From 29bd37cda2625ed66a6f135c1603ea445dde2db9 Mon Sep 17 00:00:00 2001 From: Michael Date: Thu, 19 Mar 2020 21:55:31 +0000 Subject: [PATCH] Issue 8371: Ensure to always have permissions --- mod/item.php | 38 +++++++++----------------------------- 1 file changed, 9 insertions(+), 29 deletions(-) diff --git a/mod/item.php b/mod/item.php index a9f1ef808b..3566e2150c 100644 --- a/mod/item.php +++ b/mod/item.php @@ -244,10 +244,10 @@ function item_post(App $a) { $body = preg_replace('#\[url=([^\]]*?)\]\[/url\]#ism', '[url]$1[/url]', $body); if (!empty($orig_post)) { - $str_group_allow = $orig_post['allow_gid']; - $str_contact_allow = $orig_post['allow_cid']; - $str_group_deny = $orig_post['deny_gid']; - $str_contact_deny = $orig_post['deny_cid']; + $str_group_allow = $orig_post['allow_gid'] ?? ''; + $str_contact_allow = $orig_post['allow_cid'] ?? ''; + $str_group_deny = $orig_post['deny_gid'] ?? ''; + $str_contact_deny = $orig_post['deny_cid'] ?? ''; $location = $orig_post['location']; $coord = $orig_post['coord']; $verb = $orig_post['verb']; @@ -261,33 +261,13 @@ function item_post(App $a) { $network = $orig_post['network']; $guid = $orig_post['guid']; $extid = $orig_post['extid']; - } else { + $aclFormatter = DI::aclFormatter(); - /* - * if coming from the API and no privacy settings are set, - * use the user default permissions - as they won't have - * been supplied via a form. - */ - if ($api_source - && !array_key_exists('contact_allow', $_REQUEST) - && !array_key_exists('group_allow', $_REQUEST) - && !array_key_exists('contact_deny', $_REQUEST) - && !array_key_exists('group_deny', $_REQUEST)) { - $str_group_allow = $user['allow_gid']; - $str_contact_allow = $user['allow_cid']; - $str_group_deny = $user['deny_gid']; - $str_contact_deny = $user['deny_cid']; - } else { - // use the posted permissions - - $aclFormatter = DI::aclFormatter(); - - $str_group_allow = $aclFormatter->toString($_REQUEST['group_allow'] ?? ''); - $str_contact_allow = $aclFormatter->toString($_REQUEST['contact_allow'] ?? ''); - $str_group_deny = $aclFormatter->toString($_REQUEST['group_deny'] ?? ''); - $str_contact_deny = $aclFormatter->toString($_REQUEST['contact_deny'] ?? ''); - } + $str_group_allow = isset($_REQUEST['group_allow']) ? $aclFormatter->toString($_REQUEST['group_allow']) : $user['allow_gid'] ?? ''; + $str_contact_allow = isset($_REQUEST['contact_allow']) ? $aclFormatter->toString($_REQUEST['contact__allow']) : $user['allow_cid'] ?? ''; + $str_group_deny = isset($_REQUEST['group_deny']) ? $aclFormatter->toString($_REQUEST['group_deny']) : $user['deny_gid'] ?? ''; + $str_contact_deny = isset($_REQUEST['contact_deny']) ? $aclFormatter->toString($_REQUEST['contact_deny']) : $user['deny_cid'] ?? ''; $title = Strings::escapeTags(trim($_REQUEST['title'] ?? '')); $location = Strings::escapeTags(trim($_REQUEST['location'] ?? ''));