From df0f9547b57e579b0016e04d3842fdeb3a8243a9 Mon Sep 17 00:00:00 2001
From: Mikael Nordfeldth <mmn@hethane.se>
Date: Sun, 3 Jan 2016 19:05:49 +0100
Subject: [PATCH] Handle private streams better (failed to show profile before)

---
 classes/Profile.php            | 11 +++++++++++
 lib/noticestreamaction.php     |  9 +++++++--
 lib/privatestreamexception.php | 31 +++++++++++++++++++++++++++++++
 lib/profilenoticestream.php    | 10 +++-------
 4 files changed, 52 insertions(+), 9 deletions(-)
 create mode 100644 lib/privatestreamexception.php

diff --git a/classes/Profile.php b/classes/Profile.php
index a45511fe54..1c8dbcc252 100644
--- a/classes/Profile.php
+++ b/classes/Profile.php
@@ -761,6 +761,17 @@ class Profile extends Managed_DataObject
         return Subscription::exists($this, $other);
     }
 
+    function readableBy(Profile $other=null)
+    {
+        // If it's not a private stream, it's readable by anyone
+        if (!$this->isPrivateStream()) {
+            return true;
+        }
+
+        // If it's a private stream, $other must be a subscriber to $this
+        return is_null($other) ? false : $other->isSubscribed($this);
+    }
+
     /**
      * Check if a pending subscription request is outstanding for this...
      *
diff --git a/lib/noticestreamaction.php b/lib/noticestreamaction.php
index bf09b63780..fb592915a7 100644
--- a/lib/noticestreamaction.php
+++ b/lib/noticestreamaction.php
@@ -13,8 +13,13 @@ abstract class NoticestreamAction extends ProfileAction
         $this->doStreamPreparation();
 
         // fetch the actual stream stuff
-        $stream = $this->getStream();
-        $this->notice = $stream->getNotices(($this->page-1) * NOTICES_PER_PAGE, NOTICES_PER_PAGE + 1);
+        try {
+            $stream = $this->getStream();
+            $this->notice = $stream->getNotices(($this->page-1) * NOTICES_PER_PAGE, NOTICES_PER_PAGE + 1);
+        } catch (PrivateStreamException $e) {
+            $this->notice = new Notice();
+            $this->notice->whereAdd('FALSE');
+        }
 
         if ($this->page > 1 && $this->notice->N == 0) {
             // TRANS: Client error when page not found (404).
diff --git a/lib/privatestreamexception.php b/lib/privatestreamexception.php
new file mode 100644
index 0000000000..ed9f3e0d5a
--- /dev/null
+++ b/lib/privatestreamexception.php
@@ -0,0 +1,31 @@
+<?php
+if (!defined('GNUSOCIAL')) { exit(1); }
+
+/**
+ * An exception for private streams
+ *
+ * @category  Exception
+ * @package   GNUsocial
+ * @author    Mikael Nordfeldth <mmn@hethane.se>
+ * @copyright 2016 Free Software Foundation, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPL 3.0
+ */
+
+class PrivateStreamException extends AuthorizationException
+{
+    var $owner = null;  // owner of the private stream
+    var $reader = null; // reader, may be null if not logged in
+
+    public function __construct(Profile $owner, Profile $reader=null)
+    {
+        $this->owner = $owner;
+        $this->reader = $reader;
+
+        // TRANS: Message when a private stream attemps to be read by unauthorized third party.
+        $msg = sprintf(_m('This stream is protected and only authorized subscribers may see its contents.'));
+
+        // If $reader is a profile, authentication has been made but still not accepted (403),
+        // otherwise authentication may give access to this resource (401).
+        parent::__construct($msg, ($reader instanceof Profile ? 403 : 401));
+    }
+}
diff --git a/lib/profilenoticestream.php b/lib/profilenoticestream.php
index 1fa795d320..3c8de05855 100644
--- a/lib/profilenoticestream.php
+++ b/lib/profilenoticestream.php
@@ -74,7 +74,7 @@ class ProfileNoticeStream extends ScopingNoticeStream
     function getNotices($offset, $limit, $since_id=null, $max_id=null)
     {
         if ($this->impossibleStream()) {
-            return new ArrayWrapper(array());
+            throw new PrivateStreamException($this->streamProfile, $this->userProfile);
         } else {
             return parent::getNotices($offset, $limit, $since_id, $max_id);
         }
@@ -82,12 +82,8 @@ class ProfileNoticeStream extends ScopingNoticeStream
 
     function impossibleStream() 
     {
-        $user = User::getKV('id', $this->streamProfile->id);
-
-        // If it's a private stream, and no user or not a subscriber
-
-        if (!empty($user) && $user->private_stream && 
-            (empty($this->userProfile) || !$this->userProfile->isSubscribed($this->streamProfile))) {
+        if (!$this->streamProfile->readableBy($this->userProfile)) {
+            // cannot read because it's a private stream and either noone's logged in or they are not subscribers
             return true;
         }
 
-- 
2.39.5