consolidate perrmisions sql, minor duepuntozero validation fixes

diff --git a/include/security.php b/include/security.php
index c74a9b4a3cbe26d8ba919b6c44155e78612591db..789e47db28f590ce2581f5d57de932667fe561f8 100644 (file)
--- a/include/security.php
+++ b/include/security.php
@@ -44,3 +44,74 @@ function can_write_wall(&$a,$owner) {
 
        return false;
 }
+
+
+function permissions_sql($owner_id,$remote_verified = false,$groups = null) {
+
+       $local_user = local_user();
+       $remote_user = remote_user();
+
+       /**
+        * Construct permissions
+        *
+        * default permissions - anonymous user
+        */
+
+       $sql = " AND allow_cid = '' 
+                        AND allow_gid = '' 
+                        AND deny_cid  = '' 
+                        AND deny_gid  = '' 
+       ";
+
+       /**
+        * Profile owner - everything is visible
+        */
+
+       if(($local_user) && ($local_user == $owner_id)) {
+               $sql = ''; 
+       }
+
+       /**
+        * Authenticated visitor. Unless pre-verified, 
+        * check that the contact belongs to this $owner_id
+        * and load the groups the visitor belongs to.
+        * If pre-verified, the caller is expected to have already
+        * done this and passed the groups into this function.
+        */
+
+       elseif($remote_user) {
+
+               if(! $remote_verified) {
+                       $r = q("SELECT id FROM contact WHERE id = %d AND uid = %d AND blocked = 0 LIMIT 1",
+                               intval($remote_user),
+                               intval($owner_id)
+                       );
+                       if(count($r)) {
+                               $remote_verified = true;
+                               $groups = init_groups_visitor($remote_user);
+                       }
+               }
+               if($remote_verified) {
+               
+                       $gs = '<<>>'; // should be impossible to match
+
+                       if(is_array($groups) && count($groups)) {
+                               foreach($groups as $g)
+                                       $gs .= '|<' . intval($g) . '>';
+                       } 
+
+                       $sql = sprintf(
+                               " AND ( allow_cid = '' OR allow_cid REGEXP '<%d>' ) 
+                                 AND ( deny_cid  = '' OR  NOT deny_cid REGEXP '<%d>' ) 
+                                 AND ( allow_gid = '' OR allow_gid REGEXP '%s' )
+                                 AND ( deny_gid  = '' OR NOT deny_gid REGEXP '%s') 
+                               ",
+                               intval($remote_user),
+                               intval($remote_user),
+                               dbesc($gs),
+                               dbesc($gs)
+                       );
+               }
+       }
+       return $sql;
+}
\ No newline at end of file

diff --git a/mod/attach.php b/mod/attach.php
index 3953d3aa19945b34477817254bd6b7ce8c1ac3d1..ae6540201e70f96227a1bf633aec78deaed4384e 100644 (file)
--- a/mod/attach.php
+++ b/mod/attach.php
@@ -1,5 +1,7 @@
 <?php
 
+require_once('include/security.php');
+
 function attach_init(&$a) {
 
        if($a->argc != 2) {
@@ -9,6 +11,8 @@ function attach_init(&$a) {
 
        $item_id = intval($a->argv[1]);
 
+       // Check for existence, which will also provide us the owner uid
+
        $r = q("SELECT * FROM `attach` WHERE `id` = %d LIMIT 1",
                intval($item_id)
        );
@@ -17,39 +21,7 @@ function attach_init(&$a) {
                return;
        }
 
-       $owner = $r[0]['uid'];
-
-       $sql_extra = " AND `allow_cid` = '' AND `allow_gid` = '' AND `deny_cid` = '' AND `deny_gid` = '' ";
-
-       if(local_user() && ($owner == $_SESSION['uid'])) {
-
-                       // Owner can always see his/her photos
-                       $sql_extra = ''; 
-
-       }
-       elseif(remote_user()) {
-
-               // authenticated visitor - here lie dragons
-
-               $groups = init_groups_visitor($_SESSION['visitor_id']);
-               $gs = '<<>>'; // should be impossible to match
-               if(count($groups)) {
-                       foreach($groups as $g)
-                               $gs .= '|<' . intval($g) . '>';
-               } 
-
-               $sql_extra = sprintf(
-                       " AND ( `allow_cid` = '' OR `allow_cid` REGEXP '<%d>' ) 
-                         AND ( `deny_cid`  = '' OR  NOT `deny_cid` REGEXP '<%d>' ) 
-                         AND ( `allow_gid` = '' OR `allow_gid` REGEXP '%s' )
-                         AND ( `deny_gid`  = '' OR NOT `deny_gid` REGEXP '%s') ",
-
-                       intval($_SESSION['visitor_id']),
-                       intval($_SESSION['visitor_id']),
-                       dbesc($gs),
-                       dbesc($gs)
-               );
-       }
+       $sql_extra = permissions_sql($r[0]['uid']);
 
