From 48a33f08e2042b0bb809f43f9bec9d7739af3c28 Mon Sep 17 00:00:00 2001 From: Mario Date: Fri, 2 Jun 2023 11:33:44 +0000 Subject: ocap initial checkin --- Zotlabs/Lib/Activity.php | 25 ++++++- Zotlabs/Module/Item.php | 51 +++++++++++--- Zotlabs/Module/Lockview.php | 41 +++++++++--- Zotlabs/Module/Photo.php | 19 ++++-- Zotlabs/Module/Settings/Privacy.php | 5 ++ Zotlabs/Module/Wall_attach.php | 22 +++--- Zotlabs/Module/Wall_upload.php | 1 - include/attach.php | 54 +++++++++++---- include/items.php | 130 ++++++++++++++++++++++++++++++++++++ include/security.php | 12 +++- view/tpl/settings_privacy.tpl | 1 + 11 files changed, 307 insertions(+), 54 deletions(-) diff --git a/Zotlabs/Lib/Activity.php b/Zotlabs/Lib/Activity.php index db2dfd84a..8bb157347 100644 --- a/Zotlabs/Lib/Activity.php +++ b/Zotlabs/Lib/Activity.php @@ -459,6 +459,27 @@ class Activity { $ret['id'] = ((strpos($i['mid'], 'http') === 0) ? $i['mid'] : z_root() . '/item/' . urlencode($i['mid'])); $ret['diaspora:guid'] = $i['uuid']; + $images = []; + $has_images = preg_match_all('/\[[zi]mg(.*?)](.*?)\[/ism', $i['body'], $images, PREG_SET_ORDER); + + // provide ocap access token for private media. + // set this for descendants even if the current item is not private + // because it may have been relayed from a private item. + + $token = get_iconfig($i, 'ocap', 'relay'); + if ($token && $has_images) { + for ($n = 0; $n < count($images); $n++) { + $match = $images[$n]; + if (str_starts_with($match[1], '=http') && str_contains($match[1], z_root() . '/photo/')) { + $i['body'] = str_replace($match[1], $match[1] . '?token=' . $token, $i['body']); + $images[$n][2] = substr($match[1], 1) . '?token=' . $token; + } elseif (str_contains($match[2], z_root() . '/photo/')) { + $i['body'] = str_replace($match[2], $match[2] . '?token=' . $token, $i['body']); + $images[$n][2] = $match[2] . '?token=' . $token; + } + } + } + if ($i['title']) $ret['name'] = $i['title']; @@ -627,10 +648,10 @@ class Activity { } if (isset($att['type']) && strpos($att['type'], 'image')) { - $ret[] = ['type' => 'Image', 'url' => $att['href']]; + $ret[] = ['type' => 'Image', 'mediaType' => $att['type'], 'name' => $att['title'], 'url' => $att['href']]; } else { - $ret[] = ['type' => 'Link', 'mediaType' => $att['type'], 'href' => $att['href']]; + $ret[] = ['type' => 'Link', 'mediaType' => $att['type'], 'name' => $att['title'], 'href' => $att['href']]; } } } diff --git a/Zotlabs/Module/Item.php b/Zotlabs/Module/Item.php index a5f66d72e..b564396c9 100644 --- a/Zotlabs/Module/Item.php +++ b/Zotlabs/Module/Item.php @@ -218,6 +218,22 @@ class Item extends Controller { ); } + $bear = Activity::token_from_request(); + if ($bear) { + logger('bear: ' . $bear, LOGGER_DEBUG); + if (!$i) { + $t = q("select * from iconfig where cat = 'ocap' and k = 'relay' and v = '%s'", + dbesc($bear) + ); + if ($t) { + $i = q("select id as item_id from item where uuid = '%s' and id = %d $item_normal limit 1", + dbesc($item_id), + intval($t[0]['iid']) + ); + } + } + } + if (!