Merge pull request #5234 from fabrixxm/fix/api

API: fix sender/recipient of PMs

diff --combined include/api.php
index d66446cb6896f346e9d0bf701ec264371379c98a,93a158b71016ccd1e5e0ad7b8b972e9cd3939b92..c89a5b16441c1447a086eef90c82573bcf323696
--- 1/include/api.php
--- 2/include/api.php
+++ b/include/api.php
@@@ -1626,7 -1626,7 +1626,7 @@@ function api_search($type
        }
  
        $params = ['order' => ['id' => true], 'limit' => [$start, $count]];
 -      $statuses = Item::select(api_user(), [], $condition, $params);
 +      $statuses = Item::selectForUser(api_user(), [], $condition, $params);
  
        $data['status'] = api_format_items(dba::inArray($statuses), $user_info);
  
@@@ -1693,7 -1693,7 +1693,7 @@@ function api_statuses_home_timeline($ty
        }
  
        $params = ['order' => ['id' => true], 'limit' => [$start, $count]];
 -      $statuses = Item::select(api_user(), [], $condition, $params);
 +      $statuses = Item::selectForUser(api_user(), [], $condition, $params);
  
        $items = dba::inArray($statuses);
  
@@@ -1770,7 -1770,7 +1770,7 @@@ function api_statuses_public_timeline($
                }
  
                $params = ['order' => ['iid' => true], 'limit' => [$start, $count]];
 -              $statuses = Item::selectThread(api_user(), [], $condition, $params);
 +              $statuses = Item::selectThreadForUser(api_user(), Item::DISPLAY_FIELDLIST, $condition, $params);
  
                $r = dba::inArray($statuses);
        } else {
@@@ -1787,7 -1787,7 +1787,7 @@@
                }
  
                $params = ['order' => ['id' => true], 'limit' => [$start, $count]];
 -              $statuses = Item::select(api_user(), [], $condition, $params);
 +              $statuses = Item::selectForUser(api_user(), [], $condition, $params);
  
                $r = dba::inArray($statuses);
        }
@@@ -1846,7 -1846,7 +1846,7 @@@ function api_statuses_networkpublic_tim
        }
  
        $params = ['order' => ['iid' => true], 'limit' => [$start, $count]];
 -      $statuses = Item::selectThread(api_user(), [], $condition, $params);
 +      $statuses = Item::selectThreadForUser(api_user(), Item::DISPLAY_FIELDLIST, $condition, $params);
  
        $ret = api_format_items(dba::inArray($statuses), $user_info, false, $type);
  
@@@ -1917,7 -1917,7 +1917,7 @@@ function api_statuses_show($type
                $params = [];
        }
  
 -      $statuses = Item::select(api_user(), [], $condition, $params);
 +      $statuses = Item::selectForUser(api_user(), [], $condition, $params);
  
        /// @TODO How about copying this to above methods which don't check $r ?
        if (!DBM::is_result($statuses)) {
@@@ -1998,7 -1998,7 +1998,7 @@@ function api_conversation_show($type
        }
  
        $params = ['order' => ['id' => true], 'limit' => [$start, $count]];
 -      $statuses = Item::select(api_user(), [], $condition, $params);
 +      $statuses = Item::selectForUser(api_user(), [], $condition, $params);
  
        if (!DBM::is_result($statuses)) {
                throw new BadRequestException("There is no status with id $id.");
@@@ -2048,7 -2048,7 +2048,7 @@@ function api_statuses_repeat($type
        logger('API: api_statuses_repeat: '.$id);
  
        $fields = ['body', 'author-name', 'author-link', 'author-avatar', 'guid', 'created', 'plink'];
 -      $item = Item::selectFirst(api_user(), $fields, ['id' => $id, 'private' => false]);
 +      $item = Item::selectFirst($fields, ['id' => $id, 'private' => false]);
  
        if (DBM::is_result($item) && $item['body'] != "") {
                if (strpos($item['body'], "[/share]") !== false) {
@@@ -2168,7 -2168,7 +2168,7 @@@ function api_statuses_mentions($type
        }
  