        // Now we'll see if we can access the attachment
 
@@ -57,17 +29,14 @@ function attach_init(&$a) {
                dbesc($item_id)
        );
 
-       if(count($r)) {
-               $data = $r[0]['data'];
-       }
-       else {
+       if(! count($r)) {
                notice( t('Permission denied.') . EOL);
                return;
        }
 
        header('Content-type: ' . $r[0]['filetype']);
        header('Content-disposition: attachment; filename=' . $r[0]['filename']);
-       echo $data;
+       echo $r[0]['data'];
        killme();
        // NOTREACHED
 }
\ No newline at end of file

diff --git a/mod/display.php b/mod/display.php
index fdb93e480cc3676f8487dfa899edda6ad9d72d8f..305a21825f5420a0ba1a069588fe766640b0a66a 100644 (file)
--- a/mod/display.php
+++ b/mod/display.php
@@ -59,42 +59,7 @@ function display_content(&$a) {
        if(count($r))
                $a->page_contact = $r[0];
 
-       $sql_extra = "
-               AND `allow_cid` = '' 
-               AND `allow_gid` = '' 
-               AND `deny_cid`  = '' 
-               AND `deny_gid`  = '' 
-       ";
-
-
-       // Profile owner - everything is visible
-
-       if(local_user() && (local_user() == $a->profile['uid'])) {
-               $sql_extra = '';                
-       }
-
-       // authenticated visitor - here lie dragons
-       // If $remotecontact is true, we know that not only is this a remotely authenticated
-       // person, but that it is *our* contact, which is important in multi-user mode.
-
-       elseif($remote_contact) {
-               $gs = '<<>>'; // should be impossible to match
-               if(count($groups)) {
-                       foreach($groups as $g)
-                               $gs .= '|<' . intval($g) . '>';
-               } 
-               $sql_extra = sprintf(
-                       " AND ( `allow_cid` = '' OR `allow_cid` REGEXP '<%d>' ) 
-                         AND ( `deny_cid`  = '' OR  NOT `deny_cid` REGEXP '<%d>' ) 
-                         AND ( `allow_gid` = '' OR `allow_gid` REGEXP '%s' )
-                         AND ( `deny_gid`  = '' OR  NOT `deny_gid` REGEXP '%s') ",
-
-                       intval($_SESSION['visitor_id']),
-                       intval($_SESSION['visitor_id']),
-                       dbesc($gs),
-                       dbesc($gs)
-               );
-       }
+       $sql_extra = permissions_sql($a->profile['uid'],$remote_contact,$groups);
 
        $r = q("SELECT `item`.*, `item`.`id` AS `item_id`, 
                `contact`.`name`, `contact`.`photo`, `contact`.`url`, `contact`.`rel`,

diff --git a/mod/photo.php b/mod/photo.php
index 3bea7e72de82bd712b28b42d0a6841619ba7db65..9809aa418de296d9c7b55581b8f2480701743d2c 100644 (file)
--- a/mod/photo.php
+++ b/mod/photo.php
@@ -1,5 +1,7 @@
 <?php
 
+require_once('include/security.php');
+
 function photo_init(&$a) {
 
        switch($a->argc) {
@@ -73,39 +75,7 @@ function photo_init(&$a) {
                );
                if(count($r)) {
                        
-                       $owner = $r[0]['uid'];
-
-                       $sql_extra = " AND `allow_cid` = '' AND `allow_gid` = '' AND `deny_cid` = '' AND `deny_gid` = '' ";
-
-                       if(local_user() && ($owner == $_SESSION['uid'])) {
-
-                               // Owner can always see his/her photos
-                               $sql_extra = ''; 
-
-                       }
-                       elseif(remote_user()) {
-
-                               // authenticated visitor - here lie dragons
-
-                               $groups = init_groups_visitor($_SESSION['visitor_id']);
-                               $gs = '<<>>'; // should be impossible to match
-                               if(count($groups)) {
-                                       foreach($groups as $g)
-                                               $gs .= '|<' . intval($g) . '>';
-                               } 
-
-                               $sql_extra = sprintf(
-                                       " AND ( `allow_cid` = '' OR `allow_cid` REGEXP '<%d>' ) 
-                                         AND ( `deny_cid`  = '' OR  NOT `deny_cid` REGEXP '<%d>' ) 
-                                         AND ( `allow_gid` = '' OR `allow_gid` REGEXP '%s' )
-                                         AND ( `deny_gid`  = '' OR NOT `deny_gid` REGEXP '%s') ",
-
-                                       intval($_SESSION['visitor_id']),
-                                       intval($_SESSION['visitor_id']),
-                                       dbesc($gs),
-                                       dbesc($gs)
-                               );
-                       }
+                       $sql_extra = permissions_sql($r[0]['uid']);
 
