From 974da7e5f57ced9a4e3183ac599e6d50c4e4c841 Mon Sep 17 00:00:00 2001 From: friendica Date: Mon, 17 Dec 2012 14:13:37 -0800 Subject: [PATCH] SECURITY: communityhome - can leak photos from people with hidden walls (Thx Chris Case) --- communityhome.tgz | Bin 4043 -> 4023 bytes communityhome/communityhome.php | 1 + 2 files changed, 1 insertion(+) diff --git a/communityhome.tgz b/communityhome.tgz index 129081b613e8d3babac1e5ad3262e5558cf837c1..20f7b9642c0e676d43f9143eb52e1df174bde2ff 100755 GIT binary patch literal 4023 zcmV;o4@mGIiwFScn9ooE1MOUUbK5o&_rKPs*yG8el+oL-j$^r#i`~X|iQRGB_HI(2 zOo@=hny>I-N0Z5Szug5$krWjtt>fI>aqG$=u-F%X9~K~-iRU=6YekE>=ZNmcSD_x# z{{HU9V0UMKFxc7X?d}cscKTedXrn*q?QQS(ceb~;H+uc;y}iK(?0y|{@)U=W5ddsB z#$;v%x0btx&!6q?^}qY>yT`EU5owa^|J+k2^6dxFaZmpbcKQSA|Lwg2vh}dOzrWq< zZ$R%swBJMj=ly>eP6Er1j%u6r#x!;(k>$CK=7-uQK5KuCjPa-shSuy%Y-@6}y9Iu=tSwj(7!5K$bsFg5H@P{BtoPDOr}U#Z=tUS+&4@oR9uU;T&h zYcut&#=j4{NvD4J0M-=hu6J&k@bP19^Kia>RF}3#R%DCAE*21*Kv~3b7~3!*Q-&Ja z7iu^#4s8o8lb_MvOf8J#DDqrTHXj`tFb~9ZsQpztsx$Xt*El-t+EzizphQYZ^TD$D zVK=s=ovw)a`QRwSITeHR$MF9Mx4 zq2#PU<^Usvy2X*KTgn{bBRyRdmp3srO9rUSu$7w6H!a)rj~J(H^XFdV70t>Pe!fMj z)t`x!ZQY1s-=#&$5*(p8kaQ{!vt31eMcp{+j_Q^iLj@y>1L|8N@wcH*t^fYqe-Is? zUjO^MJG+BI{)g-Tpj!VQgATvPUaobYKCQu1I5Qk^056h305l4y{8-2Z1y{%ec!LWe z5H3PGTI32qUo4j!`NoVJ{(|7djryG)JwK15xfdM3560N?ND(%N!+8|>2i@+C70d!J z_B$xI>j&P{vPE}lj05Zad*=w7cM&H7@h-LkG4kArXy}e-F2^j5R~?tXS}j@5Avc~! zmWzFD+l?mRA|HsE6-FW$%{}j?p)K-Le-7ZXUPI(SY!VtmVXdlsN zc&pDN$DRwr)UTj31Rasty@5d3LoJLJwg~4!L>fd3Utn4w-bY<*uc?ec?~t6Ch(=>0 z6mfuo>FC}2-DVMvFfC)KVK_DD9_i>WnH6Hb2177{z*saeb<$WPwpX<)kR_5V4w#;jI{w6INQ2}z0qgd_YX2L}fy{4@E zhl}&q%eL_9l5bt|%fYzrH-VIDu;`Y@2cuAbm`u#qKLHW80hD z2o}|YOoUY^UY))^y@V|jTJ)jO0PfL8e;|iu9XI^gl>JgYKnN2yz_bE#t1%jJ<%nh< zmWfH^1q<$9IxOJ+x2BDW7rRlT9yA%fHf3Ijg7s(~J7b!Fn>c)hF_|M1Cu>0)8 zmC<1cE7Kl2pr?z2j!