diff options
| -rw-r--r-- | include/security.php | 71 | ||||
| -rw-r--r-- | mod/attach.php | 45 | ||||
| -rw-r--r-- | mod/display.php | 37 | ||||
| -rw-r--r-- | mod/photo.php | 36 | ||||
| -rw-r--r-- | mod/photos.php | 68 | ||||
| -rw-r--r-- | mod/profile.php | 43 | ||||
| -rw-r--r-- | view/theme/duepuntozero/style.css | 14 |
7 files changed, 100 insertions, 214 deletions
diff --git a/include/security.php b/include/security.php index c74a9b4a3..789e47db2 100644 --- a/include/security.php +++ b/include/security.php @@ -44,3 +44,74 @@ function can_write_wall(&$a,$owner) { return false; } + + +function permissions_sql($owner_id,$remote_verified = false,$groups = null) { + + $local_user = local_user(); + $remote_user = remote_user(); + + /** + * Construct permissions + * + * default permissions - anonymous user + */ + + $sql = " AND allow_cid = '' + AND allow_gid = '' + AND deny_cid = '' + AND deny_gid = '' + "; + + /** + * Profile owner - everything is visible + */ + + if(($local_user) && ($local_user == $owner_id)) { + $sql = ''; + } + + /** + * Authenticated visitor. Unless pre-verified, + * check that the contact belongs to this $owner_id + * and load the groups the visitor belongs to. + * If pre-verified, the caller is expected to have already + * done this and passed the groups into this function. + */ + + elseif($remote_user) { + + if(! $remote_verified) { + $r = q("SELECT id FROM contact WHERE id = %d AND uid = %d AND blocked = 0 LIMIT 1", + intval($remote_user), + intval($owner_id) + ); + if(count($r)) { + $remote_verified = true; + $groups = init_groups_visitor($remote_user); + } + } + if($remote_verified) { + + $gs = '<<>>'; // should be impossible to match + + if(is_array($groups) && count($groups)) { + foreach($groups as $g) + $gs .= '|<' . intval($g) . '>'; + } + + $sql = sprintf( + " AND ( allow_cid = '' OR allow_cid REGEXP '<%d>' ) + AND ( deny_cid = '' OR NOT deny_cid REGEXP '<%d>' ) + AND ( allow_gid = '' OR allow_gid REGEXP '%s' ) + AND ( deny_gid = '' OR NOT deny_gid REGEXP '%s') + ", + intval($remote_user), + intval($remote_user), + dbesc($gs), + dbesc($gs) + ); + } + } + return $sql; +}
\ No newline at end of file diff --git a/mod/attach.php b/mod/attach.php index 3953d3aa1..ae6540201 100644 --- a/mod/attach.php +++ b/mod/attach.php @@ -1,5 +1,7 @@ <?php +require_once('include/security.php'); + function attach_init(&$a) { if($a->argc != 2) { @@ -9,6 +11,8 @@ function attach_init(&$a) { $item_id = intval($a->argv[1]); + // Check for existence, which will also provide us the owner uid + $r = q("SELECT * FROM `attach` WHERE `id` = %d LIMIT 1", intval($item_id) ); @@ -17,39 +21,7 @@ function attach_init(&$a) { return; } - $owner = $r[0]['uid']; - - $sql_extra = " AND `allow_cid` = '' AND `allow_gid` = '' AND `deny_cid` = '' AND `deny_gid` = '' "; - - if(local_user() && ($owner == $_SESSION['uid'])) { - - // Owner can always see his/her photos - $sql_extra = ''; - - } - elseif(remote_user()) { - - // authenticated visitor - here lie dragons - - $groups = init_groups_visitor($_SESSION['visitor_id']); - $gs = '<<>>'; // should be impossible to match - if(count($groups)) { - foreach($groups as $g) - $gs .= '|<' . intval($g) . '>'; - } - - $sql_extra = sprintf( - " AND ( `allow_cid` = '' OR `allow_cid` REGEXP '<%d>' ) - AND ( `deny_cid` = '' OR NOT `deny_cid` REGEXP '<%d>' ) - AND ( `allow_gid` = '' OR `allow_gid` REGEXP '%s' ) - AND ( `deny_gid` = '' OR NOT `deny_gid` REGEXP '%s') ", - - intval($_SESSION['visitor_id']), - intval($_SESSION['visitor_id']), - dbesc($gs), - dbesc($gs) - ); - } + $sql_extra = permissions_sql($r[0]['uid']); // Now we'll see if we can access the attachment @@ -57,17 +29,14 @@ function attach_init(&$a) { dbesc($item_id) ); - if(count($r)) { - $data = $r[0]['data']; - } - else { + if(! count($r)) { notice( t('Permission denied.') . EOL); return; } header('Content-type: ' . $r[0]['filetype']); header('Content-disposition: attachment; filename=' . $r[0]['filename']); - echo $data; + echo $r[0]['data']; killme(); // NOTREACHED }