                        // Now we'll see if we can access the photo
 

diff --git a/mod/photos.php b/mod/photos.php
index f8059fc08e1aa46103bdcf3a76b756f0fb4ee390..2c896e32f533276ff48638136d8f304afaa6babe 100644 (file)
--- a/mod/photos.php
+++ b/mod/photos.php
@@ -3,6 +3,7 @@ require_once('include/Photo.php');
 require_once('include/items.php');
 require_once('include/acl_selectors.php');
 require_once('include/bbcode.php');
+require_once('include/security.php');
 
 function photos_init(&$a) {
 
@@ -23,40 +24,8 @@ function photos_init(&$a) {
 
                $a->data['user'] = $r[0];
 
-
-               // default permissions - anonymous user
-
-               $sql_extra = " AND `allow_cid` = '' AND `allow_gid` = '' AND `deny_cid` = '' AND `deny_gid` = '' ";
-
-               // Profile owner - everything is visible
-
-               if(local_user() && (local_user() == $a->data['user']['uid'])) {
-                       $sql_extra = '';        
-               }
-               elseif(remote_user()) {
-
-                       $groups = init_groups_visitor(remote_user());
-
-                       // authenticated visitor - here lie dragons
-                       $gs = '<<>>'; // should be impossible to match
-                       if(count($groups)) {
-                               foreach($groups as $g)
-                                       $gs .= '|<' . intval($g) . '>';
-                       } 
-                       $sql_extra = sprintf(
-                               " AND ( `allow_cid` = '' OR `allow_cid` REGEXP '<%d>' ) 
-                                 AND ( `deny_cid`  = '' OR  NOT `deny_cid` REGEXP '<%d>' ) 
-                                 AND ( `allow_gid` = '' OR `allow_gid` REGEXP '%s' )
-                                 AND ( `deny_gid`  = '' OR NOT `deny_gid` REGEXP '%s') ",
-
-                               intval(remote_user()),
-                               intval(remote_user()),
-                               dbesc($gs),
-                               dbesc($gs)
-                       );
-               }
-
-
+               $sql_extra = permissions_sql($a->data['user']['uid']);
+echo "SQL=$sql_extra";
                $albums = q("SELECT distinct(`album`) AS `album` FROM `photo` WHERE `uid` = %d $sql_extra ",
                        intval($a->data['user']['uid'])
                );
@@ -806,8 +775,6 @@ function photos_content(&$a) {
 
        $owner_uid = $a->data['user']['uid'];
 
-
-
        $community_page = (($a->data['user']['page-flags'] == PAGE_COMMUNITY) ? true : false);
 
        if((local_user()) && (local_user() == $owner_uid))
@@ -858,34 +825,7 @@ function photos_content(&$a) {
                return;
        }
 
-       // default permissions - anonymous user
-
-       $sql_extra = " AND `allow_cid` = '' AND `allow_gid` = '' AND `deny_cid` = '' AND `deny_gid` = '' ";
-
-       // Profile owner - everything is visible
-
-       if(local_user() && (local_user() == $owner_uid)) {
-               $sql_extra = '';        
-       }
-       elseif(remote_user()) {
-               // authenticated visitor - here lie dragons
-               $gs = '<<>>'; // should be impossible to match
-               if(count($groups)) {
-                       foreach($groups as $g)
-                               $gs .= '|<' . intval($g) . '>';
-               } 
-               $sql_extra = sprintf(
-                       " AND ( `allow_cid` = '' OR `allow_cid` REGEXP '<%d>' ) 
-                         AND ( `deny_cid`  = '' OR  NOT `deny_cid` REGEXP '<%d>' ) 
-                         AND ( `allow_gid` = '' OR `allow_gid` REGEXP '%s' )
-                         AND ( `deny_gid`  = '' OR NOT `deny_gid` REGEXP '%s') ",
-
-                       intval(remote_user()),
-                       intval(remote_user()),
-                       dbesc($gs),
-                       dbesc($gs)
-               );
-       }
+       $sql_extra = permissions_sql($owner_uid,$remote_contact,$groups);
 