%t77zMU)QB?3&PdY%qYSIuXl;L>cl1%3zquh|8qrn0-2EwgD^+Nt$~Ti$Z`-Y z*%!%r)l6C%cGM12@9zu*nUgxfQ~@SYWsifAt9Nyx<0KWe5>+!CBzAgIl@qhpQ6{!5K$tBJsMV z3fRo+)}Nku05t6=77eBG#re-?myK&=Z_-%Hs0Jxj&Qn!<4Qj%L!k%6ad+_7M`OiNw zcEl`#Y(U=Y)~9r&-eeR|St^|$Fbs3Uoza9ng5&3xCylf7UvY@H;q(lV`j_XgaH79H zKf8R{l+#?bx=Z(94Hu_BzPyCa3(MfI}5 zFx!~a{Cswb9M509f_s!MWn`5yHhzIl9`fuhjh+og;&}#vD3Bsiq9QuLfM$?A2g?NeoGhX7-8ZPltYh{5NWC&D0 ze4l+d(0iC6Du$$a!n1s4wq_aNmvr=c$WL-Sd0>;t*|O(8g$z$tj7he>JgHc6dCq7MtnazzeMzghW|{#8j?Cn=0e2WkOoae3hI8OE*{YT3+>ry_HHjcu!VDS-ZsHL@Mq8BU)w? z08SAYXMrY7G{-o`8qrF}HJgR{LI=v}Ncl5^X-WF~5Lxvn@R-aP(H46>8ndMg#znlP zYEC(qwV6KFubyRepukV7U>PMsh@+j#=W#)Wdgph4rmHpR>)?ADn-X+Som!t@C!nHV zbu`**cDR(lD3f;QU^tJ6_aSf(=+N2(X3uV&(0(7b!2b_ClWEyUc0YW5jGi7#%0yorA=4A}bZ2l8N83q^%FFBLT;-EC({47nj zNyboyCo46RU=~A%`|N+55Ug))>8L%Gl#4-zr;tpd^n5az>$tKUvL%OLVP3XYN@@vC zDKLQ|n$)F`|N zc5iW~Y{rf+^CcQ5I3f8vDnhy+*rJjViIOv4*2-)TX^ib})Pp(@TGuj+j3^G1rXOqh z=DEh!RC$ua?ZlI!Uo@uid>Ge><%i6uZ-tO z+D`^-_3NPoW!M_j!{2oLyugea~l7p4&Ich0Lj@a2| z4q@3M3eqQe(p%^K-r>A|B=>0VGbhL`Jw%6j?(rrq4 zkZ=8_?(0zg?a9T-^W)bi9mjl79rxY;+u!dM?tks}clN9IzmGx7m%T6PWp6u2wb~_} z_4;;9ud6&{63@L^*0%j`4*o&iVAtE|~f30@vf@4@NC@cYti}Dw}SiTA81>WgE zHgKjVLOLg}%{>=aS6I-;vI)oT)(Wk$WwQvE7D9>3V*R2-wQCJQPFo+(iX1SDwkAJ#cz5`%ENfLYk54?_`ZI=tX;QE4d^<5X)}p_ z3g3(EbCpUEouht2RJn-625g!f@Z=8vwGwH$>VnWrT}JliA))vh7qJTW5W$2rOG6Di z!iVG?f(CqipDXD~le-4}R+r$D-|E-n_kVu=M|YSG;Hoe;oCo|{z|Z{qzs&r{Z@ud8 z{~m+Z_y5EFEdXQu-p;!I-yiJk=lg#^1E9kH$Dr!|e|7)Ay8mC@|F7=WY7L#lO1ZUtRJ4!Ylsrzi)H3NM0<`<(Oyr;ytEZq1?4}Xcxf#)nHTI z(^)kz%Sw4^^=9I$(facrc^Bv*blh|P)7#lyIsfnN?N;YMk3oD-1%C{EKu2aD`3FV;shY-TBtNRZ&G1Ra8+$6;)JGMHN+4QAHJ1R8d70Ra8+$6;)JGMHN+4 dQAHJ1R8d70Ra8+$6;-sc@gEqYyaxby008GZ;J^R? literal 4043 zcmV;+4>a%}iwFRis_IVw1MOV@Q`^Xr=U4n!