Security extends BaseObject
                if ($local_user && $local_user == $owner_id) {
                        $sql = '';
                /*
-                * Authenticated visitor. Unless pre-verified,
-                * check that the contact belongs to this $owner_id
-                * and load the groups the visitor belongs to.
-                * If pre-verified, the caller is expected to have already
-                * done this and passed the groups into this function.
+                * Authenticated visitor. Load the groups the visitor belongs to.
                 */
-               } elseif ($remote_user) {
-                       /*
-                        * Authenticated visitor. Unless pre-verified,
-                        * check that the contact belongs to this $owner_id
-                        * and load the groups the visitor belongs to.
-                        * If pre-verified, the caller is expected to have already
-                        * done this and passed the groups into this function.
-                        */
-
-                       if (!$remote_verified) {
-                               $cid = 0;
-
-                               foreach (\Friendica\Core\Session::get('remote', []) as $visitor) {
-                                       if ($visitor['uid'] == $owner_id) {
-                                               $cid = $visitor['cid'];
-                                               break;
-                                       }
-                               }
-
-                               if ($cid && DBA::exists('contact', ['id' => $cid, 'uid' => $owner_id, 'blocked' => false])) {
-                                       $remote_verified = true;
-                                       $groups = Group::getIdsByContactId($cid);
-                               }
-                       }
+               } elseif ($remote_contact) {
+                       $gs = '<<>>'; // should be impossible to match
 
-                       if ($remote_verified) {
-                               $gs = '<<>>'; // should be impossible to match
+                       $groups = Group::getIdsByContactId($remote_contact);
 
-                               if (is_array($groups)) {
-                                       foreach ($groups as $g) {
-                                               $gs .= '|<' . intval($g) . '>';
-                                       }
+                       if (is_array($groups)) {
+                               foreach ($groups as $g) {
+                                       $gs .= '|<' . intval($g) . '>';
                                }
-
-                               $sql = sprintf(
-                                       " AND ( NOT (deny_cid REGEXP '<%d>' OR deny_gid REGEXP '%s')
-                                         AND ( allow_cid REGEXP '<%d>' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') )
-                                         )
-                                       ",
-                                       intval($cid),
-                                       DBA::escape($gs),
-                                       intval($cid),
-                                       DBA::escape($gs)
-                               );
                        }
+
+                       $sql = sprintf(
+                               " AND (NOT (deny_cid REGEXP '<%d>' OR deny_gid REGEXP '%s')
+                                 AND (allow_cid REGEXP '<%d>' OR allow_gid REGEXP '%s' OR (allow_cid = '' AND allow_gid = ''))) ",
+                               intval($remote_contact),
+                               DBA::escape($gs),
+                               intval($remote_contact),
+                               DBA::escape($gs)
+                       );
                }
                return $sql;
        }
-
 }