Merge branch 'master' of https://github.com/friendica/red

1 files changed, 49 insertions, 5 deletions

diff --git a/include/zot.php b/include/zot.php
index 3d59f00f3..1706153dd 100644
--- a/include/zot.php
+++ b/include/zot.php
@@ -1402,6 +1402,7 @@ function process_delivery($sender,$arr,$deliveries,$relay,$public = false) {
 
 		$perm = (($arr['mid'] == $arr['parent_mid']) ? 'send_stream' : 'post_comments');
 
+
 		// This is our own post, possibly coming from a channel clone
 
 		if($arr['owner_xchan'] == $d['hash']) {
@@ -1419,7 +1420,44 @@ function process_delivery($sender,$arr,$deliveries,$relay,$public = false) {
 			$result[] = array($d['hash'],'permission denied',$channel['channel_name'] . ' <' . $channel['channel_address'] . '@' . get_app()->get_hostname() . '>',$arr['mid']);
 			continue;
 		}
-	
+
+		if($arr['mid'] != $arr['parent_mid']) {
+
+			// check source route.
+			// We are only going to accept comments from this sender if the comment has the same route as the top-level-post,
+			// this is so that permissions mismatches between senders apply to the entire conversation
+			// As a side effect we will also do a preliminary check that we have the top-level-post, otherwise
+			// processing it is pointless. 
+
+			$r = q("select route from item where mid = '%s' and uid = %d limit 1",
+				dbesc($arr['parent_mid']),
+				intval($channel['channel_id'])
+			);
+			if(! $r) {
+				$result[] = array($d['hash'],'comment parent not found',$channel['channel_name'] . ' <' . $channel['channel_address'] . '@' . get_app()->get_hostname() . '>',$arr['mid']);
+				continue;
+			}
+			if($relay) {
+				// reset the route in case it travelled a great distance upstream
+				// use our parent's route so when we go back downstream we'll match
+				// with whatever route our parent has.
+				$arr['route'] = $r[0]['route'];
+			}
+			else {
+
+				// going downstream check that we have the same upstream provider that
+				// sent it to us originally. Ignore it if it came from another source
+				// (with potentially different permissions)
+
+				$current_route = (($arr['route']) ? $arr['route'] . ',' : '') . $sender['hash'];
+
+				if($r[0]['route'] != $current_route) {
+					$result[] = array($d['hash'],'comment route mismatch',$channel['channel_name'] . ' <' . $channel['channel_address'] . '@' . get_app()->get_hostname() . '>',$arr['mid']);
+					continue;
+				}
+			}
+		}
+
 		if($arr['item_restrict'] & ITEM_DELETED) {
 
 			// remove_community_tag is a no-op if this isn't a community tag activity
@@ -1446,9 +1484,13 @@ function process_delivery($sender,$arr,$deliveries,$relay,$public = false) {
 				$arr['id'] = $r[0]['id'];
 				$arr['uid'] = $channel['channel_id'];
 				update_imported_item($sender,$arr,$channel['channel_id']);
-			}	
-			$result[] = array($d['hash'],'updated',$channel['channel_name'] . ' <' . $channel['channel_address'] . '@' . get_app()->get_hostname() . '>',$arr['mid']);
-			$item_id = $r[0]['id'];
+				$result[] = array($d['hash'],'updated',$channel['channel_name'] . ' <' . $channel['channel_address'] . '@' . get_app()->get_hostname() . '>',$arr['mid']);
+				$item_id = $r[0]['id'];
+			}
+			else {
+				$result[] = array($d['hash'],'update ignored',$channel['channel_name'] . ' <' . $channel['channel_address'] . '@' . get_app()->get_hostname() . '>',$arr['mid']);
+				continue;
+			}
 		}
 		else {
 			$arr['aid'] = $channel['channel_account_id'];
@@ -1459,7 +1501,9 @@ function process_delivery($sender,$arr,$deliveries,$relay,$public = false) {
 				$item_id = $item_result['item_id'];
 				$parr = array('item_id' => $item_id,'item' => $arr,'sender' => $sender,'channel' => $channel);
 				call_hooks('activity_received',$parr);
-				add_source_route($item_id,$sender['hash']);
+				// don't add a source route if it's a relay or later recipients will get a route mismatch
+				if(! $relay)
+					add_source_route($item_id,$sender['hash']);
 			}
 			$result[] = array($d['hash'],(($item_id) ? 'posted' : 'storage failed:' . $item_result['message']),$channel['channel_name'] . ' <' . $channel['channel_address'] . '@' . get_app()->get_hostname() . '>',$arr['mid']);
 		}