        $params = ['order' => ['id' => true], 'limit' => [$start, $count]];
 -      $statuses = Item::select(api_user(), [], $condition, $params);
 +      $statuses = Item::selectForUser(api_user(), [], $condition, $params);
  
        $ret = api_format_items(dba::inArray($statuses), $user_info, false, $type);
  
@@@ -2248,7 -2248,7 +2248,7 @@@ function api_statuses_user_timeline($ty
        }
  
        $params = ['order' => ['id' => true], 'limit' => [$start, $count]];
 -      $statuses = Item::select(api_user(), [], $condition, $params);
 +      $statuses = Item::selectForUser(api_user(), [], $condition, $params);
  
        $ret = api_format_items(dba::inArray($statuses), $user_info, true, $type);
  
@@@ -2300,7 -2300,7 +2300,7 @@@ function api_favorites_create_destroy($
                $itemid = intval($_REQUEST['id']);
        }
  
 -      $item = Item::selectFirst(api_user(), [], ['id' => $itemid, 'uid' => api_user()]);
 +      $item = Item::selectFirstForUser(api_user(), [], ['id' => $itemid, 'uid' => api_user()]);
  
        if (!DBM::is_result($item)) {
                throw new BadRequestException("Invalid item.");
@@@ -2390,7 -2390,7 +2390,7 @@@ function api_favorites($type
                        $condition[] = $max_id;
                }
  
 -              $statuses = Item::select(api_user(), [], $condition, $params);
 +              $statuses = Item::selectForUser(api_user(), [], $condition, $params);
  
                $ret = api_format_items(dba::inArray($statuses), $user_info, false, $type);
        }
@@@ -3198,7 -3198,7 +3198,7 @@@ function api_lists_statuses($type
        }
  
        $params = ['order' => ['id' => true], 'limit' => [$start, $count]];
 -      $statuses = Item::select(api_user(), [], $condition, $params);
 +      $statuses = Item::selectForUser(api_user(), [], $condition, $params);
  
        $items = api_format_items(dba::inArray($statuses), $user_info, false, $type);
  
@@@ -3700,12 -3700,9 +3700,9 @@@ api_register_func('api/direct_messages/
  function api_direct_messages_box($type, $box, $verbose)
  {
        $a = get_app();
-       $user_info = api_get_user($a);
- 
-       if (api_user() === false || $user_info === false) {
+       if (api_user() === false) {
                throw new ForbiddenException();
        }
- 
        // params
        $count = (x($_GET, 'count') ? $_GET['count'] : 20);
        $page = (x($_REQUEST, 'page') ? $_REQUEST['page'] -1 : 0);
@@@ -3726,6 -3723,10 +3723,10 @@@
        unset($_REQUEST["screen_name"]);
        unset($_GET["screen_name"]);
  
+       $user_info = api_get_user($a);
+       if ($user_info === false) {
+               throw new ForbiddenException();
+       }
        $profile_url = $user_info["url"];
  
        // pagination
@@@ -4723,7 -4724,7 +4724,7 @@@ function prepare_photo_data($type, $sca
        $condition = ["`parent` = ? AND `uid` = ? AND (`verb` = ? OR `type`='photo')",
                $item[0]['parent'], api_user(), ACTIVITY_POST];
  
 -      $statuses = Item::select(api_user(), [], $condition);
 +      $statuses = Item::selectForUser(api_user(), [], $condition);
  
        // prepare output of comments
        $commentData = api_format_items(dba::inArray($statuses), $user_info, false, $type);
@@@ -5716,7 -5717,7 +5717,7 @@@ function api_friendica_notification_see
        $nm->setSeen($note);
        if ($note['otype']=='item') {
                // would be really better with an ItemsManager and $im->getByID() :-P
 -              $item = Item::selectFirst(api_user(), [], ['id' => $note['iid'], 'uid' => api_user()]);
 +              $item = Item::selectFirstForUser(api_user(), [], ['id' => $note['iid'], 'uid' => api_user()]);
                if (DBM::is_result($$item)) {
                        // we found the item, return it to the user
                        $ret = api_format_items([$item], $user_info, false, $type);