$i) { http_status_exit(403, 'Forbidden'); } @@ -286,7 +302,9 @@ class Item extends Controller { if ((!local_channel()) && (!remote_channel()) && (!x($_REQUEST, 'anonname'))) return; - $uid = local_channel(); + $uid = local_channel(); + $token = ''; + $channel = null; $observer = null; $datarray = []; @@ -809,7 +827,6 @@ class Item extends Controller { require_once('include/text.php'); - // BBCODE alert: the following functions assume bbcode input // and will require alternatives for alternative content-types (text/html, text/markdown, text/plain, etc.) // we may need virtual or template classes to implement the possible alternatives @@ -845,6 +862,21 @@ class Item extends Controller { $private = 2; } + if ($private && get_pconfig($profile_uid, 'system', 'ocap_enabled')) { + // for edited posts, re-use any existing OCAP token (if found). + // Otherwise generate a new one. + + if ($iconfig) { + foreach ($iconfig as $cfg) { + if ($cfg['cat'] === 'ocap' && $cfg['k'] === 'relay') { + $token = $cfg['v']; + } + } + } + if (!$token) { + $token = new_token(); + } + } /** * @@ -866,9 +898,9 @@ class Item extends Controller { */ if (!$preview) { - fix_attached_photo_permissions($profile_uid, $owner_xchan['xchan_hash'], ((strpos($body, '[/crypt]')) ? $_POST['media_str'] : $body), $str_contact_allow, $str_group_allow, $str_contact_deny, $str_group_deny); - fix_attached_photo_permissions($profile_uid, $owner_xchan['xchan_hash'], ((strpos($summary, '[/crypt]')) ? $_POST['media_str'] : $summary), $str_contact_allow, $str_group_allow, $str_contact_deny, $str_group_deny); - fix_attached_file_permissions($channel, $observer['xchan_hash'], ((strpos($body, '[/crypt]')) ? $_POST['media_str'] : $body), $str_contact_allow, $str_group_allow, $str_contact_deny, $str_group_deny); + fix_attached_permissions($profile_uid, ((strpos($body, '[/crypt]')) ? $_POST['media_str'] : $body), $str_contact_allow, $str_group_allow, $str_contact_deny, $str_group_deny, $token); + //fix_attached_photo_permissions($profile_uid, $owner_xchan['xchan_hash'], ((strpos($body, '[/crypt]')) ? $_POST['media_str'] : $body), $str_contact_allow, $str_group_allow, $str_contact_deny, $str_group_deny, $token); + //fix_attached_file_permissions($channel, $observer['xchan_hash'], ((strpos($body, '[/crypt]')) ? $_POST['media_str'] : $body), $str_contact_allow, $str_group_allow, $str_contact_deny, $str_group_deny, $token); } $attachments = ''; @@ -951,14 +983,12 @@ class Item extends Controller { } } - $item_unseen = ((local_channel() != $profile_uid) ? 1 : 0); $item_wall = ((isset($_REQUEST['type']) && ($_REQUEST['type'] === 'wall' || $_REQUEST['type'] === 'wall-comment')) ? 1 : 0); $item_origin = (($origin) ? 1 : 0); $item_consensus = (($consensus) ? 1 : 0); $item_nocomment = (($nocomment) ? 1 : 0); - // determine if this is a wall post if ($parent) { @@ -1107,8 +1137,13 @@ class Item extends Controller { if (!empty_acl($datarray)) $datarray['public_policy'] = ''; - if ($iconfig) + if ($iconfig) { $datarray['iconfig'] = $iconfig; + } + + if ($token) { + IConfig::set($datarray, 'ocap', 'relay', $token); + } // preview mode - prepare the body for display and send it via json diff --git a/Zotlabs/Module/Lockview.php b/Zotlabs/Module/Lockview.php index bac3a7eb9..0c8e23f8c 100644 --- a/Zotlabs/Module/Lockview.php +++ b/Zotlabs/Module/Lockview.php @@ -15,6 +15,7 @@ class Lockview extends Controller { $atoken_xchans = []; $access_list = []; $guest_access_list = []; + $ocap_access_list = []; if (local_channel()) { $at = q("select * from atoken where atoken_uid = %d", @@ -166,6 +167,24 @@ class Lockview extends Controller { } } } + $ocap_tokens = []; + foreach ($allowed_users as $allowed_user) { + $allowed_user = trim($allowed_user, '\''); + if (str_starts_with($allowed_user, 'token:')) { + $ocap_tokens[] = str_replace('token:', '', $allowed_user); + } + } + + if ($ocap_tokens) { + stringify_array_elms($ocap_tokens, true); + $ocap_mids = dbq("select id, mid from item where id in (select iid from iconfig where cat = 'ocap' and k = 'relay' and v in (" . implode(', ', $ocap_tokens) . "))"); + + foreach ($ocap_mids as $ocap) { + $ocap_access_list[] = '' . t('Item') . ' ' . $ocap['id'] . ''; + } + + } + } $profile_groups = []; @@ -205,9 +224,6 @@ class Lockview extends Controller { } if ($atokens && $allowed_xchans && $url) { - - $guest_access_list = []; - $allowed_xchans = array_unique($allowed_xchans); foreach ($atokens as $atoken) { if (in_array($atoken['xchan_hash'], $allowed_xchans)) { @@ -216,22 +232,25 @@ class Lockview extends Controller { } } - $access_list_header = ''; + $access_list_header = '
' . t('Access') . '
'; + $guest_access_list_header = '
' . t('Guest access') . '
'; + $ocap_access_list_header = '
' . t('OCAP access') . '
'; + $divider = '
'; + $str = ''; + if ($access_list) { - $access_list_header = '
' . t('Access') . '
'; + $str .= $access_list_header . implode($access_list); } - $guest_access_list_header = ''; if ($guest_access_list) { - $guest_access_list_header = '
' . t('Guest access') . '
'; + $str .= $divider . $guest_access_list_header . implode($guest_access_list); } - $divider = ''; - if ($access_list && $guest_access_list) { - $divider = '
'; + if ($ocap_access_list) { + $str .= $divider . $ocap_access_list_header . implode($ocap_access_list); } - echo $access_list_header . implode($access_list) . $divider . $guest_access_list_header . implode($guest_access_list); + echo $str; killme(); } diff --git a/Zotlabs/Module/Photo.php b/Zotlabs/Module/Photo.php index fa87d96e5..cb83d78d3 100644 --- a/Zotlabs/Module/Photo.php +++ b/Zotlabs/Module/Photo.php @@ -46,7 +46,7 @@ class Photo extends \Zotlabs\Web\Controller { dbesc(argv(1)) ); if ($r) { - $allowed = attach_can_view($r[0]['uid'],$observer_xchan,argv(1)/*,$bear*/); + $allowed = attach_can_view($r[0]['uid'], $observer_xchan, argv(1), $bear); } if (! $allowed) { http_status_exit(404,'Permission denied.'); @@ -154,6 +154,11 @@ class Photo extends \Zotlabs\Web\Controller { } else { + $bear = Activity::token_from_request(); + if ($bear) { + logger('bear: ' . $bear, LOGGER_DEBUG); + } + /** * Other photos */ @@ -223,7 +228,7 @@ class Photo extends \Zotlabs\Web\Controller { } if($allowed === (-1)) - $allowed = attach_can_view($r[0]['uid'],$observer_xchan,$photo); + $allowed = attach_can_view($r[0]['uid'], $observer_xchan, $photo, $bear); $channel = channelx_by_n($r[0]['uid']); @@ -262,13 +267,13 @@ class Photo extends \Zotlabs\Web\Controller { http_status_exit(404,'not found'); } - if(! $data) - killme(); + if(! $data) + killme(); - $etag = '"' . md5($data . $modified) . '"'; + $etag = '"' . md5($data . $modified) . '"'; - if($modified == 0) - $modified = time(); + if($modified == 0) + $modified = time(); header_remove('Pragma'); if((isset($_SERVER['HTTP_IF_NONE_MATCH']) && $_SERVER['HTTP_IF_NONE_MATCH'] === $etag) || (!isset($_SERVER['HTTP_IF_NONE_MATCH']) && isset($_SERVER['HTTP_IF_MODIFIED_SINCE']) && $_SERVER['HTTP_IF_MODIFIED_SINCE'] === gmdate("D, d M Y H:i:s", $modified) . " GMT")) { diff --git a/Zotlabs/Module/Settings/Privacy.php b/Zotlabs/Module/Settings/Privacy.php index 65d5b538e..911c03aa5 100644 --- a/Zotlabs/Module/Settings/Privacy.php +++ b/Zotlabs/Module/Settings/Privacy.php @@ -25,6 +25,9 @@ class Privacy { $permit_all_mentions = (((x($_POST, 'permit_all_mentions')) && (intval($_POST['permit_all_mentions']) == 1)) ? 