From 09a27868827d6f71436c4af3c53e32f0849ae364 Mon Sep 17 00:00:00 2001 From: Zach Prezkuta Date: Mon, 4 Feb 2013 20:27:30 -0700 Subject: [PATCH] fix bug that wouldn't show posts to a user who was in an allowed group when individual contacts were also specified in the permissions --- include/security.php | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/include/security.php b/include/security.php index 126f162377..cb4587fbda 100644 --- a/include/security.php +++ b/include/security.php @@ -300,7 +300,7 @@ function item_permissions_sql($owner_id,$remote_verified = false,$groups = null) } $sql = sprintf( - " AND ( private = 0 OR ( private in (1,2) AND wall = 1 AND ( allow_cid = '' OR allow_cid REGEXP '<%d>' ) + /*" AND ( private = 0 OR ( private in (1,2) AND wall = 1 AND ( allow_cid = '' OR allow_cid REGEXP '<%d>' ) AND ( deny_cid = '' OR NOT deny_cid REGEXP '<%d>' ) AND ( allow_gid = '' OR allow_gid REGEXP '%s' ) AND ( deny_gid = '' OR NOT deny_gid REGEXP '%s'))) @@ -309,6 +309,15 @@ function item_permissions_sql($owner_id,$remote_verified = false,$groups = null) intval($remote_user), dbesc($gs), dbesc($gs) +*/ + " AND ( private = 0 OR ( private in (1,2) AND wall = 1 + AND ( NOT (deny_cid REGEXP '<%d>' OR deny_gid REGEXP '%s') + AND ( allow_cid REGEXP '<%d>' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = ''))))) + ", + intval($remote_user), + dbesc($gs), + intval($remote_user), + dbesc($gs) ); } } -- 2.39.5