Issue 8882: Fixes permissions of pinned posts

diff --git a/src/Model/Item.php b/src/Model/Item.php
index 724f61e25dd8c606ffbf3f4ac718134cb9d588c3..d780010944bec33c831ba2be7fe1f78193a62be1 100644 (file)
--- a/src/Model/Item.php
+++ b/src/Model/Item.php
@@ -201,18 +201,10 @@ class Item
                        return [];
                }
 
-               if (empty($condition) || !is_array($condition)) {
-                       $condition = ['iid' => $pinned];
+               if (!empty($condition)) {
+                       $condition = DBA::mergeConditions(['iid' => $pinned], $condition);
                } else {
-                       reset($condition);
-                       $first_key = key($condition);
-                       if (!is_int($first_key)) {
-                               $condition['iid'] = $pinned;
-                       } else {
-                               $values_string = substr(str_repeat("?, ", count($pinned)), 0, -2);
-                               $condition[0] = '(' . $condition[0] . ") AND `iid` IN (" . $values_string . ")";
-                               $condition = array_merge($condition, $pinned);
-                       }
+                       $condition = ['iid' => $pinned];
                }
 
                return self::selectThreadForUser($uid, $selected, $condition, $params);

diff --git a/src/Module/Profile/Status.php b/src/Module/Profile/Status.php
index 200e03ca752876d86edb4ea9805183259a3ad5ac..421c8acccda6ee3df88acdb9210fdb057e5da872 100644 (file)
--- a/src/Module/Profile/Status.php
+++ b/src/Module/Profile/Status.php
@@ -232,7 +232,18 @@ class Status extends BaseProfile
                $items = DBA::toArray($items_stmt);
 
                if ($pager->getStart() == 0 && !empty($a->profile['uid'])) {
-                       $pinned_items = Item::selectPinned($a->profile['uid'], ['uri', 'pinned']);
+                       $condition = ['private' => [Item::PUBLIC, Item::UNLISTED]];
+                       if (remote_user()) {
+                               $permissionSets = DI::permissionSet()->selectByContactId(remote_user(), $a->profile['uid']);
+                               if (!empty($permissionSets)) {
+                                       $condition = ['psid' => array_merge($permissionSets->column('id'),
+                                                       [DI::permissionSet()->getIdFromACL($a->profile['uid'], '', '', '', '')])];
+                               }
+                       } elseif ($a->profile['uid'] == local_user()) {
+                               $condition = [];
+                       }
+       
+                       $pinned_items = Item::selectPinned($a->profile['uid'], ['uri', 'pinned'], $condition);
                        $pinned = Item::inArray($pinned_items);
                        $items = array_merge($items, $pinned);
                }