1 : 0); set_pconfig(local_channel(), 'system', 'permit_all_mentions', $permit_all_mentions); + $ocap_enabled = (((x($_POST, 'ocap_enabled')) && (intval($_POST['ocap_enabled']) == 1)) ? 1 : 0); + set_pconfig(local_channel(), 'system', 'ocap_enabled', $ocap_enabled); + $role = get_pconfig(local_channel(), 'system', 'permissions_role'); if ($role === 'custom') { @@ -103,6 +106,7 @@ class Privacy { $index_opt_out = get_pconfig(local_channel(), 'system', 'index_opt_out'); $group_actor = get_pconfig(local_channel(), 'system', 'group_actor'); $permit_all_mentions = get_pconfig(local_channel(), 'system', 'permit_all_mentions'); + $ocap_enabled = get_pconfig(local_channel(), 'system', 'ocap_enabled'); $permissions_role = get_pconfig(local_channel(), 'system', 'permissions_role', 'custom'); $permission_limits = ($permissions_role === 'custom'); @@ -125,6 +129,7 @@ class Privacy { '$index_opt_out' => ['index_opt_out', t('Opt-out of search engine indexing'), $index_opt_out, '', [t('No'), t('Yes')]], '$group_actor' => ['group_actor', t('Group actor'), $group_actor, t('Allow this channel to act as a forum'), [t('No'), t('Yes')]], '$permit_all_mentions' => ['permit_all_mentions', t('Accept all messages which mention you'), $permit_all_mentions, t('This setting bypasses normal permissions'), [t('No'), t('Yes')]], + '$ocap_enabled' => ['ocap_enabled', t('Enable OCAP access'), $ocap_enabled, t('Allow limited posts access to linked private media'), [t('No'), t('Yes')]], ]); return $o; diff --git a/Zotlabs/Module/Wall_attach.php b/Zotlabs/Module/Wall_attach.php index 2c0eeec77..80892f0f3 100644 --- a/Zotlabs/Module/Wall_attach.php +++ b/Zotlabs/Module/Wall_attach.php @@ -18,10 +18,10 @@ class Wall_attach extends \Zotlabs\Web\Controller { function post() { - + $using_api = false; - $result = []; + $result = []; if($_REQUEST['api_source'] && array_key_exists('media',$_FILES)) { $using_api = true; @@ -69,7 +69,7 @@ class Wall_attach extends \Zotlabs\Web\Controller { ]; } } - else { + else { if(! array_key_exists('userfile',$_FILES)) { $_FILES['userfile'] = [ 'name' => $_FILES['files']['name'], @@ -82,18 +82,18 @@ class Wall_attach extends \Zotlabs\Web\Controller { } $observer = \App::get_observer(); - - + + $def_album = get_pconfig($channel['channel_id'],'system','photo_path'); $def_attach = get_pconfig($channel['channel_id'],'system','attach_path'); - - $r = attach_store($channel,(($observer) ? $observer['xchan_hash'] : ''),'', array('source' => 'editor', 'visible' => 0, 'album' => $def_album, 'directory' => $def_attach, 'allow_cid' => '<' . $channel['channel_hash'] . '>')); + + $r = attach_store($channel,(($observer) ? $observer['xchan_hash'] : ''),'', array('source' => 'editor', 'visible' => 0, 'album' => $def_album, 'directory' => $def_attach, 'flags' => 1, 'allow_cid' => '<' . $channel['channel_hash'] . '>')); if(! $r['success']) { notice( $r['message'] . EOL); killme(); } - + if(intval($r['data']['is_photo'])) { $s = "\n\n" . $r['body'] . "\n\n"; } @@ -130,7 +130,7 @@ class Wall_attach extends \Zotlabs\Web\Controller { logger('unable to read svg data file: ' . 