From 88cd5800cf2e22f365bc38f567fcc1627e9278a7 Mon Sep 17 00:00:00 2001 From: friendica Date: Tue, 6 Mar 2012 17:21:14 -0800 Subject: [privacy] rework latest fix --- include/security.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'include/security.php') diff --git a/include/security.php b/include/security.php index 6b8128bdd..c04491570 100755 --- a/include/security.php +++ b/include/security.php @@ -159,6 +159,7 @@ function permissions_sql($owner_id,$remote_verified = false,$groups = null) { AND allow_gid = '' AND deny_cid = '' AND deny_gid = '' + AND private = 0 "; /** @@ -199,10 +200,11 @@ function permissions_sql($owner_id,$remote_verified = false,$groups = null) { } $sql = sprintf( - " AND ( allow_cid = '' OR allow_cid REGEXP '<%d>' ) + " AND (( allow_cid = '' OR allow_cid REGEXP '<%d>' ) AND ( deny_cid = '' OR NOT deny_cid REGEXP '<%d>' ) AND ( allow_gid = '' OR allow_gid REGEXP '%s' ) AND ( deny_gid = '' OR NOT deny_gid REGEXP '%s') + OR private = 0 ) ", intval($remote_user), intval($remote_user), -- cgit v1.2.3 From 7ad2dd65654f6b1cb17ae98e65c3e95528d29e30 Mon Sep 17 00:00:00 2001 From: friendica Date: Tue, 6 Mar 2012 17:52:00 -0800 Subject: fix photos after permissions_sql change --- include/security.php | 80 +++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 76 insertions(+), 4 deletions(-) (limited to 'include/security.php') diff --git a/include/security.php b/include/security.php index c04491570..9042d4d64 100755 --- a/include/security.php +++ b/include/security.php @@ -149,6 +149,77 @@ function permissions_sql($owner_id,$remote_verified = false,$groups = null) { $local_user = local_user(); $remote_user = remote_user(); + /** + * Construct permissions + * + * default permissions - anonymous user + */ + + $sql = " AND allow_cid = '' + AND allow_gid = '' + AND deny_cid = '' + AND deny_gid = '' + "; + + /** + * Profile owner - everything is visible + */ + + if(($local_user) && ($local_user == $owner_id)) { + $sql = ''; + } + + /** + * Authenticated visitor. Unless pre-verified, + * check that the contact belongs to this $owner_id + * and load the groups the visitor belongs to. + * If pre-verified, the caller is expected to have already + * done this and passed the groups into this function. + */ + + elseif($remote_user) { + + if(! $remote_verified) { + $r = q("SELECT id FROM contact WHERE id = %d AND uid = %d AND blocked = 0 LIMIT 1", + intval($remote_user), + intval($owner_id) + ); + if(count($r)) { + $remote_verified = true; + $groups = init_groups_visitor($remote_user); + } + } + if($remote_verified) { + + $gs = '<<>>'; // should be impossible to match + + if(is_array($groups) && count($groups)) { + foreach($groups as $g) + $gs .= '|<' . intval($g) . '>'; + } + + $sql = sprintf( + " AND ( allow_cid = '' OR allow_cid REGEXP '<%d>' ) + AND ( deny_cid = '' OR NOT deny_cid REGEXP '<%d>' ) + AND ( allow_gid = '' OR allow_gid REGEXP '%s' ) + AND ( deny_gid = '' OR NOT deny_gid REGEXP '%s') + ", + intval($remote_user), + intval($remote_user), + dbesc($gs), + dbesc($gs) + ); + } + } + return $sql; +} + + +function item_permissions_sql($owner_id,$remote_verified = false,$groups = null) { + + $local_user = local_user(); + $remote_user = remote_user(); + /** * Construct permissions * @@ -200,11 +271,10 @@ function permissions_sql($owner_id,$remote_verified = false,$groups = null) { } $sql = sprintf( - " AND (( allow_cid = '' OR allow_cid REGEXP '<%d>' ) + " AND ( private = 0 OR (( allow_cid = '' OR allow_cid REGEXP '<%d>' ) AND ( deny_cid = '' OR NOT deny_cid REGEXP '<%d>' ) AND ( allow_gid = '' OR allow_gid REGEXP '%s' ) - AND ( deny_gid = '' OR NOT deny_gid REGEXP '%s') - OR private = 0 ) + AND ( deny_gid = '' OR NOT deny_gid REGEXP '%s'))) ", intval($remote_user), intval($remote_user), @@ -214,4 +284,6 @@ function permissions_sql($owner_id,$remote_verified = false,$groups = null) { } } return $sql; -} \ No newline at end of file +} + + -- cgit v1.2.3