aboutsummaryrefslogtreecommitdiffstats
path: root/Zotlabs/Module
diff options
context:
space:
mode:
authorzotlabs <mike@macgirvin.com>2019-02-19 13:14:19 -0800
committerzotlabs <mike@macgirvin.com>2019-02-19 13:14:19 -0800
commit1a77bdd1d0d4a7f989d1c117c30cd6327779cd71 (patch)
tree0890271921ae5ea7cd646fb39fc0b81aaaeb2703 /Zotlabs/Module
parent1ea9002fe8d04f0b2af32fa30a6aae9a0ffcf96c (diff)
downloadvolse-hubzilla-1a77bdd1d0d4a7f989d1c117c30cd6327779cd71.tar.gz
volse-hubzilla-1a77bdd1d0d4a7f989d1c117c30cd6327779cd71.tar.bz2
volse-hubzilla-1a77bdd1d0d4a7f989d1c117c30cd6327779cd71.zip
fix ability for file storage creators (visitors) to be able to delete their own content
Diffstat (limited to 'Zotlabs/Module')
-rw-r--r--Zotlabs/Module/Filestorage.php40
1 files changed, 30 insertions, 10 deletions
diff --git a/Zotlabs/Module/Filestorage.php b/Zotlabs/Module/Filestorage.php
index 23bd63f95..2c247cd65 100644
--- a/Zotlabs/Module/Filestorage.php
+++ b/Zotlabs/Module/Filestorage.php
@@ -5,6 +5,8 @@ namespace Zotlabs\Module;
*
*/
+
+
class Filestorage extends \Zotlabs\Web\Controller {
function post() {
@@ -71,14 +73,6 @@ class Filestorage extends \Zotlabs\Web\Controller {
return;
}
- // Since we have ACL'd files in the wild, but don't have ACL here yet, we
- // need to return for anyone other than the owner, despite the perms check for now.
-
- $is_owner = (((local_channel()) && ($owner == local_channel())) ? true : false);
- if(! ($is_owner || is_site_admin())){
- info( t('Permission Denied.') . EOL );
- return;
- }
if(argc() > 3 && argv(3) === 'delete') {
@@ -101,18 +95,31 @@ class Filestorage extends \Zotlabs\Web\Controller {
}
$file = intval(argv(2));
- $r = q("SELECT hash FROM attach WHERE id = %d AND uid = %d LIMIT 1",
+ $r = q("SELECT hash, creator FROM attach WHERE id = %d AND uid = %d LIMIT 1",
dbesc($file),
intval($owner)
);
if(! $r) {
+ notice( t('File not found.') . EOL);
+
if($json_return)
json_return_and_die([ 'success' => false ]);
- notice( t('File not found.') . EOL);
goaway(z_root() . '/cloud/' . $which);
}
+ if(local_channel() !== $owner) {
+ if($r[0]['creator'] && $r[0]['creator'] !== $ob_hash) {
+ notice( t('Permission denied.') . EOL);
+
+ if($json_return)
+ json_return_and_die([ 'success' => false ]);
+
+ goaway(z_root() . '/cloud/' . $which);
+ }
+ }
+
+
$f = $r[0];
$channel = channelx_by_n($owner);
@@ -134,6 +141,19 @@ class Filestorage extends \Zotlabs\Web\Controller {
goaway(dirname($url));
}
+
+
+
+ // Since we have ACL'd files in the wild, but don't have ACL here yet, we
+ // need to return for anyone other than the owner, despite the perms check for now.
+
+ $is_owner = (((local_channel()) && ($owner == local_channel())) ? true : false);
+ if(! ($is_owner || is_site_admin())){
+ info( t('Permission Denied.') . EOL );
+ return;
+ }
+
+
if(argc() > 3 && argv(3) === 'edit') {
require_once('include/acl_selectors.php');
if(! $perms['write_storage']) {