harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

better fix for #629 #635 based on ownership/authorship rather than message flags which could be forged

Browse Source
This commit is contained in:
zotlabs 2016-12-31 15:56:45 -08:00
parent 709bcedbed
commit e2eb0b2eac
1 changed files with 6 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
include/zot.php
View File

@ -1782,7 +1782,7 @@ function process_delivery($sender, $arr, $deliveries, $relay, $public = false, $
$result[] = $DR->get(); $result[] = $DR->get();
} }
else { else {
update_imported_item($sender,$arr,$r[0],$channel['channel_id']); update_imported_item($sender,$arr,$r[0],$channel['channel_id'],$tag_delivery);
$DR->update('updated'); $DR->update('updated');
$result[] = $DR->get(); $result[] = $DR->get();
if(! $relay) if(! $relay)
@ -1930,7 +1930,7 @@ function remove_community_tag($sender, $arr, $uid) {
* @param int $uid * @param int $uid
*/ */
function update_imported_item($sender, $item, $orig, $uid) { function update_imported_item($sender, $item, $orig, $uid, $tag_delivery) {
// If this is a comment being updated, remove any privacy information // If this is a comment being updated, remove any privacy information
// so that item_store_update will set it from the original. // so that item_store_update will set it from the original.
@ -1943,16 +1943,11 @@ function update_imported_item($sender, $item, $orig, $uid) {
unset($item['item_private']); unset($item['item_private']);
} }
// Subtle issue where we might receive an edit item update from a downstream source. // we need the tag_delivery check for downstream flowing posts as the stored post
// Ignore unless it comes from upstream. // may have a different owner than the one being transmitted.
$x = q("select item_wall from item where mid = '%s' and uid = %d limit 1", if(($sender['hash'] != $orig['owner_xchan'] && $sender['hash'] != $orig['author_xchan']) && (! $tag_delivery)) {
dbesc($item['mid']), notice('sender is not owner or author');
intval($uid)
);
if($x && $x[0]['item_wall'] == 1 && $item['item_wall'] == 0) {
notice('remote wall update ignored');
return; return;
} }