aboutsummaryrefslogtreecommitdiffstats
path: root/Zotlabs
diff options
context:
space:
mode:
authorzotlabs <mike@macgirvin.com>2019-03-12 15:17:25 -0700
committerzotlabs <mike@macgirvin.com>2019-03-12 15:17:25 -0700
commit72384ff2cb28afa74f93a15738fdbd95efe1443b (patch)
tree494a81b489b69dbd829674d062c6c732ed7e1b66 /Zotlabs
parent11116bdcb77eb9fc62db92fdf87cf2cc1d8e5708 (diff)
downloadvolse-hubzilla-72384ff2cb28afa74f93a15738fdbd95efe1443b.tar.gz
volse-hubzilla-72384ff2cb28afa74f93a15738fdbd95efe1443b.tar.bz2
volse-hubzilla-72384ff2cb28afa74f93a15738fdbd95efe1443b.zip
add owner permission checks to AS item fetch
Diffstat (limited to 'Zotlabs')
-rw-r--r--Zotlabs/Module/Item.php39
1 files changed, 37 insertions, 2 deletions
diff --git a/Zotlabs/Module/Item.php b/Zotlabs/Module/Item.php
index b247df0fd..980d7308d 100644
--- a/Zotlabs/Module/Item.php
+++ b/Zotlabs/Module/Item.php
@@ -62,9 +62,44 @@ class Item extends Controller {
$sql_extra = item_permissions_sql(0);
- $r = q("select * from item where mid = '%s' $item_normal $sql_extra limit 1",
- dbesc(z_root() . '/item/' . $item_id)
+ $r = null;
+
+
+ // first see if we have this item owned by the current signer
+
+ $x = q("select * from xchan where xchan_hash = '%s'",
+ dbesc($sigdata['portable_id'])
);
+
+ if ($x) {
+
+ // include xchans for all zot-like networks - these will have the same guid and public key
+
+ $xchans = q("select xchan_hash from xchan where xchan_hash = '%s' OR ( xchan_guid = '%s' AND xchan_pubkey = '%s' ) ",
+ dbesc($sigdata['portable_id']),
+ dbesc($x[0]['xchan_guid']),
+ dbesc($x[0]['xchan_pubkey'])
+ );
+
+ if ($xchans) {
+ $hashes = ids_to_querystr($xchans,'xchan_hash',true);
+ $r = q("select * from item where mid = '%s' $item_normal and owner_xchan in ( " . protect_sprintf($hashes) . " ) ",
+ dbesc(z_root() . '/item/' . $item_id)
+ );
+ }
+ }
+
+ // then see if we can access it as a visitor
+
+ if (! $r) {
+
+ $r = q("select * from item where mid = '%s' $item_normal $sql_extra limit 1",
+ dbesc(z_root() . '/item/' . $item_id)
+ );
+ }
+
+ // fetch once more with no extra conditions to see what error condition applies
+
if(! $r) {