X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=mod%2Fphotos.php;h=cb13b760364e72df276db5c3db5dc8eeeef0e074;hb=ac6945eed1644e7a9e58c5f74dae696ff0f09d72;hp=bbdb8b7e9ecaef43598aff9c1d611732af929f8e;hpb=5de7d0f12f279aed4551d261d8f71325ca01028a;p=friendica.git
diff --git a/mod/photos.php b/mod/photos.php
index bbdb8b7e9e..cb13b76036 100644
--- a/mod/photos.php
+++ b/mod/photos.php
@@ -3,6 +3,7 @@ require_once('include/Photo.php');
require_once('include/items.php');
require_once('include/acl_selectors.php');
require_once('include/bbcode.php');
+require_once('include/security.php');
function photos_init(&$a) {
@@ -23,7 +24,9 @@ function photos_init(&$a) {
$a->data['user'] = $r[0];
- $albums = q("SELECT distinct(`album`) AS `album` FROM `photo` WHERE `uid` = %d",
+ $sql_extra = permissions_sql($a->data['user']['uid']);
+
+ $albums = q("SELECT distinct(`album`) AS `album` FROM `photo` WHERE `uid` = %d $sql_extra ",
intval($a->data['user']['uid'])
);
@@ -35,7 +38,11 @@ function photos_init(&$a) {
$o .= '
';
foreach($albums as $album) {
- if((! strlen($album['album'])) || ($album['album'] == t('Contact Photos')))
+
+ // don't show contact photos. We once trasnlated this name, but then you could still access it under
+ // a different language setting. Now we store the name in English and check in English (and translated for legacy albums).
+
+ if((! strlen($album['album'])) || ($album['album'] === 'Contact Photos') || ($album['album'] === t('Contact Photos')))
continue;
$o .= '
' . '' . $album['album'] . '
';
}
@@ -133,7 +140,7 @@ function photos_post(&$a) {
if(($a->argc > 3) && ($a->argv[2] === 'album')) {
$album = hex2bin($a->argv[3]);
- if($album == t('Profile Photos') || $album == t('Contact Photos')) {
+ if($album === t('Profile Photos') || $album === 'Contact Photos' || $album === t('Contact Photos')) {
goaway($a->get_baseurl() . '/' . $_SESSION['photo_return']);
return; // NOTREACHED
}
@@ -376,6 +383,8 @@ function photos_post(&$a) {
if(count($tags)) {
foreach($tags as $tag) {
+ if(isset($profile))
+ unset($profile);
if(strpos($tag,'@') === 0) {
$name = substr($tag,1);
if((strpos($name,'@')) || (strpos($name,'http://'))) {
@@ -397,7 +406,7 @@ function photos_post(&$a) {
}
else {
$newname = $name;
- if(strstr($name,'_')) {
+ if(strstr($name,'_') || strstr($name,' ')) {
$newname = str_replace('_',' ',$name);
$r = q("SELECT * FROM `contact` WHERE `name` = '%s' AND `uid` = %d LIMIT 1",
dbesc($newname),
@@ -590,6 +599,9 @@ function photos_post(&$a) {
$filesize = intval($_FILES['userfile']['size']);
}
+
+ logger('photos: upload: received file: ' . $filename . ' as ' . $src . ' ' . $filesize . ' bytes', LOGGER_DEBUG);
+
$maximagesize = get_config('system','maximagesize');
if(($maximagesize) && ($filesize > $maximagesize)) {
@@ -600,6 +612,14 @@ function photos_post(&$a) {
return;
}
+ if(! $filesize) {
+ notice( t('Image file is empty.') . EOL);
+ @unlink($src);
+ $foo = 0;
+ call_hooks('photo_post_end',$foo);
+ return;
+ }
+
logger('mod/photos.php: photos_post(): loading the contents of ' . $src , 'LOGGER_DEBUG');
$imagedata = @file_get_contents($src);
@@ -755,8 +775,6 @@ function photos_content(&$a) {
$owner_uid = $a->data['user']['uid'];
-
-
$community_page = (($a->data['user']['page-flags'] == PAGE_COMMUNITY) ? true : false);
if((local_user()) && (local_user() == $owner_uid))
@@ -798,43 +816,12 @@ function photos_content(&$a) {
}
}
- $r = q("SELECT `hidewall` FROM `profile` WHERE `uid` = %d AND `is-default` = 1 LIMIT 1",
- intval($owner_uid)
- );
-
- if(count($r) && $r[0]['hidewall'] && (local_user() != $owner_uid) && (! $remote_contact)) {
+ if($a->data['user']['hidewall'] && (local_user() != $owner_uid) && (! $remote_contact)) {
notice( t('Access to this item is restricted.') . EOL);
return;
}
- // default permissions - anonymous user
-
- $sql_extra = " AND `allow_cid` = '' AND `allow_gid` = '' AND `deny_cid` = '' AND `deny_gid` = '' ";
-
- // Profile owner - everything is visible
-
- if(local_user() && (local_user() == $owner_uid)) {
- $sql_extra = '';
- }
- elseif(remote_user()) {
- // authenticated visitor - here lie dragons
- $gs = '<<>>'; // should be impossible to match
- if(count($groups)) {
- foreach($groups as $g)
- $gs .= '|<' . intval($g) . '>';
- }
- $sql_extra = sprintf(
- " AND ( `allow_cid` = '' OR `allow_cid` REGEXP '<%d>' )
- AND ( `deny_cid` = '' OR NOT `deny_cid` REGEXP '<%d>' )
- AND ( `allow_gid` = '' OR `allow_gid` REGEXP '%s' )
- AND ( `deny_gid` = '' OR NOT `deny_gid` REGEXP '%s') ",
-
- intval(remote_user()),
- intval(remote_user()),
- dbesc($gs),
- dbesc($gs)
- );
- }
+ $sql_extra = permissions_sql($owner_uid,$remote_contact,$groups);
$o = "";
@@ -867,7 +854,7 @@ function photos_content(&$a) {
$albumselect .= '';
if(count($a->data['albums'])) {
foreach($a->data['albums'] as $album) {
- if(($album['album'] === '') || ($album['album'] == t('Contact Photos')))
+ if(($album['album'] === '') || ($album['album'] === 'Contact Photos') || ($album['album'] === t('Contact Photos')))
continue;
$albumselect .= '';
}
@@ -916,7 +903,7 @@ function photos_content(&$a) {
$album = hex2bin($datum);
$r = q("SELECT `resource-id`, max(`scale`) AS `scale` FROM `photo` WHERE `uid` = %d AND `album` = '%s'
- $sql_extra GROUP BY `resource-id`",
+ AND `scale` <= 4 $sql_extra GROUP BY `resource-id`",
intval($owner_uid),
dbesc($album)
);
@@ -926,7 +913,7 @@ function photos_content(&$a) {
}
$r = q("SELECT `resource-id`, `id`, `filename`, max(`scale`) AS `scale`, `desc` FROM `photo` WHERE `uid` = %d AND `album` = '%s'
- $sql_extra GROUP BY `resource-id` ORDER BY `created` DESC LIMIT %d , %d",
+ AND `scale` <= 4 $sql_extra GROUP BY `resource-id` ORDER BY `created` DESC LIMIT %d , %d",
intval($owner_uid),
dbesc($album),
intval($a->pager['start']),
@@ -936,7 +923,7 @@ function photos_content(&$a) {
$o .= '