Friendica/friendica-github
1
0
Fork 0
mirror of https://github.com/friendica/friendica synced 2025-05-03 11:44:09 +02:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #5946 from JonnyTischbein/move_include_security

Browse source 
Move and Split include/security
This commit is contained in:
Hypolite Petovan 2018-10-19 08:55:08 -04:00 • committed by GitHub
commit ec0d3a6eac
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
40 changed files with 625 additions and 591 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/Model/Group.php
View file

@ -4,9 +4,11 @@
*/
namespace Friendica\Model;
use Friendica\BaseModule;
use Friendica\BaseObject;
use Friendica\Core\L10n;
use Friendica\Database\DBA;
use Friendica\Util\Security;
require_once 'boot.php';
require_once 'include/dba.php';
@ -409,7 +411,7 @@ class Group extends BaseObject
'$createtext' => L10n::t('Create a new group'),
'$creategroup' => L10n::t('Group Name: '),
'$editgroupstext' => L10n::t('Edit groups'),
'$form_security_token' => get_form_security_token('group_edit'),
'$form_security_token' => BaseModule::getFormSecurityToken('group_edit'),
]);

40
src/Model/Item.php
View file

@ -24,6 +24,7 @@ use Friendica\Protocol\Diaspora;
use Friendica\Protocol\OStatus;
use Friendica\Util\DateTimeFormat;
use Friendica\Util\XML;
use Friendica\Util\Security;
use Text_LanguageDetect;
require_once 'boot.php';
@ -3007,7 +3008,7 @@ class Item extends BaseObject
$uid = local_user();
}
if (!can_write_wall($uid)) {
if (!Security::canWriteToUserWall($uid)) {
logger('like: unable to write on wall ' . $uid);
return false;
}
@ -3193,4 +3194,41 @@ class Item extends BaseObject
}
}
}
public static function getPermissionsSQLByUserId($owner_id, $remote_verified = false, $groups = null)
{
$local_user = local_user();
$remote_user = remote_user();
/*
* Construct permissions
*
* default permissions - anonymous user
*/
$sql = " AND NOT `item`.`private`";
// Profile owner - everything is visible
if ($local_user && ($local_user == $owner_id)) {
$sql = '';
} elseif ($remote_user) {
/*
* Authenticated visitor. Unless pre-verified,
* check that the contact belongs to this $owner_id
* and load the groups the visitor belongs to.
* If pre-verified, the caller is expected to have already
* done this and passed the groups into this function.
*/
$set = PermissionSet::get($owner_id, $remote_user, $groups);
if (!empty($set)) {
$sql_set = " OR (`item`.`private` IN (1,2) AND `item`.`wall` AND `item`.`psid` IN (" . implode(',', $set) . "))";
} else {
$sql_set = '';
}
$sql = " AND (NOT `item`.`private`" . $sql_set . ")";
}
return $sql;
}
}

3
src/Model/Photo.php
View file

@ -14,6 +14,7 @@ use Friendica\Database\DBA;
use Friendica\Object\Image;
use Friendica\Util\DateTimeFormat;
use Friendica\Util\Network;
use Friendica\Util\Security;
require_once 'include/dba.php';
@ -226,7 +227,7 @@ class Photo
*/
public static function getAlbums($uid, $update = false)
{
$sql_extra = permissions_sql($uid);
$sql_extra = Security::getPermissionsSQLByUserId($uid);
$key = "photo_albums:".$uid.":".local_user().":".remote_user();
$albums = Cache::get($key);