Fix for private communities

diff --git a/src/Model/Item.php b/src/Model/Item.php
index 96cf5c488c35b1f9b599958bdd399876d0a20fd7..69a967b2c4be923b2943c8e1f7ba9a1277b9dbee 100644 (file)
--- a/src/Model/Item.php
+++ b/src/Model/Item.php
@@ -1442,26 +1442,36 @@ class Item
                }
 
                $post = Post::selectFirst(['uid', 'allow_cid', 'allow_gid', 'deny_cid', 'deny_gid', 'private'], ['uri-id' => $uriid, 'origin' => true]);
-               if (empty($post)) {
-                       if (Post::exists(['uri-id' => $uriid, 'uid' => 0])) {
-                               return 0;
-                       } else {
+               if (!empty($post)) {
+                       if (in_array($post['private'], [Item::PUBLIC, Item::UNLISTED])) {
+                               return $post['uid'];
+                       }
+
+                       $pcid = Contact::getPublicIdByUserId($uid);
+                       if (empty($pcid)) {
                                return null;
                        }
-               }
 
-               if (in_array($post['private'], [Item::PUBLIC, Item::UNLISTED])) {
-                       return $post['uid'];
-               }
+                       foreach (Item::enumeratePermissions($post, true) as $receiver) {
+                               if ($receiver == $pcid) {
+                                       return $post['uid'];
+                               }
+                       }
 
-               $pcid = Contact::getPublicIdByUserId($uid);
-               if (empty($pcid)) {
                        return null;
                }
 
-               foreach (Item::enumeratePermissions($post, true) as $receiver) {
-                       if ($receiver == $pcid) {
-                               return $post['uid'];
+               if (Post::exists(['uri-id' => $uriid, 'uid' => 0])) {
+                       return 0;
+               }
+
+               // When the post belongs to a a forum then all forum users are allowed to access it
+               foreach (Tag::getByURIId($uriid, [Tag::EXCLUSIVE_MENTION]) as $tag) {
+                       if (DBA::exists('contact', ['uid' => $uid, 'nurl' => Strings::normaliseLink($tag['url']), 'contact-type' => Contact::TYPE_COMMUNITY])) {
+                               $target_uid = User::getIdForURL($tag['url']);
+                               if (!empty($target_uid)) {
+                                       return $target_uid;
+                               }
                        }
                }
 

diff --git a/src/Module/ActivityPub/Objects.php b/src/Module/ActivityPub/Objects.php
index c085d86836e052c22c983158328dd7452e0c08ab..0a523ea435471079021f64906fcac793f3824157 100644 (file)
--- a/src/Module/ActivityPub/Objects.php
+++ b/src/Module/ActivityPub/Objects.php
@@ -70,9 +70,7 @@ class Objects extends BaseModule
                        }
                }
 
-               $item = Post::selectFirst(['id', 'uid', 'origin', 'author-link', 'changed', 'private', 'psid', 'gravity', 'deleted', 'parent-uri-id'],
-                       ['uri-id' => $itemuri['id']], ['order' => ['origin' => true]]);
-
+               $item = Post::selectFirst([], ['uri-id' => $itemuri['id'], 'origin' => true]);
                if (!DBA::isResult($item)) {
                        throw new HTTPException\NotFoundException();
                }
@@ -81,22 +79,13 @@ class Objects extends BaseModule
 
                if (!$validated) {
                        $requester = HTTPSignature::getSigner('', $_SERVER);
-                       if (!empty($requester) && $item['origin']) {
-                               $requester_id = Contact::getIdForURL($requester, $item['uid']);
-                               if (!empty($requester_id)) {
-                                       $permissionSets = DI::permissionSet()->selectByContactId($requester_id, $item['uid']);
-                                       $psids = array_merge($permissionSets->column('id'), [PermissionSet::PUBLIC]);
-                                       $validated = in_array($item['psid'], $psids);
-                               }
-                       }
-               }
-
-               if ($validated) {
-                       // Valid items are original post or posted from this node (including in the case of a forum)
-                       $validated = ($item['origin'] || (parse_url($item['author-link'], PHP_URL_HOST) == parse_url(DI::baseUrl()->get(), PHP_URL_HOST)));
+                       if (!empty($requester)) {
+                               $receivers = Item::enumeratePermissions($item, false);
 
-                       if (!$validated && $item['deleted']) {
-                               $validated = Post::exists(['origin' => true, 'uri-id' => $item['parent-uri-id']]);
+                               $validated = in_array(Contact::getIdForURL($requester, $item['uid']), $receivers);
+                               if (!$validated) {
+                                       $validated = in_array(Contact::getIdForURL($requester), $receivers);
+                               }
                        }
                }