Non public content is now displayed again to visitors.

diff --git a/include/conversation.php b/include/conversation.php
index 1c97a1abe4e074ff1b5b8875c3ba01245cb75e63..839b58b871bebf90feba1541003b05150191c50e 100644 (file)
--- a/include/conversation.php
+++ b/include/conversation.php
@@ -798,7 +798,7 @@ function conversation_add_children(array $parents, $block_authors, $order, $uid)
 
        foreach ($parents AS $parent) {
                $condition = ["`item`.`parent-uri` = ? AND `item`.`uid` IN (0, ?) ",
-                       $parent['uri'], local_user()];
+                       $parent['uri'], $uid];
                if ($block_authors) {
                        $condition[0] .= "AND NOT `author`.`hidden`";
                }

diff --git a/mod/display.php b/mod/display.php
index 729ca440138c9dc42e2355f3f4ffba5ace42e07f..f4a09b74e07a5f0ceb2ec17b0fe3db6abfd441fa 100644 (file)
--- a/mod/display.php
+++ b/mod/display.php
@@ -26,6 +26,10 @@ use Friendica\Module\Objects;
 
 function display_init(App $a)
 {
+       if (ActivityPub::isRequest()) {
+               Objects::rawContent();
+       }
+
        if (Config::get('system', 'block_public') && !local_user() && !remote_user()) {
                return;
        }
@@ -48,6 +52,7 @@ function display_init(App $a)
        }
 
        $item = null;
+       $item_user = local_user();
 
        $fields = ['id', 'parent', 'author-id', 'body', 'uid', 'guid'];
 
@@ -61,6 +66,16 @@ function display_init(App $a)
                        if (DBA::isResult($item)) {
                                $nick = $a->user["nickname"];
                        }
+               // Is this item private but could be visible to the remove visitor?
+               } elseif (remote_user()) {
+                       $item = Item::selectFirst($fields, ['guid' => $a->argv[1], 'private' => 1]);
+                       if (DBA::isResult($item)) {
+                               if (!Contact::isFollower(remote_user(), $item['uid'])) {
+                                       $item = null;
+                               } else {
+                                       $item_user = $item['uid'];
+                               }
+                       }
                }
 
                // Is it an item with uid=0?
@@ -72,9 +87,7 @@ function display_init(App $a)
        }
 
        if (!DBA::isResult($item)) {
-               $a->error = 404;
-               notice(L10n::t('Item not found.') . EOL);
-               return;
+               System::httpExit(404);
        }
 
        if (!empty($_SERVER['HTTP_ACCEPT']) && strstr($_SERVER['HTTP_ACCEPT'], 'application/atom+xml')) {
@@ -82,10 +95,6 @@ function display_init(App $a)
                displayShowFeed($item["id"], false);
        }
 
-       if (ActivityPub::isRequest()) {
-               Objects::rawContent();
-       }
-
        if ($item["id"] != $item["parent"]) {
                $item = Item::selectFirstForUser(local_user(), $fields, ['id' => $item["parent"]]);
        }
@@ -225,7 +234,7 @@ function display_content(App $a, $update = false, $update_uid = 0)
 
                if ($a->argc == 2) {
                        $item_parent = 0;
-                       $fields = ['id', 'parent', 'parent-uri'];
+                       $fields = ['id', 'parent', 'parent-uri', 'uid'];
 
                        if (local_user()) {
                                $condition = ['guid' => $a->argv[1], 'uid' => local_user()];
@@ -235,6 +244,13 @@ function display_content(App $a, $update = false, $update_uid = 0)
                                        $item_parent = $item["parent"];
                                        $item_parent_uri = $item['parent-uri'];
                                }
+                       } elseif (remote_user()) {
+                               $item = Item::selectFirst($fields, ['guid' => $a->argv[1], 'private' => 1]);
+                               if (DBA::isResult($item) && Contact::isFollower(remote_user(), $item['uid'])) {
+                                       $item_id = $item["id"];
+                                       $item_parent = $item["parent"];
+                                       $item_parent_uri = $item['parent-uri'];
+                               }
                        }
 
                        if ($item_parent == 0) {
@@ -250,9 +266,7 @@ function display_content(App $a, $update = false, $update_uid = 0)
        }
 
        if (!$item_id) {
-               $a->error = 404;
-               notice(L10n::t('Item not found.').EOL);
-               return;
+               System::httpExit(404);
        }
 
        // We are displaying an "alternate" link if that post was public. See issue 2864
@@ -271,18 +285,22 @@ function display_content(App $a, $update = false, $update_uid = 0)
                                        '$conversation' => $conversation]);
 
        $groups = [];
+       $remote_cid = null;
+       $is_remote_contact = false;
+       $item_uid = local_user();
 
        $parent = Item::selectFirst(['uid'], ['uri' => $item_parent_uri, 'wall' => true]);
        if (DBA::isResult($parent)) {
                $a->profile['profile_uid'] = $parent['uid'];
+               $is_remote_contact = Contact::isFollower(remote_user(), $a->profile['profile_uid']);
        }
 
-       $is_remote_contact = Contact::isFollower(remote_user(), $a->profile['profile_uid']);
-
        if ($is_remote_contact) {
                $cdata = Contact::getPublicAndUserContacID(remote_user(), $a->profile['profile_uid']);
                if (!empty($cdata['user'])) {
                        $groups = Group::getIdsByContactId($cdata['user']);
+                       $remote_cid = $cdata['user'];
+                       $item_uid = $parent['uid'];
                }
        }
 