'store/' . $channel['channel_address'] . '/' . $r['data']['os_path']); } } - + $s .= "\n\n" . '[attachment]' . $r['data']['hash'] . ',' . $r['data']['revision'] . '[/attachment]' . "\n"; } @@ -144,8 +144,8 @@ class Wall_attach extends \Zotlabs\Web\Controller { $result['message'] = $s; json_return_and_die($result); - + } - + } diff --git a/Zotlabs/Module/Wall_upload.php b/Zotlabs/Module/Wall_upload.php index 3e979588c..4a6eee8f9 100644 --- a/Zotlabs/Module/Wall_upload.php +++ b/Zotlabs/Module/Wall_upload.php @@ -12,7 +12,6 @@ class Wall_upload extends \Zotlabs\Web\Controller { function post() { - $using_api = ((x($_FILES,'media')) ? true : false); if($using_api) { diff --git a/include/attach.php b/include/attach.php index b7fb17f38..4465a67fe 100644 --- a/include/attach.php +++ b/include/attach.php @@ -338,36 +338,46 @@ function attach_by_id($id, $observer_hash) { return $ret; } -function attach_can_view($uid,$ob_hash,$resource) { +function attach_can_view($uid, $ob_hash, $resource, $token = EMPTY_STR) { - $sql_extra = permissions_sql($uid,$ob_hash); + $sql_extra = permissions_sql($uid, $ob_hash, '', $token); $hash = $resource; - if(! perm_is_allowed($uid,$ob_hash,'view_storage')) { - return false; + if (!$token) { + if(! perm_is_allowed($uid, $ob_hash, 'view_storage')) { + return false; + } } $r = q("select folder from attach where hash = '%s' and uid = %d $sql_extra", dbesc($hash), intval($uid) ); - if(! $r) { + + if(!$r) { return false; } - return attach_can_view_folder($uid,$ob_hash,$r[0]['folder']); + // don't perform recursive folder check when using OCAP. Only when using ACL access. + // For OCAP if the token is valid they can see the thing. + + if ($token) { + return true; + } + + return attach_can_view_folder($uid, $ob_hash, $r[0]['folder'], $token); } -function attach_can_view_folder($uid,$ob_hash,$folder_hash) { +function attach_can_view_folder($uid, $ob_hash, $folder_hash, $token = EMPTY_STR) { - $sql_extra = permissions_sql($uid,$ob_hash); + $sql_extra = permissions_sql($uid, $ob_hash, '', $token); $hash = $folder_hash; - if(! $folder_hash) { - return perm_is_allowed($uid,$ob_hash,'view_storage'); + if(!$folder_hash && !$token) { + return perm_is_allowed($uid, $ob_hash, 'view_storage'); } @@ -508,7 +518,7 @@ function attach_store($channel, $observer_hash, $options = '', $arr = null) { $upload_path = $arr['directory'] ?? ''; $visible = $arr['visible'] ?? 0; $notify = $arr['notify'] ?? 0; - + $flags = (($arr && array_key_exists('flags', $arr)) ? intval($arr['flags']) : 0); $observer = array(); $dosync = ((array_key_exists('nosync',$arr) && $arr['nosync']) ? 0 : 1); @@ -933,8 +943,8 @@ function attach_store($channel, $observer_hash, $options = '', $arr = null) { ); } else { - $r = q("INSERT INTO attach ( aid, uid, hash, creator, filename, filetype, folder, filesize, revision, os_storage, is_photo, content, created, edited, os_path, display_path, allow_cid, allow_gid,deny_cid, deny_gid ) - VALUES ( %d, %d, '%s', '%s', '%s', '%s', '%s', %d, %d, %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s' ) ", + $r = q("INSERT INTO attach ( aid, uid, hash, creator, filename, filetype, folder, filesize, revision, os_storage, is_photo, flags, content, created, edited, os_path, display_path, allow_cid, allow_gid,deny_cid, deny_gid ) + VALUES ( %d, %d, '%s', '%s', '%s', '%s', '%s', %d, %d, %d, %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s' ) ", intval($channel['channel_account_id']), intval($channel_id), dbesc($hash), @@ -946,6 +956,7 @@ function attach_store($channel, $observer_hash, $options = '', $arr = null) { intval(0), intval(1), intval($is_photo), + intval($flags), dbescbin($os_basepath . $os_relpath), dbesc($created), dbesc($created), @@ -1413,6 +1424,23 @@ function attach_change_permissions($channel_id, $resource, $allow_cid, $allow_gi if(! $r) return; + $private = $allow_cid || $allow_gid || $deny_cid || $deny_gid; + + // preserve any existing tokens that may have been set for this file + // @fixme - we need a way to unconditionally clear these if desired. + + if ($private) { + $token_matches = null; + if (preg_match_all('/\/', $r[0]['allow_cid'], $token_matches, PREG_SET_ORDER)) { + foreach ($token_matches as $m) { + $tok = ''; + if (!str_contains($allow_cid, $tok)) { + $allow_cid .= $tok; + } + } + } + } + if(intval($r[0]['is_dir'])) { if($recurse) { $r = q("select hash, flags, is_dir from attach where folder = '%s' and uid = %d", diff --git a/include/items.php b/include/items.php index f6a93cc2c..a74fe8b50 100644 --- a/include/items.php +++ b/include/items.php @@ -5009,6 +5009,136 @@ function fix_attached_file_permissions($channel,$observer_hash,$body, } } +function list_attached_local_files($body) { + + $files = []; + $match = []; + + // match img and zmg image links + if (preg_match_all("/\[[zi]mg(.*?)](.*?)\[\/[zi]mg]/", $body, $match)) { + $images = array_merge($match[1], $match[2]); + if ($images) { + foreach ($images as $image) { + if (!stristr($image, z_root() . '/photo/')) { + continue; + } + $image_uri = substr($image,strrpos($image,'/') + 1); + if (str_contains($image_uri, '-')) { + $image_uri = substr($image_uri,0, strrpos($image_uri,'-')); + } + if (str_contains($image_uri, '.')) { + $image_uri = substr($image_uri,0, strpos($image_uri,'.')); + } + if ($image_uri && !in_array($image_uri, $files)) { + $files[] = $image_uri; + } + } + } + } + if (preg_match_all("/\[attachment](.*?)\[\/attachment]/",$body,$match)) { + $attaches = $match[1]; + if ($attaches) { + foreach ($attaches as $attach) { + $hash = substr($attach,0,strpos($attach,',')); + if ($hash && !in_array($hash, $files)) { + $files[] = $hash; + } + } + } + } + + return $files; +} + +function fix_attached_permissions($uid, $body, $str_contact_allow, $str_group_allow, $str_contact_deny, $str_group_deny, $token = EMPTY_STR) { + + $files = list_attached_local_files($body); + + if (! $files) { + return; + } + + foreach ($files as $file) { + $attach_q = q("select id, hash, flags, is_photo, allow_cid, allow_gid, deny_cid, deny_gid from attach where hash = '%s' and uid = %d", + dbesc($file), + intval($uid) + ); + + if (! $attach_q) { + continue; + } + + $attach = array_shift($attach_q); + + $new_public = !(($str_contact_allow || $str_group_allow || $str_contact_deny || $str_group_deny)); + $existing_public = !