\ No newline at end of file diff --git a/mod/display.php b/mod/display.php index fdb93e480..305a21825 100644 --- a/mod/display.php +++ b/mod/display.php @@ -59,42 +59,7 @@ function display_content(&$a) { if(count($r)) $a->page_contact = $r[0]; - $sql_extra = " - AND `allow_cid` = '' - AND `allow_gid` = '' - AND `deny_cid` = '' - AND `deny_gid` = '' - "; - - - // Profile owner - everything is visible - - if(local_user() && (local_user() == $a->profile['uid'])) { - $sql_extra = ''; - } - - // authenticated visitor - here lie dragons - // If $remotecontact is true, we know that not only is this a remotely authenticated - // person, but that it is *our* contact, which is important in multi-user mode. - - elseif($remote_contact) { - $gs = '<<>>'; // should be impossible to match - if(count($groups)) { - foreach($groups as $g) - $gs .= '|<' . intval($g) . '>'; - } - $sql_extra = sprintf( - " AND ( `allow_cid` = '' OR `allow_cid` REGEXP '<%d>' ) - AND ( `deny_cid` = '' OR NOT `deny_cid` REGEXP '<%d>' ) - AND ( `allow_gid` = '' OR `allow_gid` REGEXP '%s' ) - AND ( `deny_gid` = '' OR NOT `deny_gid` REGEXP '%s') ", - - intval($_SESSION['visitor_id']), - intval($_SESSION['visitor_id']), - dbesc($gs), - dbesc($gs) - ); - } + $sql_extra = permissions_sql($a->profile['uid'],$remote_contact,$groups); $r = q("SELECT `item`.*, `item`.`id` AS `item_id`, `contact`.`name`, `contact`.`photo`, `contact`.`url`, `contact`.`rel`, diff --git a/mod/photo.php b/mod/photo.php index 3bea7e72d..9809aa418 100644 --- a/mod/photo.php +++ b/mod/photo.php @@ -1,5 +1,7 @@ <?php +require_once('include/security.php'); + function photo_init(&$a) { switch($a->argc) { @@ -73,39 +75,7 @@ function photo_init(&$a) { ); if(count($r)) { - $owner = $r[0]['uid']; - - $sql_extra = " AND `allow_cid` = '' AND `allow_gid` = '' AND `deny_cid` = '' AND `deny_gid` = '' "; - - if(local_user() && ($owner == $_SESSION['uid'])) { - - // Owner can always see his/her photos - $sql_extra = ''; - - } - elseif(remote_user()) { - - // authenticated visitor - here lie dragons - - $groups = init_groups_visitor($_SESSION['visitor_id']); - $gs = '<<>>'; // should be impossible to match - if(count($groups)) { - foreach($groups as $g) - $gs .= '|<' . intval($g) . '>'; - } - - $sql_extra = sprintf( - " AND ( `allow_cid` = '' OR `allow_cid` REGEXP '<%d>' ) - AND ( `deny_cid` = '' OR NOT `deny_cid` REGEXP '<%d>' ) - AND ( `allow_gid` = '' OR `allow_gid` REGEXP '%s' ) - AND ( `deny_gid` = '' OR NOT `deny_gid` REGEXP '%s') ", - - intval($_SESSION['visitor_id']), - intval($_SESSION['visitor_id']), - dbesc($gs), - dbesc($gs) - ); - } + $sql_extra = permissions_sql($r[0]['uid']); // Now we'll see if we can access the photo diff --git a/mod/photos.php b/mod/photos.php index f8059fc08..2c896e32f 100644 --- a/mod/photos.php +++ b/mod/photos.php @@ -3,6 +3,7 @@ require_once('include/Photo.php'); require_once('include/items.php'); require_once('include/acl_selectors.php'); require_once('include/bbcode.php'); +require_once('include/security.php'); function photos_init(&$a) { @@ -23,40 +24,8 @@ function photos_init(&$a) { $a->data['user'] = $r[0]; - - // default permissions - anonymous user - - $sql_extra = " AND `allow_cid` = '' AND `allow_gid` = '' AND `deny_cid` = '' AND `deny_gid` = '' "; - - // Profile owner - everything is visible - - if(local_user() && (local_user() == $a->data['user']['uid'])) { - $sql_extra = ''; - } - elseif(remote_user()) { - - $groups = init_groups_visitor(remote_user()); - - // authenticated visitor - here lie dragons - $gs = '<<>>'; // should be impossible to match - if(count($groups)) { - foreach($groups as $g) - $gs .= '|<' . intval($g) . '>'; - } - $sql_extra = sprintf( - " AND ( `allow_cid` = '' OR `allow_cid` REGEXP '<%d>' ) - AND ( `deny_cid` = '' OR NOT `deny_cid` REGEXP '<%d>' ) - AND ( `allow_gid` = '' OR `allow_gid` REGEXP '%s' ) - AND ( `deny_gid` = '' OR NOT `deny_gid` REGEXP '%s') ", - - intval(remote_user()), - intval(remote_user()), - dbesc($gs), - dbesc($gs) - ); - } - - + $sql_extra = permissions_sql($a->data['user']['uid']); +echo "SQL=$sql_extra"; $albums = q("SELECT distinct(`album`) AS `album` FROM `photo` WHERE `uid` = %d $sql_extra ", intval($a->data['user']['uid']) ); @@ -806,8 +775,6 @@ function