@@ -312,10 +330,9 @@ function display_content(App $a, $update = false, $update_uid = 0)
                ];
                $o .= status_editor($a, $x, 0, true);
        }
+       $sql_extra = Item::getPermissionsSQLByUserId($a->profile['profile_uid'], $is_remote_contact, $groups, $remote_cid);
 
-       $sql_extra = Item::getPermissionsSQLByUserId($a->profile['uid'], $is_remote_contact, $groups);
-
-       if (local_user() && (local_user() == $a->profile['uid'])) {
+       if (local_user() && (local_user() == $a->profile['profile_uid'])) {
                $condition = ['parent-uri' => $item_parent_uri, 'uid' => local_user(), 'unseen' => true];
                $unseen = Item::exists($condition);
        } else {
@@ -326,13 +343,12 @@ function display_content(App $a, $update = false, $update_uid = 0)
                return '';
        }
 
-       $condition = ["`id` = ? AND `item`.`uid` IN (0, ?) " . $sql_extra, $item_id, local_user()];
+       $condition = ["`id` = ? AND `item`.`uid` IN (0, ?) " . $sql_extra, $item_id, $item_uid];
        $fields = ['parent-uri', 'body', 'title', 'author-name', 'author-avatar', 'plink'];
        $item = Item::selectFirstForUser(local_user(), $fields, $condition);
 
        if (!DBA::isResult($item)) {
-               notice(L10n::t('Item not found.') . EOL);
-               return $o;
+               System::httpExit(404);
        }
 
        $item['uri'] = $item['parent-uri'];
@@ -346,7 +362,7 @@ function display_content(App $a, $update = false, $update_uid = 0)
                $o .= "<script> var netargs = '?f=&item_id=" . $item_id . "'; </script>";
        }
 
-       $o .= conversation($a, [$item], new Pager($a->query_string), 'display', $update_uid, false, 'commented', local_user());
+       $o .= conversation($a, [$item], new Pager($a->query_string), 'display', $update_uid, false, 'commented', $item_uid);
 
        // Preparing the meta header
        $description = trim(HTML::toPlaintext(BBCode::convert($item["body"], false), 0, true));

diff --git a/mod/profile.php b/mod/profile.php
index 2c11f43b9c442273bdf53985df44d4091ed555b3..f84a4be190c4c3955fde0336209da2fe5b6b0d21 100644 (file)
--- a/mod/profile.php
+++ b/mod/profile.php
@@ -139,6 +139,7 @@ function profile_content(App $a, $update = 0)
        require_once 'include/items.php';
 
        $groups = [];
+       $remote_cid = null;
 
        $tab = 'posts';
        $o = '';
@@ -158,6 +159,7 @@ function profile_content(App $a, $update = 0)
                $cdata = Contact::getPublicAndUserContacID(remote_user(), $a->profile['profile_uid']);
                if (!empty($cdata['user'])) {
                        $groups = Group::getIdsByContactId($cdata['user']);
+                       $remote_cid = $cdata['user'];
                }
        }
 
@@ -211,9 +213,8 @@ function profile_content(App $a, $update = 0)
                }
        }
 
-
        // Get permissions SQL - if $remote_contact is true, our remote user has been pre-verified and we already have fetched his/her groups
-       $sql_extra = Item::getPermissionsSQLByUserId($a->profile['profile_uid'], $remote_contact, $groups);
+       $sql_extra = Item::getPermissionsSQLByUserId($a->profile['profile_uid'], $remote_contact, $groups, $remote_cid);
        $sql_extra2 = '';
 
        if ($update) {
@@ -325,7 +326,7 @@ function profile_content(App $a, $update = 0)
                }
        }
 
-       $o .= conversation($a, $items, $pager, 'profile', $update, false, 'created', local_user());
+       $o .= conversation($a, $items, $pager, 'profile', $update, false, 'created', $a->profile['profile_uid']);
 
        if (!$update) {
                $o .= $pager->renderMinimal(count($items));

diff --git a/src/Model/Item.php b/src/Model/Item.php
index b0a346bc0b6cb3d839626a91899c08c8e43ab6cb..9acff3bfa8490bb5241162ed0d4784af5e1f0c7b 100644 (file)
--- a/src/Model/Item.php
+++ b/src/Model/Item.php
@@ -3214,7 +3214,7 @@ class Item extends BaseObject
                }
        }
 
-       public static function getPermissionsSQLByUserId($owner_id, $remote_verified = false, $groups = null)
+       public static function getPermissionsSQLByUserId($owner_id, $remote_verified = false, $groups = null, $remote_cid = null)
        {
                $local_user = local_user();
                $remote_user = remote_user();
@@ -3237,7 +3237,7 @@ class Item extends BaseObject
                         * If pre-verified, the caller is expected to have already
                         * done this and passed the groups into this function.
                         */
-                       $set = PermissionSet::get($owner_id, $remote_user, $groups);
+                       $set = PermissionSet::get($owner_id, $remote_cid, $groups);
 
                        if (!empty($set)) {
                                $sql_set = " OR (`item`.`private` IN (1,2) AND `item`.`wall` AND `item`.`psid` IN (" . implode(',', $set) . "))";