(($attach['allow_cid'] || $attach['allow_gid'] || $attach['deny_cid'] || $attach['deny_gid'])); + + if ($existing_public) { + // permissions have already been fixed and they are public. There's nothing for us to do. + continue; + } + + // if flags & 1, the attachment was uploaded directly into a post and needs to have permissions corrected + // or - if it is a private file and a new token was generated, we'll need to add the token to the ACL. + + if (((intval($attach['flags']) & 1) !== 1) && (! $token)) { + continue; + } + + $item_private = 0; + + if ($new_public === false) { + $item_private = (($str_group_allow || ($str_contact_allow && substr_count($str_contact_allow,'<') > 2)) ? 1 : 2); + + // preserve any existing tokens that may have been set for this file + $token_matches = null; + if (preg_match_all('//',$attach['allow_cid'],$token_matches, PREG_SET_ORDER)) { + foreach ($token_matches as $m) { + $tok = ''; + if (!str_contains($str_contact_allow, $tok)) { + $str_contact_allow .= $tok; + } + } + } + if ($token && !str_contains($str_contact_allow, $token)) { + $str_contact_allow .= ''; + } + } + + q("update attach SET allow_cid = '%s', allow_gid = '%s', deny_cid = '%s', deny_gid = '%s', flags = 0 + WHERE id = %d AND uid = %d", + dbesc($str_contact_allow), + dbesc($str_group_allow), + dbesc($str_contact_deny), + dbesc($str_group_deny), + intval($attach['id']), + intval($uid) + ); + + if ($attach['is_photo']) { + $r = q("UPDATE photo SET allow_cid = '%s', allow_gid = '%s', deny_cid = '%s', deny_gid = '%s' + WHERE resource_id = '%s' AND uid = %d ", + dbesc($str_contact_allow), + dbesc($str_group_allow), + dbesc($str_contact_deny), + dbesc($str_group_deny), + dbesc($file), + intval($uid) + ); + + $r = q("UPDATE item SET allow_cid = '%s', allow_gid = '%s', deny_cid = '%s', deny_gid = '%s', item_private = %d + WHERE resource_id = '%s' AND 'resource_type' = 'photo' AND uid = %d", + dbesc($str_contact_allow), + dbesc($str_group_allow), + dbesc($str_contact_deny), + dbesc($str_group_deny), + intval($item_private), + dbesc($file), + intval($uid) + ); + } + } +} function item_create_edit_activity($post) { diff --git a/include/security.php b/include/security.php index 2fbe1da1a..539e5f5b5 100644 --- a/include/security.php +++ b/include/security.php @@ -330,7 +330,7 @@ function change_channel($change_channel) { * @return string additional SQL where statement */ -function permissions_sql($owner_id, $remote_observer = null, $table = '') { +function permissions_sql($owner_id, $remote_observer = null, $table = '', $token = EMPTY_STR) { $local_channel = local_channel(); @@ -412,6 +412,16 @@ function permissions_sql($owner_id, $remote_observer = null, $table = '') { dbesc($gs) ); } + + /* + * OCAP token access + */ + + elseif ($token) { + $sql = " AND ( {$table}allow_cid like '" . protect_sprintf('%%') . + "' OR ( {$table}allow_cid = '' AND {$table}allow_gid = '' AND {$table}deny_cid = '' AND {$table}deny_gid = '' ) )"; + } + } return $sql; diff --git a/view/tpl/settings_privacy.tpl b/view/tpl/settings_privacy.tpl index 77d125e41..ae81cee78 100644 --- a/view/tpl/settings_privacy.tpl +++ b/view/tpl/settings_privacy.tpl @@ -11,6 +11,7 @@ {{include file="field_checkbox.tpl" field=$index_opt_out}} {{include file="field_checkbox.tpl" field=$autoperms}} {{include file="field_checkbox.tpl" field=$permit_all_mentions}} + {{include file="field_checkbox.tpl" field=$ocap_enabled}} {{if $sec_addon}} {{$sec_addon}} -- cgit v1.2.3