harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

correct fix for wiki anonymous read issue (items_permissions_sql checks item.public_policy which was set for posts, not wikis)

Browse Source
This commit is contained in:
zotlabs 2017-03-06 15:33:10 -08:00
parent f783d594cc
commit 751c4c3169
2 changed files with 6 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
Zotlabs/Lib/NativeWikiPage.php
View File

@ -64,6 +64,8 @@ class NativeWikiPage {
$arr['deny_cid'] = $w['wiki']['deny_cid'];
$arr['deny_gid'] = $w['wiki']['deny_gid'];
$arr['public_policy'] = map_scope(\Zotlabs\Access\PermissionLimits::Get($channel_id,'view_wiki'),true);
// We may wish to change this some day.
$arr['item_unpublished'] = 1;
@ -232,10 +234,7 @@ class NativeWikiPage {
}
}
$sql_extra = '';
if($w['wiki']['allow_cid'] || $w['wiki']['allow_gid'] || $w['wiki']['deny_cid'] || $w['wiki']['deny_gid'])
$sql_extra .= item_permissions_sql($channel_id,$observer_hash);
$sql_extra = item_permissions_sql($channel_id,$observer_hash);
if($revision == (-1))
$sql_extra .= " order by revision desc ";
@ -288,10 +287,7 @@ class NativeWikiPage {
}
}
$sql_extra = '';
if($w['wiki']['allow_cid'] || $w['wiki']['allow_gid'] || $w['wiki']['deny_cid'] || $w['wiki']['deny_gid'])
$sql_extra .= item_permissions_sql($channel_id,$observer_hash);
$sql_extra = item_permissions_sql($channel_id,$observer_hash);
$sql_extra .= " order by revision desc ";

3
include/items.php
View File

@ -328,7 +328,8 @@ function post_activity_item($arr,$allow_code = false,$deliver = true) {
return $ret;
}
$arr['public_policy'] = ((x($_REQUEST,'public_policy')) ? escape_tags($_REQUEST['public_policy']) : map_scope(\Zotlabs\Access\PermissionLimits::Get($channel['channel_id'],'view_stream'),true));
$arr['public_policy'] = ((array_key_exists('public_policy',$arr)) ? escape_tags($arr['public_policy']) : map_scope(\Zotlabs\Access\PermissionLimits::Get($channel['channel_id'],'view_stream'),true));
if($arr['public_policy'])
$arr['item_private'] = 1;