diff options
Diffstat (limited to 'include/security.php')
| -rw-r--r-- | include/security.php | 45 |
1 files changed, 26 insertions, 19 deletions
diff --git a/include/security.php b/include/security.php index d4ebe0024..f3cf2d1b6 100644 --- a/include/security.php +++ b/include/security.php @@ -18,20 +18,13 @@ function authenticate_success($user_record, $login_initial = false, $interactive $_SESSION['addr'] = $_SERVER['REMOTE_ADDR']; + $lastlog_updated = false; + if(x($user_record, 'account_id')) { $a->account = $user_record; $_SESSION['account_id'] = $user_record['account_id']; $_SESSION['authenticated'] = 1; - if($login_initial || $update_lastlog) { - q("update account set account_lastlog = '%s' where account_id = %d", - dbesc(datetime_convert()), - intval($_SESSION['account_id']) - ); - $a->account['account_lastlog'] = datetime_convert(); - call_hooks('logged_in', $a->account); - - } $uid_to_load = (((x($_SESSION,'uid')) && (intval($_SESSION['uid']))) ? intval($_SESSION['uid']) @@ -42,9 +35,19 @@ function authenticate_success($user_record, $login_initial = false, $interactive change_channel($uid_to_load); } + if($login_initial || $update_lastlog) { + q("update account set account_lastlog = '%s' where account_id = %d", + dbesc(datetime_convert()), + intval($_SESSION['account_id']) + ); + $a->account['account_lastlog'] = datetime_convert(); + $lastlog_updated = true; + call_hooks('logged_in', $a->account); + } + } - if($login_initial) { + if(($login_initial) && (! $lastlog_updated)) { call_hooks('logged_in', $user_record); @@ -145,7 +148,7 @@ function change_channel($change_channel) { * @return string additional SQL where statement */ -function permissions_sql($owner_id, $remote_observer = null) { +function permissions_sql($owner_id, $remote_observer = null, $table = '') { $local_channel = local_channel(); @@ -155,10 +158,14 @@ function permissions_sql($owner_id, $remote_observer = null) { * default permissions - anonymous user */ - $sql = " AND allow_cid = '' - AND allow_gid = '' - AND deny_cid = '' - AND deny_gid = '' + if($table) + $table .= '.'; + + + $sql = " AND {$table}allow_cid = '' + AND {$table}allow_gid = '' + AND {$table}deny_cid = '' + AND {$table}deny_gid = '' "; /** @@ -178,7 +185,7 @@ function permissions_sql($owner_id, $remote_observer = null) { */ else { - $observer = (($remote_observer) ? $remote_observer : get_observer_hash()); + $observer = ((! is_null($remote_observer)) ? $remote_observer : get_observer_hash()); if($observer) { $groups = init_groups_visitor($observer); @@ -190,8 +197,8 @@ function permissions_sql($owner_id, $remote_observer = null) { } $regexop = db_getfunc('REGEXP'); $sql = sprintf( - " AND ( NOT (deny_cid like '%s' OR deny_gid $regexop '%s') - AND ( allow_cid like '%s' OR allow_gid $regexop '%s' OR ( allow_cid = '' AND allow_gid = '') ) + " AND ( NOT ({$table}deny_cid like '%s' OR {$table}deny_gid $regexop '%s') + AND ( {$table}allow_cid like '%s' OR {$table}allow_gid $regexop '%s' OR ( {$table}allow_cid = '' AND {$table}allow_gid = '') ) ) ", dbesc(protect_sprintf( '%<' . $observer . '>%')), @@ -408,7 +415,7 @@ function init_groups_visitor($contact_id) { $r = q("SELECT hash FROM `groups` left join group_member on groups.id = group_member.gid WHERE xchan = '%s' ", dbesc($contact_id) ); - if(count($r)) { + if($r) { foreach($r as $rr) $groups[] = $rr['hash']; } |