Enable visibility request parameter to override default user permissions in mod/item

diff --git a/mod/item.php b/mod/item.php
index 85ec3b1d27288354ea754c027333d9741d36057c..bc6050646077f5967c1dff3ce35ff94f494392c6 100644 (file)
--- a/mod/item.php
+++ b/mod/item.php
@@ -262,12 +262,18 @@ function item_post(App $a) {
                $guid              = $orig_post['guid'];
                $extid             = $orig_post['extid'];
        } else {
-               $aclFormatter = DI::aclFormatter();
-
-               $str_group_allow   = isset($_REQUEST['group_allow'])   ? $aclFormatter->toString($_REQUEST['group_allow'])   : $user['allow_gid'] ?? '';
-               $str_contact_allow = isset($_REQUEST['contact_allow']) ? $aclFormatter->toString($_REQUEST['contact_allow']) : $user['allow_cid'] ?? '';
-               $str_group_deny    = isset($_REQUEST['group_deny'])    ? $aclFormatter->toString($_REQUEST['group_deny'])    : $user['deny_gid']  ?? '';
-               $str_contact_deny  = isset($_REQUEST['contact_deny'])  ? $aclFormatter->toString($_REQUEST['contact_deny'])  : $user['deny_cid']  ?? '';
+               $str_contact_allow = '';
+               $str_group_allow   = '';
+               $str_contact_deny  = '';
+               $str_group_deny    = '';
+
+               if (($_REQUEST['visibility'] ?? '') !== 'public') {
+                       $aclFormatter = DI::aclFormatter();
+                       $str_contact_allow = isset($_REQUEST['contact_allow']) ? $aclFormatter->toString($_REQUEST['contact_allow']) : $user['allow_cid'] ?? '';
+                       $str_group_allow   = isset($_REQUEST['group_allow'])   ? $aclFormatter->toString($_REQUEST['group_allow'])   : $user['allow_gid'] ?? '';
+                       $str_contact_deny  = isset($_REQUEST['contact_deny'])  ? $aclFormatter->toString($_REQUEST['contact_deny'])  : $user['deny_cid']  ?? '';
+                       $str_group_deny    = isset($_REQUEST['group_deny'])    ? $aclFormatter->toString($_REQUEST['group_deny'])    : $user['deny_gid']  ?? '';
+               }
 
                $title             = Strings::escapeTags(trim($_REQUEST['title']    ?? ''));
                $location          = Strings::escapeTags(trim($_REQUEST['location'] ?? ''));