^y!(Eo$_}uY!S>>USM~*OJIwzZ|^G0 znXxst_0YGKWQZ%3|NXjqMzSR2ki5r|t6Fsu8_o3ex0(4&&uGZhcip9D$E$_!%I?;m zLOrB|;c#m(+&dTy_O^P%{lWfTpUX9E_4@}0gCYLe?QQk?yZiftEg1ee=HzJ^#UcdQ za>aCRhj+HOfiIX3_xs;}|NV2=^o%sk^?&ZE69>+d=-~c8*x3Jrz5amuzdz^=5BdkY z*#8H+y}d2yJ&E>5=r7*?N6|F2gZQ|%U2n{m-ZZv-uhINi+s0?(Z?Tw+`yh;FXX@C~ z+ck$|7UpsMx$TWHik>Ax3t6Luf8S`n%-8#Y^lYkK*p|%HvIZ;`mi5{ZQPeO5YPgd| zo@Ib6p>+K_S;i$hK`8H}7oW(PSURzmAIf+cdN31CB&pyN7pEe>$gkAyQm-;zm-sb! z+^_yq__dw-R^#uZZqlhAKY~4jy60cm7JT|t+df+C9@mxau^l_|sEY-}CQ%k~94#G~ zk|`qt?TZW?7)Oo`w#CnAZ>AO|%Q*Hu&^8|*30Q=3HZuNZ9M_rqs4I?-x{h6tGANN! z(tNOPe$-t$%1+NhkI+!<#mo=gS}k!Dg~rQBhLQ4)9b%93<;v?L%f8cgn074PsC^%b zAdsQSnox39Aaj6-pl)*{>$WzB_()F|#pO**%~Am>Gwealmz$Pt`mY$LZ3`BD>=(_- z7Jj)!y4AlEDaXE*#lB06v?Vw~aUhvg9%Z|V_=>u5)E(DtHHHdC6bIC|M&fTnpIiTf zMerm#KEM9=hkO0KLjH&A|Dam`pM#Emz+SF(U%aTn3pf|9JcQTDAOIQ#RDL4Wf`TjL zA-uzd5C|6`9W81FpdW0H8wFy{4gZ1Q#Etr$9zDNW#tT0@gdfGk_DK;ohoeOt2Z!D6 ztsTxoe;IU8ZZ`=1neE8#OiV)i!w2^mn|Bc>Lixwi4&~VQrm|tWzO^2+G+s?y{%W;k zIfvYM9@`%Fwc|9JfQx)6=XMm!aJ=yS+lI*uQ{RhmwKZE{;=1j7-A85zG3Hg!2idTV ztJ7SD4MXdcR^Ap`;6H6N6o1N^y7ZpOSe1!1;2jfVH;B6gjH6qb1noe`Lb%-$`8(is_1ymDl;kTNzPUIh}<0{J2CVtYep1ZIci z%w;^Dh)6C&3{1!DKJGS)aHVC7k%8efpnGhhzhqW~`5KHsgrQh9Fm*Cj#$v+g7~+Qc zhO!H@*-C2$NzDajgl8v76{l8QMb=@T%H5ySII?_W?;d?Xb0Q0&@L!?lK3JK2Bk^pHMRy z8j}?SSc@L)!f^+8YT=I_PAmjx z9I1)Ko0cwMGjCe|_QV6AX-BbWXpOHgem%cx+#q|C##%--D5+|m>f#&F6E2d@>}J%1 zpDr(c{e`h($s))GjTdjsiauqXObytKTy;Wa2FO?mH*~XEK`~ zoDv|Espa==aps!pjH|3=vJB_e;q3~bHv;q;giA3v3PRh9XANTq@e=KsOuC~w4&r`tFUSFJ- zcg~0!<%={r=DLh>SY}LOs#cPMsh@+j#=booRv-8hjZt7L$&q44sHYNC-I<+~4PGG~l z?ijS2>~JZ;O(wC<0c{@h9>drk(6O`y%%0sGr-#}Fm{q6R`HggXu>AV57M0|Z|(%qWL5 z4|%vMSvn=lEB&aJ>o1nd?