diff options
author | mrjive <mrjive@mrjive.it> | 2015-09-29 08:01:51 +0200 |
---|---|---|
committer | mrjive <mrjive@mrjive.it> | 2015-09-29 08:01:51 +0200 |
commit | 11c1573b55f278a664a90a2872d06a40b3ac3026 (patch) | |
tree | 4061879d490fec39ab01d3feeb575b86586fb7f8 /include/security.php | |
parent | 006ca4421a7027ccee4612beb99a1f9976146070 (diff) | |
parent | b3525b865784ff5d2d5a76b913b8c86d139cc0f3 (diff) | |
download | volse-hubzilla-11c1573b55f278a664a90a2872d06a40b3ac3026.tar.gz volse-hubzilla-11c1573b55f278a664a90a2872d06a40b3ac3026.tar.bz2 volse-hubzilla-11c1573b55f278a664a90a2872d06a40b3ac3026.zip |
Merge pull request #5 from redmatrix/master
updating from original codebase
Diffstat (limited to 'include/security.php')
-rw-r--r-- | include/security.php | 42 |
1 files changed, 39 insertions, 3 deletions
diff --git a/include/security.php b/include/security.php index 380505a79..9a25d9e0e 100644 --- a/include/security.php +++ b/include/security.php @@ -245,6 +245,9 @@ function item_permissions_sql($owner_id, $remote_observer = null) { $observer = (($remote_observer) ? $remote_observer : get_observer_hash()); if($observer) { + + $s = scopes_sql($owner_id,$observer); + $groups = init_groups_visitor($observer); $gs = '<<>>'; // should be impossible to match @@ -255,9 +258,9 @@ function item_permissions_sql($owner_id, $remote_observer = null) { } $regexop = db_getfunc('REGEXP'); $sql = sprintf( - " AND ( NOT (deny_cid like '%s' OR deny_gid $regexop '%s') - AND ( allow_cid like '%s' OR allow_gid $regexop '%s' OR ( allow_cid = '' AND allow_gid = '' AND item_private = 0 ) ) - ) + " AND (( NOT (deny_cid like '%s' OR deny_gid $regexop '%s') + AND ( allow_cid like '%s' OR allow_gid $regexop '%s' OR ( allow_cid = '' AND allow_gid = '' AND item_private = 0 )) + ) OR ( item_private = 1 $s )) ", dbesc(protect_sprintf( '%<' . $observer . '>%')), dbesc($gs), @@ -271,6 +274,39 @@ function item_permissions_sql($owner_id, $remote_observer = null) { } /** + * Remote visitors also need to be checked against the public_scope parameter if item_private is set. + * This function checks the various permutations of that field for any which apply to this observer. + * + */ + + + +function scopes_sql($uid,$observer) { + $str = " and ( public_policy = 'authenticated' "; + if(! is_foreigner($observer)) + $str .= " or public_policy = 'network: red' "; + if(local_channel()) + $str .= " or public_policy = 'site: " . get_app()->get_hostname() . "' "; + + $ab = q("select * from abook where abook_xchan = '%s' and abook_channel = %d limit 1", + dbesc($observer), + intval($uid) + ); + if(! $ab) + return $str . " ) "; + if($ab[0]['abook_pending']) + $str .= " or public_policy = 'any connections' "; + $str .= " or public_policy = 'contacts' ) "; + return $str; +} + + + + + + + +/** * @param string $observer_hash * * @return string additional SQL where statement |