harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixes for display and search privacy enforcement

Browse Source
This commit is contained in:
friendica
2013-09-22 22:52:48 -07:00
parent 3ff9642750
commit 956d275693
3 changed files with 77 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
include/security.php
View File

@@ -302,16 +302,19 @@ function public_permissions_sql($observer_hash) {
foreach($groups as $g)
$gs .= '|<' . $g . '>';
}
$sql = sprintf(
" OR (( NOT (deny_cid like '%s' OR deny_gid REGEXP '%s')
AND ( allow_cid like '%s' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') )
))
",
dbesc(protect_sprintf( '%<' . $observer_hash . '>%')),
dbesc($gs),
dbesc(protect_sprintf( '%<' . $observer_hash . '>%')),
dbesc($gs)
);
$sql = '';
if($observer_hash) {
$sql = sprintf(
" OR (( NOT (deny_cid like '%s' OR deny_gid REGEXP '%s')
AND ( allow_cid like '%s' OR allow_gid REGEXP '%s' OR ( allow_cid = '' AND allow_gid = '') )
))
",
dbesc(protect_sprintf( '%<' . $observer_hash . '>%')),
dbesc($gs),
dbesc(protect_sprintf( '%<' . $observer_hash . '>%')),
dbesc($gs)
);
}
return $sql;
}
@@ -424,6 +427,29 @@ function stream_perms_api_uids($perms_min = PERMS_SITE) {
$str .= ',';
$str .= intval($rr);
}
logger('stream_perms_api_uids: ' . $str);
return $str;
}
function stream_perms_xchans($perms_min = PERMS_SITE) {
$ret = array();
if(local_user())
$ret[] = get_observer_hash();
$r = q("select channel_hash from channel where channel_r_stream <= %d",
intval($perms_min)
);
if($r)
foreach($r as $rr)
if(! in_array($rr['channel_hash'],$ret))
$ret[] = $rr['channel_hash'];
$str = '';
if($ret)
foreach($ret as $rr) {
if($str)
$str .= ',';
$str .= "'" . dbesc($rr) . "'";
}
logger('stream_perms_xchans: ' . $str);
return $str;
}