attachment permissions not right

2 files changed, 46 insertions, 40 deletions

diff --git a/include/attach.php b/include/attach.php
index 38a011bcb..46d406f4b 100644
--- a/include/attach.php
+++ b/include/attach.php
@@ -193,13 +193,13 @@ function attach_by_hash($hash,$rev = 0) {
 	$sql_extra = permissions_sql($r[0]['uid']);
 
 	// Now we'll see if we can access the attachment
-
+dbg(1);
 
 	$r = q("SELECT * FROM attach WHERE hash = '%s' and uid = %d $sql_extra LIMIT 1",
 		dbesc($hash),
 		intval($r[0]['uid'])
 	);
-
+dbg(0);
 	if(! $r) {
 		$ret['message'] =  t('Permission denied.');
 		return $ret;
diff --git a/include/security.php b/include/security.php
index 29a0fc0bc..ef4d5a313 100644
--- a/include/security.php
+++ b/include/security.php
@@ -205,26 +205,29 @@ function permissions_sql($owner_id,$remote_verified = false,$groups = null) {
 
 
 	else {
-		$observer = get_app()->get_observer();
-		$groups = init_groups_visitor($remote_user);
-
-		$gs = '<<>>'; // should be impossible to match
-
-		if(is_array($groups) && count($groups)) {
-			foreach($groups as $g)
-				$gs .= '|<' . $g . '>';
-		} 
-		$sql = sprintf(
-			" AND ( NOT (deny_cid like '%s' OR deny_gid REGEXP '%s')
-			  AND ( allow_cid like '%s' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') )
-			  )
-			",
-			dbesc(protect_sprintf( '%<' . $remote_user . '>%')),
-			dbesc($gs),
-			dbesc(protect_sprintf( '%<' . $remote_user . '>%')),
-			dbesc($gs)
-		);
+		$observer = get_observer_hash();
+		if($observer) {
+			$groups = init_groups_visitor($observer);
+
+			$gs = '<<>>'; // should be impossible to match
+
+			if(is_array($groups) && count($groups)) {
+				foreach($groups as $g)
+					$gs .= '|<' . $g . '>';
+			} 
+			$sql = sprintf(
+				" AND ( NOT (deny_cid like '%s' OR deny_gid REGEXP '%s')
+				  AND ( allow_cid like '%s' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') )
+				  )
+				",
+				dbesc(protect_sprintf( '%<' . $observer . '>%')),
+				dbesc($gs),
+				dbesc(protect_sprintf( '%<' . $observer . '>%')),
+				dbesc($gs)
+			);
+		}
 	}
+
 	return $sql;
 }
 
@@ -260,25 +263,28 @@ function item_permissions_sql($owner_id,$remote_verified = false,$groups = null)
 
 
 	else {
-		$observer = get_app()->get_observer();
-		$groups = init_groups_visitor($remote_user);
-
-		$gs = '<<>>'; // should be impossible to match
-
-		if(is_array($groups) && count($groups)) {
-			foreach($groups as $g)
-				$gs .= '|<' . $g . '>';
-		} 
-		$sql = sprintf(
-			" AND ( NOT (deny_cid like '%s' OR deny_gid REGEXP '%s')
-			  AND ( allow_cid like '%s' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') )
-			  )
-			",
-			dbesc(protect_sprintf( '%<' . $remote_user . '>%')),
-			dbesc($gs),
-			dbesc(protect_sprintf( '%<' . $remote_user . '>%')),
-			dbesc($gs)
-		);
+		$observer = get_observer_hash();
+
+		if($observer) {
+			$groups = init_groups_visitor($observer);
+
+			$gs = '<<>>'; // should be impossible to match
+
+			if(is_array($groups) && count($groups)) {
+				foreach($groups as $g)
+					$gs .= '|<' . $g . '>';
+			} 
+			$sql = sprintf(
+				" AND ( NOT (deny_cid like '%s' OR deny_gid REGEXP '%s')
+				  AND ( allow_cid like '%s' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') )
+				  )
+				",
+				dbesc(protect_sprintf( '%<' . $observer . '>%')),
+				dbesc($gs),
+				dbesc(protect_sprintf( '%<' . $observer . '>%')),
+				dbesc($gs)
+			);
+		}
 	}
 	return $sql;
 }