From c37ffd2999453de17bd6b0c98b708a0f55bacdc7 Mon Sep 17 00:00:00 2001 From: friendica Date: Mon, 5 Mar 2012 15:04:43 -0800 Subject: can_write_wall documentation --- include/security.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'include/security.php') diff --git a/include/security.php b/include/security.php index bc2c9f0bf..6b8128bdd 100755 --- a/include/security.php +++ b/include/security.php @@ -108,14 +108,18 @@ function can_write_wall(&$a,$owner) { if(remote_user()) { - // user remembered decision and avoid a DB lookup for each and every display item + // use remembered decision and avoid a DB lookup for each and every display item // DO NOT use this function if there are going to be multiple owners + // We have a contact-id for an authenticated remote user, this block determines if the contact + // belongs to this page owner, and has the necessary permissions to post content + if($verified === 2) return true; elseif($verified === 1) return false; else { + $r = q("SELECT `contact`.*, `user`.`page-flags` FROM `contact` LEFT JOIN `user` on `user`.`uid` = `contact`.`uid` WHERE `contact`.`uid` = %d AND `contact`.`id` = %d AND `contact`.`blocked` = 0 AND `contact`.`pending` = 0 AND `user`.`blockwall` = 0 AND `readonly` = 0 AND ( `contact`.`rel` IN ( %d , %d ) OR `user`.`page-flags` = %d ) LIMIT 1", @@ -125,6 +129,7 @@ function can_write_wall(&$a,$owner) { intval(CONTACT_IS_FRIEND), intval(PAGE_COMMUNITY) ); + if(count($r)) { $verified = 2; return true; -- cgit v1.2.3 From 88cd5800cf2e22f365bc38f567fcc1627e9278a7 Mon Sep 17 00:00:00 2001 From: friendica Date: Tue, 6 Mar 2012 17:21:14 -0800 Subject: [privacy] rework latest fix --- include/security.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'include/security.php') diff --git a/include/security.php b/include/security.php index 6b8128bdd..c04491570 100755 --- a/include/security.php +++ b/include/security.php @@ -159,6 +159,7 @@ function permissions_sql($owner_id,$remote_verified = false,$groups = null) { AND allow_gid = '' AND deny_cid = '' AND deny_gid = '' + AND private = 0 "; /** @@ -199,10 +200,11 @@ function permissions_sql($owner_id,$remote_verified = false,$groups = null) { } $sql = sprintf( - " AND ( allow_cid = '' OR allow_cid REGEXP '<%d>' ) + " AND (( allow_cid = '' OR allow_cid REGEXP '<%d>' ) AND ( deny_cid = '' OR NOT deny_cid REGEXP '<%d>' ) AND ( allow_gid = '' OR allow_gid REGEXP '%s' ) AND ( deny_gid = '' OR NOT deny_gid REGEXP '%s') + OR private = 0 ) ", intval($remote_user), intval($remote_user), -- cgit v1.2.3 From 7ad2dd65654f6b1cb17ae98e65c3e95528d29e30 Mon Sep 17 00:00:00 2001 From: friendica Date: Tue, 6 Mar 2012 17:52:00 -0800 Subject: fix photos after permissions_sql change --- include/security.php | 80 +++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 76 insertions(+), 4 deletions(-) (limited to 'include/security.php') diff --git a/include/security.php b/include/security.php index c04491570..9042d4d64 100755 --- a/include/security.php +++ b/include/security.php @@ -149,6 +149,77 @@ function permissions_sql($owner_id,$remote_verified = false,$groups = null) { $local_user = local_user(); $remote_user = remote_user(); + /** + * Construct permissions + * + * default permissions - anonymous user + */ + + $sql = " AND allow_cid = '' + AND allow_gid = '' + AND deny_cid = '' + AND deny_gid = '' + "; + + /** + * Profile owner - everything is visible + */ + + if(($local_user) && ($local_user == $owner_id)) { + $sql = ''; + } + + /** + * Authenticated visitor. Unless pre-verified, + * check that the contact belongs to this $owner_id + * and load the groups the visitor belongs to. + * If pre-verified, the caller is expected to have already + * done this and passed the groups into this function. + */ + + elseif($remote_user) { + + if(! $remote_verified) { + $r = q("SELECT id FROM contact WHERE id = %d AND uid = %d AND blocked = 0 LIMIT 1", + intval($remote_user), + intval($owner_id) + ); + if(count($r)) { + $remote_verified = true; + $groups = init_groups_visitor($remote_user); + } + } + if($remote_verified) { + + $gs = '<<>>'; // should be impossible to match + + if(is_array($groups) && count($groups)) { + foreach($groups as $g) + $gs .= '|<' . intval($g) . '>'; + } + + $sql = sprintf( + " AND ( allow_cid = '' OR allow_cid REGEXP '<%d>' ) + AND ( deny_cid = '' OR NOT deny_cid REGEXP '<%d>' ) + AND ( allow_gid = '' OR allow_gid REGEXP '%s' ) + AND ( deny_gid = '' OR NOT deny_gid REGEXP '%s') + ", + intval($remote_user), + intval($remote_user), + dbesc($gs), + dbesc($gs) + ); + } + } + return $sql; +} + + +function item_permissions_sql($owner_id,$remote_verified = false,$groups = null) { + + $local_user = local_user(); + $remote_user = remote_user(); + /** * Construct permissions * @@ -200,11 +271,10 @@ function permissions_sql($owner_id,$remote_verified = false,$groups = null) { } $sql = sprintf( - " AND (( allow_cid = '' OR allow_cid REGEXP '<%d>' ) + " AND ( private = 0 OR (( allow_cid = '' OR allow_cid REGEXP '<%d>' ) AND ( deny_cid = '' OR NOT deny_cid REGEXP '<%d>' ) AND ( allow_gid = '' OR allow_gid REGEXP '%s' ) - AND ( deny_gid = '' OR NOT deny_gid REGEXP '%s') - OR private = 0 ) + AND ( deny_gid = '' OR NOT deny_gid REGEXP '%s'))) ", intval($remote_user), intval($remote_user), @@ -214,4 +284,6 @@ function permissions_sql($owner_id,$remote_verified = false,$groups = null) { } } return $sql; -} \ No newline at end of file +} + + -- cgit v1.2.3 From dd3b3c2454b98225e2251a890095e8a971fdb396 Mon Sep 17 00:00:00 2001 From: friendica Date: Wed, 7 Mar 2012 15:54:37 -0800 Subject: revup --- include/security.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include/security.php') diff --git a/include/security.php b/include/security.php index 9042d4d64..f469dad66 100755 --- a/include/security.php +++ b/include/security.php @@ -271,7 +271,7 @@ function item_permissions_sql($owner_id,$remote_verified = false,$groups = null) } $sql = sprintf( - " AND ( private = 0 OR (( allow_cid = '' OR allow_cid REGEXP '<%d>' ) + " AND ( private = 0 OR ( private = 1 AND wall = 1 AND ( allow_cid = '' OR allow_cid REGEXP '<%d>' ) AND ( deny_cid = '' OR NOT deny_cid REGEXP '<%d>' ) AND ( allow_gid = '' OR allow_gid REGEXP '%s' ) AND ( deny_gid = '' OR NOT deny_gid REGEXP '%s'))) -- cgit v1.2.3 From 312c17504515b0f6c77b2e59ef8569dbf8d048fa Mon Sep 17 00:00:00 2001 From: friendica Date: Fri, 9 Mar 2012 00:31:17 -0800 Subject: bug in check for private email comment to public conversation prevents authenticated visitor from seeing comments that should be allowed --- include/security.php | 1 + 1 file changed, 1 insertion(+) (limited to 'include/security.php') diff --git a/include/security.php b/include/security.php index f469dad66..8c536b656 100755 --- a/include/security.php +++ b/include/security.php @@ -283,6 +283,7 @@ function item_permissions_sql($owner_id,$remote_verified = false,$groups = null) ); } } + return $sql; } -- cgit v1.2.3