X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=include%2Fsecurity.php;h=2063bdd16253d56b19343e62c02ba01520cd60ac;hb=ac1ff6c8ce9f23eebf5e53ce799c3b8b84d6de93;hp=ad76509fdd6a1cc865d3ddcb222f3bad7016e31e;hpb=ecea7425f8ad11ace4af39d476919e3203bff44f;p=friendica.git

diff --git a/include/security.php b/include/security.php
index ad76509fdd..2063bdd162 100644
--- a/include/security.php
+++ b/include/security.php
@@ -9,8 +9,10 @@ use Friendica\Core\L10n;
 use Friendica\Core\PConfig;
 use Friendica\Core\System;
 use Friendica\Database\DBA;
+use Friendica\Model\Contact;
 use Friendica\Model\Group;
 use Friendica\Util\DateTimeFormat;
+use Friendica\Model\PermissionSet;
 
 /**
  * @brief Calculate the hash that is needed for the "Friendica" cookie
@@ -177,7 +179,7 @@ function authenticate_success($user_record, $login_initial = false, $interactive
 		 * The cookie will be renewed automatically.
 		 * The week ensures that sessions will expire after some inactivity.
 		 */
-		if ($_SESSION['remember']) {
+		if (!empty($_SESSION['remember'])) {
 			logger('Injecting cookie for remembered user ' . $a->user['nickname']);
 			new_cookie(604800, $user_record);
 			unset($_SESSION['remember']);
@@ -223,7 +225,7 @@ function can_write_wall($owner)
 		} else {
 			$cid = 0;
 
-			if (is_array($_SESSION['remote'])) {
+			if (!empty($_SESSION['remote'])) {
 				foreach ($_SESSION['remote'] as $visitor) {
 					if ($visitor['uid'] == $owner) {
 						$cid = $visitor['cid'];
@@ -241,9 +243,9 @@ function can_write_wall($owner)
 				AND `user`.`blockwall` = 0 AND `readonly` = 0  AND ( `contact`.`rel` IN ( %d , %d ) OR `user`.`page-flags` = %d ) LIMIT 1",
 				intval($owner),
 				intval($cid),
-				intval(CONTACT_IS_SHARING),
-				intval(CONTACT_IS_FRIEND),
-				intval(PAGE_COMMUNITY)
+				intval(Contact::SHARING),
+				intval(Contact::FRIEND),
+				intval(Contact::PAGE_COMMUNITY)
 			);
 
 			if (DBA::isResult($r)) {
@@ -297,11 +299,7 @@ function permissions_sql($owner_id, $remote_verified = false, $groups = null)
 		 */
 
 		if (!$remote_verified) {
-			$r = q("SELECT id FROM contact WHERE id = %d AND uid = %d AND blocked = 0 LIMIT 1",
-				intval($remote_user),
-				intval($owner_id)
-			);
-			if (DBA::isResult($r)) {
+			if (DBA::exists('contact', ['id' => $remote_user, 'uid' => $owner_id, 'blocked' => false])) {
 				$remote_verified = true;
 				$groups = Group::getIdsByContactId($remote_user);
 			}
@@ -322,9 +320,9 @@ function permissions_sql($owner_id, $remote_verified = false, $groups = null)
 				  )
 				",
 				intval($remote_user),
-				dbesc($gs),
+				DBA::escape($gs),
 				intval($remote_user),
-				dbesc($gs)
+				DBA::escape($gs)
 			);
 		}
 	}
@@ -341,12 +339,7 @@ function item_permissions_sql($owner_id, $remote_verified = false, $groups = nul
 	 *
 	 * default permissions - anonymous user
 	 */
-	$sql = " AND `item`.allow_cid = ''
-			 AND `item`.allow_gid = ''
-			 AND `item`.deny_cid  = ''
-			 AND `item`.deny_gid  = ''
-			 AND `item`.private != 1
-	";
+	$sql = " AND NOT `item`.`private`";
 
 	// Profile owner - everything is visible
 	if ($local_user && ($local_user == $owner_id)) {
@@ -359,37 +352,15 @@ function item_permissions_sql($owner_id, $remote_verified = false, $groups = nul
 		 * If pre-verified, the caller is expected to have already
 		 * done this and passed the groups into this function.
 		 */
-		if (!$remote_verified) {
-			$r = q("SELECT id FROM contact WHERE id = %d AND uid = %d AND blocked = 0 LIMIT 1",
-				intval($remote_user),
-				intval($owner_id)
-			);
-			if (DBA::isResult($r)) {
-				$remote_verified = true;
-				$groups = Group::getIdsByContactId($remote_user);
-			}
-		}
-		if ($remote_verified) {
+		$set = PermissionSet::get($owner_id, $remote_user, $groups);
 
-			$gs = '<<>>'; // should be impossible to match
-
-			if (is_array($groups) && count($groups)) {
-				foreach ($groups as $g) {
-					$gs .= '|<' . intval($g) . '>';
-				}
-			}
-
-			$sql = sprintf(
-				" AND ( `item`.private = 0 OR ( `item`.private in (1,2) AND `item`.`wall` = 1
-				  AND ( NOT (`item`.deny_cid REGEXP '<%d>' OR `item`.deny_gid REGEXP '%s')
-				  AND ( `item`.allow_cid REGEXP '<%d>' OR `item`.allow_gid REGEXP '%s' OR ( `item`.allow_cid = '' AND `item`.allow_gid = '')))))
-				",
-				intval($remote_user),
-				dbesc($gs),
-				intval($remote_user),
-				dbesc($gs)
-			);
+		if (!empty($set)) {
+			$sql_set = " OR (`item`.`private` IN (1,2) AND `item`.`wall` AND `item`.`psid` IN (" . implode(',', $set) . "))";
+		} else {
+			$sql_set = '';
 		}
+
+		$sql = " AND (NOT `item`.`private`" . $sql_set . ")";
 	}
 
 	return $sql;