photos_content(&$a) { $owner_uid = $a->data['user']['uid']; - - $community_page = (($a->data['user']['page-flags'] == PAGE_COMMUNITY) ? true : false); if((local_user()) && (local_user() == $owner_uid)) @@ -858,34 +825,7 @@ function photos_content(&$a) { return; } - // default permissions - anonymous user - - $sql_extra = " AND `allow_cid` = '' AND `allow_gid` = '' AND `deny_cid` = '' AND `deny_gid` = '' "; - - // Profile owner - everything is visible - - if(local_user() && (local_user() == $owner_uid)) { - $sql_extra = ''; - } - elseif(remote_user()) { - // authenticated visitor - here lie dragons - $gs = '<<>>'; // should be impossible to match - if(count($groups)) { - foreach($groups as $g) - $gs .= '|<' . intval($g) . '>'; - } - $sql_extra = sprintf( - " AND ( `allow_cid` = '' OR `allow_cid` REGEXP '<%d>' ) - AND ( `deny_cid` = '' OR NOT `deny_cid` REGEXP '<%d>' ) - AND ( `allow_gid` = '' OR `allow_gid` REGEXP '%s' ) - AND ( `deny_gid` = '' OR NOT `deny_gid` REGEXP '%s') ", - - intval(remote_user()), - intval(remote_user()), - dbesc($gs), - dbesc($gs) - ); - } + $sql_extra = permissions_sql($owner_uid,$remote_contact,$groups); $o = ""; diff --git a/mod/profile.php b/mod/profile.php index f2dd7f4df..e9b144ffd 100644 --- a/mod/profile.php +++ b/mod/profile.php @@ -164,48 +164,19 @@ function profile_content(&$a, $update = 0) { } } - // Construct permissions - - // default permissions - anonymous user - - $sql_extra = " AND `allow_cid` = '' AND `allow_gid` = '' AND `deny_cid` = '' AND `deny_gid` = '' "; - - // Profile owner - everything is visible - if($is_owner) { - $sql_extra = ''; - - // Oh - while we're here... reset the Unseen messages - $r = q("UPDATE `item` SET `unseen` = 0 WHERE `wall` = 1 AND `unseen` = 1 AND `uid` = %d", - intval($_SESSION['uid']) + intval(local_user()) ); - } - // authenticated visitor - here lie dragons - // If $remotecontact is true, we know that not only is this a remotely authenticated - // person, but that it is *our* contact, which is important in multi-user mode. - - elseif($remote_contact) { - $gs = '<<>>'; // should be impossible to match - if(count($groups)) { - foreach($groups as $g) - $gs .= '|<' . intval($g) . '>'; - } - $sql_extra = sprintf( - " AND ( `allow_cid` = '' OR `allow_cid` REGEXP '<%d>' ) - AND ( `deny_cid` = '' OR NOT `deny_cid` REGEXP '<%d>' ) - AND ( `allow_gid` = '' OR `allow_gid` REGEXP '%s' ) - AND ( `deny_gid` = '' OR NOT `deny_gid` REGEXP '%s') ", - - intval($_SESSION['visitor_id']), - intval($_SESSION['visitor_id']), - dbesc($gs), - dbesc($gs) - ); - } + /** + * Get permissions SQL - if $remote_contact is true, our remote user has been pre-verified and we already have fetched his/her groups + */ + + $sql_extra = permissions_sql($a->profile['profile_uid'],$remote_contact,$groups); + $r = q("SELECT COUNT(*) AS `total` FROM `item` LEFT JOIN `contact` ON `contact`.`id` = `item`.`contact-id` diff --git a/view/theme/duepuntozero/style.css b/view/theme/duepuntozero/style.css index 67a1546ee..a99d7530f 100644 --- a/view/theme/duepuntozero/style.css +++ b/view/theme/duepuntozero/style.css @@ -2547,7 +2547,7 @@ a.mail-list-link { .settings-block > h3, .settings-heading { - border-bottom: 1px solid #babdb6 + border-bottom: 1px solid #babdb6; } @@ -2632,7 +2632,7 @@ a.mail-list-link { margin-right: 1em; } -#adminpage table {width:100%; border-bottom: 1p solid #000000; margin: 5px 0px;} +#adminpage table {width:100%; border-bottom: 1px solid #000000; margin: 5px 0px;} #adminpage table th { text-align: left;} #adminpage td .icon { float: left;} #adminpage table#users img { width: 16px; height: 16px; } @@ -2692,9 +2692,9 @@ a.mail-list-link { margin-top: 10px; } -.type-video { background-position: 0px; 0px; } -.type-image { background-position: -20px; 0px; } -.type-audio { background-position: -40px; 0px; } -.type-text { background-position: -60px; 0px; } -.type-unkn { background-position: -80px; 0px; } +.type-video { background-position: 0px 0px; } +.type-image { background-position: -20px 0px; } +.type-audio { background-position: -40px 0px; } +.type-text { background-position: -60px 0px; } +.type-unkn { background-position: -80px 0px; } |