{KwP0$WrvCQ)kUt6G)MAx*ITt$xr)KAT!bvA|t^()3d; z-#pjYo@q~VxSe=X6s$lrF{$p3642QWLODm^rYIZT-{0e?8#Uhl@AdVI=I_^Cqow+G z;#(`qck6B{g0p%(5D+ol_x)>awR-iu!H|a@e&P*_-hGsex!}QQTZ>$evg{ryi?595 zNn%e1?DXrA0%h14)T7@`{NAlcl&tHygg>P70Dorv$;)^?YTlF`lqClbF5u{;AUQ;5 zn>mDKizq0c)LCwwcXUUK{;}GHeaM^bh`ZCs*IN5oySQ&b`L`#Rr>{=lo_1X8Np(DO{|oDSh5KK_{;+!g`z*A6+50oS>}}_$R=c9J z-oRPX>na~t)cX(tAcA-yK`$@-z883RLRX|b!VS-lf!`@w>QJgvyYPUJX@a4~wxPr< zRB5$|bfsMXFqaE0xGMjF7lXn)a*^_y^B{@o5_ z184a%qI2@v!uN3Pg%y3Qn{e#z?8u(j4vQe&h)J>S%?}IWYfAoFI|8ClH)l|$ijxXc z(hI~?5JBoXDb_vm_Vh`{*kkuUalRMte+~|+`=8H3>ODBkKln%|n6|p)5lTn!q4KAi z;wW5rqggc#D-}*1$xo&7^;OW1kPE#Eb~=bUxtoKf_E7d5p%_|h(4u?n<7Mo>Oojjo+g2XCSvJNJ1F$(enVOhKg@RMUlahvbTB)ya!v|ky+M0Pv&gF{4KRPfhK zfdAr@U;iJTO+ST>$MXOE{(f=&-`gEl>;H35_F}h@$5Vsv>*vebb=xw4uJe~RQ|PDh zz1TiisRhv~>t{rji%4w1rpfV7?$v-%A}v>45SppW$lg986yM+?R^c8ZoRVf`sBmI@ zNZv3Qz=!*}lCCnjE9hHaf=|Bn*Yo#(e*VYzm=55oun_JO{x0BS^I!k|-|j(wZ-2ix z#QDEJ==ZDN|9cMF-2YGay8w*w`+J-E|6s6pK>a`19}f3+5%_z9{{C)t{_`wU-T$xd z|5x|_tNZ`e{r~Fze|7)=|I_u->WY7L#lO1ZUtRI9uJ~71{J-*wzxwlSE*`0CN2VI{ zEMI=Wlq*uZmJaO#*uNTV>svez4a~AqURu4G_|s_f`H#8_^b|TCIsfVH4fhM@e+RvT z{p$SZIf(D6;9miEBD94UgFh==7~#nXaOUC0Nmx{`-<{(?DX`Li=VPlYF|!b7Gha4o z!M%hi#*szq7o>B$MgQ{;)$tt`+{~*BL75FD-D06KeRZf)tG%<`z*!|21YdOU0rz&i zP${j>SxKk|(i0P>=qQ=b_j82h;*Wvwq(jT&GFl3!^R0WUqKYc2sG^E0s;HuhDypcW xiYlt8qKYc2sG^E0s;HuhDypcWiYlt8qKYc2sG^E0s%UHL{{S&;AhrN_001LcD2xCA diff --git a/communityhome/communityhome.php b/communityhome/communityhome.php index 2b14fd33..484842cc 100755 --- a/communityhome/communityhome.php +++ b/communityhome/communityhome.php @@ -105,6 +105,7 @@ function communityhome_home(&$a, &$o){ `user` WHERE `user`.`uid` = `photo`.`uid` AND `user`.`blockwall`=0 + AND `user`.`hidewall` = 0 ORDER BY `photo`.`edited` DESC LIMIT 0, 12", dbesc(t('Contact Photos')), -- 2.39.2