aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--include/attach.php4
-rw-r--r--include/security.php82
2 files changed, 46 insertions, 40 deletions
diff --git a/include/attach.php b/include/attach.php
index 38a011bcb..46d406f4b 100644
--- a/include/attach.php
+++ b/include/attach.php
@@ -193,13 +193,13 @@ function attach_by_hash($hash,$rev = 0) {
$sql_extra = permissions_sql($r[0]['uid']);
// Now we'll see if we can access the attachment
-
+dbg(1);
$r = q("SELECT * FROM attach WHERE hash = '%s' and uid = %d $sql_extra LIMIT 1",
dbesc($hash),
intval($r[0]['uid'])
);
-
+dbg(0);
if(! $r) {
$ret['message'] = t('Permission denied.');
return $ret;
diff --git a/include/security.php b/include/security.php
index 29a0fc0bc..ef4d5a313 100644
--- a/include/security.php
+++ b/include/security.php
@@ -205,26 +205,29 @@ function permissions_sql($owner_id,$remote_verified = false,$groups = null) {
else {
- $observer = get_app()->get_observer();
- $groups = init_groups_visitor($remote_user);
-
- $gs = '<<>>'; // should be impossible to match
-
- if(is_array($groups) && count($groups)) {
- foreach($groups as $g)
- $gs .= '|<' . $g . '>';
- }
- $sql = sprintf(
- " AND ( NOT (deny_cid like '%s' OR deny_gid REGEXP '%s')
- AND ( allow_cid like '%s' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') )
- )
- ",
- dbesc(protect_sprintf( '%<' . $remote_user . '>%')),
- dbesc($gs),
- dbesc(protect_sprintf( '%<' . $remote_user . '>%')),
- dbesc($gs)
- );
+ $observer = get_observer_hash();
+ if($observer) {
+ $groups = init_groups_visitor($observer);
+
+ $gs = '<<>>'; // should be impossible to match
+
+ if(is_array($groups) && count($groups)) {
+ foreach($groups as $g)
+ $gs .= '|<' . $g . '>';
+ }
+ $sql = sprintf(
+ " AND ( NOT (deny_cid like '%s' OR deny_gid REGEXP '%s')
+ AND ( allow_cid like '%s' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') )
+ )
+ ",
+ dbesc(protect_sprintf( '%<' . $observer . '>%')),
+ dbesc($gs),
+ dbesc(protect_sprintf( '%<' . $observer . '>%')),
+ dbesc($gs)
+ );
+ }
}
+
return $sql;
}
@@ -260,25 +263,28 @@ function item_permissions_sql($owner_id,$remote_verified = false,$groups = null)
else {
- $observer = get_app()->get_observer();
- $groups = init_groups_visitor($remote_user);
-
- $gs = '<<>>'; // should be impossible to match
-
- if(is_array($groups) && count($groups)) {
- foreach($groups as $g)
- $gs .= '|<' . $g . '>';
- }
- $sql = sprintf(
- " AND ( NOT (deny_cid like '%s' OR deny_gid REGEXP '%s')
- AND ( allow_cid like '%s' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') )
- )
- ",
- dbesc(protect_sprintf( '%<' . $remote_user . '>%')),
- dbesc($gs),
- dbesc(protect_sprintf( '%<' . $remote_user . '>%')),
- dbesc($gs)
- );
+ $observer = get_observer_hash();
+
+ if($observer) {
+ $groups = init_groups_visitor($observer);
+
+ $gs = '<<>>'; // should be impossible to match
+
+ if(is_array($groups) && count($groups)) {
+ foreach($groups as $g)
+ $gs .= '|<' . $g . '>';
+ }
+ $sql = sprintf(
+ " AND ( NOT (deny_cid like '%s' OR deny_gid REGEXP '%s')
+ AND ( allow_cid like '%s' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') )
+ )
+ ",
+ dbesc(protect_sprintf( '%<' . $observer . '>%')),
+ dbesc($gs),
+ dbesc(protect_sprintf( '%<' . $observer . '>%')),
+ dbesc($gs)
+ );
+ }
}
return $sql;
}