Fix permissions when viewing photos, applying same fix to items as well

diff --git a/mod/photos.php b/mod/photos.php
index 06abade5e95d16571a95578d3cccccba491936b4..88e237ab0946924254a8bc9877b2089e7f8f2519 100644 (file)
--- a/mod/photos.php
+++ b/mod/photos.php
@@ -88,7 +88,7 @@ function photos_init(App $a) {
                        $ret['albums'] = [];
                        foreach ($albums as $k => $album) {
                                //hide profile photos to others
-                               if (!$is_owner && !remote_user() && ($album['album'] == L10n::t('Profile Photos')))
+                               if (!$is_owner && !remote_user($a->profile_uid) && ($album['album'] == L10n::t('Profile Photos')))
                                        continue;
                                $entry = [
                                        'text'      => $album['album'],
@@ -1573,7 +1573,7 @@ function photos_content(App $a)
                $twist = false;
                foreach ($r as $rr) {
                        //hide profile photos to others
-                       if (!$is_owner && !remote_user() && ($rr['album'] == L10n::t('Profile Photos'))) {
+                       if (!$is_owner && !remote_user($owner_uid) && ($rr['album'] == L10n::t('Profile Photos'))) {
                                continue;
                        }
 

diff --git a/src/Model/Item.php b/src/Model/Item.php
index b5c68d9ab7cbfc87a57bbf1c09be3eb130d7ae23..5c571ff1e0d253761ac18d30f9d77d9cca05195f 100644 (file)
--- a/src/Model/Item.php
+++ b/src/Model/Item.php
@@ -3263,7 +3263,11 @@ class Item extends BaseObject
        public static function getPermissionsSQLByUserId($owner_id, $remote_verified = false, $groups = null, $remote_cid = null)
        {
                $local_user = local_user();
-               $remote_user = remote_user();
+               $remote_user = remote_user($owner_id);
+
+               if (is_null($remote_cid)) {
+                       $remote_cid = $remote_user;
+               }
 
                /*
                 * Construct permissions

diff --git a/src/Util/Security.php b/src/Util/Security.php
index 5fc38c94095e977e71215a9df11cfe953c49d7e1..aa6209f3245b60bf55381a600f0aacf555d824aa 100644 (file)
--- a/src/Util/Security.php
+++ b/src/Util/Security.php
@@ -51,7 +51,7 @@ class Security extends BaseObject
 
                                $r = q("SELECT `contact`.*, `user`.`page-flags` FROM `contact` INNER JOIN `user` on `user`.`uid` = `contact`.`uid`
                                        WHERE `contact`.`uid` = %d AND `contact`.`id` = %d AND `contact`.`blocked` = 0 AND `contact`.`pending` = 0
-                                       AND `user`.`blockwall` = 0 AND `readonly` = 0  AND ( `contact`.`rel` IN ( %d , %d ) OR `user`.`page-flags` = %d ) LIMIT 1",
+                                       AND `user`.`blockwall` = 0 AND `readonly` = 0  AND (`contact`.`rel` IN (%d , %d) OR `user`.`page-flags` = %d) LIMIT 1",
                                        intval($owner),
                                        intval($cid),
                                        intval(Contact::SHARING),
@@ -75,7 +75,7 @@ class Security extends BaseObject
        public static function getPermissionsSQLByUserId($owner_id, $remote_verified = false, $groups = null)
        {
                $local_user = local_user();
-               $remote_user = remote_user();
+               $remote_user = remote_user($owner_id);
 
                /*
                 * Construct permissions
@@ -83,10 +83,9 @@ class Security extends BaseObject
                 * default permissions - anonymous user
                 */
                $sql = " AND allow_cid = ''
-                                AND allow_gid = ''
-                                AND deny_cid  = ''
-                                AND deny_gid  = ''
-               ";
+                        AND allow_gid = ''
+                        AND deny_cid  = ''
+                        AND deny_gid  = '' ";
 
                /*
                 * Profile owner - everything is visible
@@ -101,6 +100,8 @@ class Security extends BaseObject
                 * done this and passed the groups into this function.
                 */
                } elseif ($remote_user) {
+                       $cid = \Friendica\Core\Session::getVisitorContactIDForUserID($owner_id);
+
                        /*
                         * Authenticated visitor. Unless pre-verified,
                         * check that the contact belongs to this $owner_id
@@ -110,8 +111,6 @@ class Security extends BaseObject
                         */
 
                        if (!$remote_verified) {
-                               $cid = \Friendica\Core\Session::getVisitorContactIDForUserID($owner_id);
-
                                if ($cid && DBA::exists('contact', ['id' => $cid, 'uid' => $owner_id, 'blocked' => false])) {
                                        $remote_verified = true;
                                        $groups = Group::getIdsByContactId($cid);
@@ -128,10 +127,8 @@ class Security extends BaseObject
                                }
 
                                $sql = sprintf(
-                                       " AND ( NOT (deny_cid REGEXP '<%d>' OR deny_gid REGEXP '%s')
-                                         AND ( allow_cid REGEXP '<%d>' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') )
-                                         )
-                                       ",
+                                       " AND (NOT (deny_cid REGEXP '<%d>' OR deny_gid REGEXP '%s')
+                                         AND (allow_cid REGEXP '<%d>' OR allow_gid REGEXP '%s' OR (allow_cid = '' AND allow_gid = ''))) ",
                                        intval($cid),
                                        DBA::escape($gs),
                                        intval($cid),
@@ -141,5 +138,4 @@ class Security extends BaseObject
                }
                return $sql;
        }
-
 }