enhanced email privacy

2 files changed, 11 insertions, 6 deletions

diff --git a/include/conversation.php b/include/conversation.php
index 6b1f64925..0d901a3c0 100644
--- a/include/conversation.php
+++ b/include/conversation.php
@@ -283,14 +283,14 @@ function conversation(&$a, $items, $mode, $update) {
 				continue;
 
 			$toplevelpost = (($item['id'] == $item['parent']) ? true : false);
-
+			$toplevelprivate = false;
 
 			// Take care of author collapsing and comment collapsing
 			// If a single author has more than 3 consecutive top-level posts, squash the remaining ones.
 			// If there are more than two comments, squash all but the last 2.
-
+		
 			if($toplevelpost) {
-
+				$toplevelprivate = (($toplevelpost && $item['private']) ? true : false);
 				$item_writeable = (($item['writable'] || $item['self']) ? true : false);
 
 				if($blowhard == $item['cid'] && (! $item['self']) && ($mode != 'profile') && ($mode != 'notes')) {
@@ -312,9 +312,12 @@ function conversation(&$a, $items, $mode, $update) {
 				$comments_seen = 0;
 				$comments_collapsed = false;
 			}
-			else
+			else {
+				// prevent private email from leaking into public conversation
+				if((! $toplevelpost) && (! toplevelprivate) && ($item['private']) && ($profile_owner != local_user()))
+					continue;
 				$comments_seen ++;
-
+			}	
 
 			$override_comment_box = ((($page_writeable) && ($item_writeable)) ? true : false);
 			$show_comment_box = ((($page_writeable) && ($item_writeable) && ($comments_seen == $comments[$item['parent']])) ? true : false);
diff --git a/include/poller.php b/include/poller.php
index 6ac99fc7d..86bb8ad55 100644
--- a/include/poller.php
+++ b/include/poller.php
@@ -421,8 +421,10 @@ function poller_run($argv, $argc){
 							$datarray['contact-id'] = $contact['id'];
 							if($datarray['parent-uri'] === $datarray['uri'])
 								$datarray['private'] = 1;
-							if(! get_pconfig($importer_uid,'system','allow_public_email_replies'))
+							if(! get_pconfig($importer_uid,'system','allow_public_email_replies')) {
 								$datarray['private'] = 1;
+								$datarray['allow_cid'] = '<' . $contact['id'] . '>';
+							}
 							$datarray['author-name'] = $contact['name'];
 							$datarray['author-link'] = 'mailbox';
 							$datarray['author-avatar'] = $contact['photo'];