diff options
| author | friendica <info@friendica.com> | 2013-02-10 04:55:29 -0800 |
|---|---|---|
| committer | friendica <info@friendica.com> | 2013-02-10 04:55:29 -0800 |
| commit | 99c5f88963227a48544747e9dc8b13550b88c0f2 (patch) | |
| tree | 115070a6941baf51a5388be67b312e499f800e2c /include/security.php | |
| parent | 260a012b02c4941655e897735eeac09dadcf98c4 (diff) | |
| download | volse-hubzilla-99c5f88963227a48544747e9dc8b13550b88c0f2.tar.gz volse-hubzilla-99c5f88963227a48544747e9dc8b13550b88c0f2.tar.bz2 volse-hubzilla-99c5f88963227a48544747e9dc8b13550b88c0f2.zip | |
mod_display - no fun. Not working at all. But a bit of progress.
Diffstat (limited to 'include/security.php')
| -rw-r--r-- | include/security.php | 40 |
1 files changed, 32 insertions, 8 deletions
diff --git a/include/security.php b/include/security.php index 9f4058f88..8477ea6de 100644 --- a/include/security.php +++ b/include/security.php @@ -214,13 +214,13 @@ function permissions_sql($owner_id,$remote_verified = false,$groups = null) { $gs .= '|<' . $g . '>'; } $sql = sprintf( - " AND ( NOT (deny_cid like '<%s>' OR deny_gid REGEXP '%s') - AND ( allow_cid like '<%s>' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') ) + " AND ( NOT (deny_cid like '%s' OR deny_gid REGEXP '%s') + AND ( allow_cid like '%s' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') ) ) ", - dbesc(protect_sprintf( '%' . $remote_user . '%')), + dbesc(protect_sprintf( '%<' . $remote_user . '>%')), dbesc($gs), - dbesc(protect_sprintf( '%' . $remote_user . '%')), + dbesc(protect_sprintf( '%<' . $remote_user . '>%')), dbesc($gs) ); } @@ -269,19 +269,43 @@ function item_permissions_sql($owner_id,$remote_verified = false,$groups = null) $gs .= '|<' . $g . '>'; } $sql = sprintf( - " AND ( NOT (deny_cid like '<%s>' OR deny_gid REGEXP '%s') - AND ( allow_cid like '<%s>' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') ) + " AND ( NOT (deny_cid like '%s' OR deny_gid REGEXP '%s') + AND ( allow_cid like '%s' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') ) ) ", - dbesc(protect_sprintf( '%' . $remote_user . '%')), + dbesc(protect_sprintf( '%<' . $remote_user . '>%')), dbesc($gs), - dbesc(protect_sprintf( '%' . $remote_user . '%')), + dbesc(protect_sprintf( '%<' . $remote_user . '>%')), dbesc($gs) ); } return $sql; } +function public_permissions_sql($observer_hash) { + + $observer = get_app()->get_observer(); + $groups = init_groups_visitor($observer_hash); + + $gs = '<<>>'; // should be impossible to match + + if(is_array($groups) && count($groups)) { + foreach($groups as $g) + $gs .= '|<' . $g . '>'; + } + $sql = sprintf( + " OR (( NOT (deny_cid like '%s' OR deny_gid REGEXP '%s') + AND ( allow_cid like '%s' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') ) + )) + ", + dbesc(protect_sprintf( '%<' . $observer_hash . '>%')), + dbesc($gs), + dbesc(protect_sprintf( '%<' . $observer_hash . '>%')), + dbesc($gs) + ); + + return $sql; +} /* |