SECURITY: edited comment to private post loses privacy info. Not visible in stream but may be visible in feeds

2 files changed, 11 insertions, 1 deletions

diff --git a/boot.php b/boot.php
index 2d118735a..c253df395 100755
--- a/boot.php
+++ b/boot.php
@@ -46,7 +46,7 @@ require_once('include/account.php');
 
 
 define ( 'PLATFORM_NAME',           'hubzilla' );
-define ( 'STD_VERSION',             '1.6.1' );
+define ( 'STD_VERSION',             '1.6.2' );
 define ( 'ZOT_REVISION',            1     );
 
 define ( 'DB_UPDATE_VERSION',       1168  );
diff --git a/include/zot.php b/include/zot.php
index 157354afa..8adc74ffa 100644
--- a/include/zot.php
+++ b/include/zot.php
@@ -1953,6 +1953,16 @@ function remove_community_tag($sender, $arr, $uid) {
  */
 function update_imported_item($sender, $item, $orig, $uid) {
 
+	// If this is a comment being updated, remove any privacy information
+	// so that item_store_update will set it from the original.
+
+	if($item['mid'] !== $item['parent_mid']) {
+		unset($item['allow_cid']);
+		unset($item['allow_gid']);
+		unset($item['deny_cid']);
+		unset($item['deny_gid']);
+		unset($item['item_private']);
+	}
 
 	$x = item_store_update($item);