        $o = "";
 

diff --git a/mod/profile.php b/mod/profile.php
index f2dd7f4dfa327571aadc516152e1577030c612df..e9b144ffdd7b8538cdd318f0cf6bf6f96b909c05 100644 (file)
--- a/mod/profile.php
+++ b/mod/profile.php
@@ -164,48 +164,19 @@ function profile_content(&$a, $update = 0) {
                }
        }
 
-       // Construct permissions
-
-       // default permissions - anonymous user
-
-       $sql_extra = " AND `allow_cid` = '' AND `allow_gid` = '' AND `deny_cid` = '' AND `deny_gid` = '' ";
-
-       // Profile owner - everything is visible
-
        if($is_owner) {
-               $sql_extra = ''; 
-               
-               // Oh - while we're here... reset the Unseen messages
-
                $r = q("UPDATE `item` SET `unseen` = 0 
                        WHERE `wall` = 1 AND `unseen` = 1 AND `uid` = %d",
-                       intval($_SESSION['uid'])
+                       intval(local_user())
                );
-
        }
 
-       // authenticated visitor - here lie dragons
-       // If $remotecontact is true, we know that not only is this a remotely authenticated
-       // person, but that it is *our* contact, which is important in multi-user mode.
-
-       elseif($remote_contact) {
-               $gs = '<<>>'; // should be impossible to match
-               if(count($groups)) {
-                       foreach($groups as $g)
-                               $gs .= '|<' . intval($g) . '>';
-               } 
-               $sql_extra = sprintf(
-                       " AND ( `allow_cid` = '' OR `allow_cid` REGEXP '<%d>' ) 
-                         AND ( `deny_cid`  = '' OR  NOT `deny_cid` REGEXP '<%d>' ) 
-                         AND ( `allow_gid` = '' OR `allow_gid` REGEXP '%s' )
-                         AND ( `deny_gid`  = '' OR NOT `deny_gid` REGEXP '%s') ",
-
-                       intval($_SESSION['visitor_id']),
-                       intval($_SESSION['visitor_id']),
-                       dbesc($gs),
-                       dbesc($gs)
-               );
-       }
+       /**
+        * Get permissions SQL - if $remote_contact is true, our remote user has been pre-verified and we already have fetched his/her groups
+        */
+
+       $sql_extra = permissions_sql($a->profile['profile_uid'],$remote_contact,$groups);
+
 
        $r = q("SELECT COUNT(*) AS `total`
                FROM `item` LEFT JOIN `contact` ON `contact`.`id` = `item`.`contact-id`

diff --git a/view/theme/duepuntozero/style.css b/view/theme/duepuntozero/style.css
index 67a1546eeda388fcc700b3c79351523b48922ba0..a99d7530faa4076e53011ad91d6e183227d646c8 100644 (file)
--- a/view/theme/duepuntozero/style.css
+++ b/view/theme/duepuntozero/style.css
@@ -2547,7 +2547,7 @@ a.mail-list-link {
 
 .settings-block > h3,
 .settings-heading {
-       border-bottom: 1px solid #babdb6
+       border-bottom: 1px solid #babdb6;
 }
  
 
@@ -2632,7 +2632,7 @@ a.mail-list-link {
        margin-right: 1em;
 }
 
-#adminpage table {width:100%; border-bottom: 1p solid #000000; margin: 5px 0px;}
+#adminpage table {width:100%; border-bottom: 1px solid #000000; margin: 5px 0px;}
 #adminpage table th { text-align: left;}
 #adminpage td .icon { float: left;}
 #adminpage table#users img { width: 16px; height: 16px; }
@@ -2692,9 +2692,9 @@ a.mail-list-link {
        margin-top: 10px;
 }
 
-.type-video { background-position: 0px; 0px; }
-.type-image { background-position: -20px; 0px; }
-.type-audio { background-position: -40px; 0px; }
-.type-text  { background-position: -60px; 0px; }
-.type-unkn  { background-position: -80px; 0px; }
+.type-video { background-position: 0px 0px; }
+.type-image { background-position: -20px 0px; }
+.type-audio { background-position: -40px 0px; }
+.type-text  { background-position: -60px 0px; }
+.type-unkn  { background-position: -80px 0px; }