diff --git a/boot.php b/boot.php index 6d09c647e9..3aca931492 100644 --- a/boot.php +++ b/boot.php @@ -416,19 +416,12 @@ function public_contact() */ function remote_user($uid = null) { - // You cannot be both local and remote. - // Unncommented by rabuzarus because remote authentication to local - // profiles wasn't possible anymore (2018-04-12). -// if (local_user()) { -// return false; -// } - if (empty($_SESSION['authenticated'])) { return false; } if (!is_null($uid)) { - return Session::getVisitorContactIDForUserID($uid); + return Session::getRemoteContactID($uid); } elseif (is_null($uid) && !empty($_SESSION['visitor_id'])) { return intval($_SESSION['visitor_id']); } diff --git a/include/items.php b/include/items.php index c5d8fc023d..ae686a32d9 100644 --- a/include/items.php +++ b/include/items.php @@ -13,6 +13,7 @@ use Friendica\Core\PConfig; use Friendica\Core\Protocol; use Friendica\Core\Renderer; use Friendica\Core\System; +use Friendica\Core\Session; use Friendica\Database\DBA; use Friendica\Model\Item; use Friendica\Protocol\DFRN; @@ -362,7 +363,7 @@ function drop_item($id, $return = '') $contact_id = 0; // check if logged in user is either the author or owner of this item - if (remote_user($item['uid']) == $item['contact-id']) { + if (Session::getRemoteContactID($item['uid']) == $item['contact-id']) { $contact_id = $item['contact-id']; } diff --git a/mod/photos.php b/mod/photos.php index daa31276f0..3bf49f37be 100644 --- a/mod/photos.php +++ b/mod/photos.php @@ -904,7 +904,7 @@ function photos_content(App $a) return; } - $sql_extra = Security::getPermissionsSQLByUserId($owner_uid, $remote_contact); + $sql_extra = Security::getPermissionsSQLByUserId($owner_uid); $o = ""; diff --git a/src/Content/Widget.php b/src/Content/Widget.php index 9097442796..09a5fc6345 100644 --- a/src/Content/Widget.php +++ b/src/Content/Widget.php @@ -11,6 +11,7 @@ use Friendica\Core\PConfig; use Friendica\Core\Protocol; use Friendica\Core\Renderer; use Friendica\Core\System; +use Friendica\Core\Session; use Friendica\Database\DBA; use Friendica\Model\Contact; use Friendica\Model\FileTag; @@ -339,7 +340,7 @@ class Widget $zcid = 0; - $cid = remote_user($profile_uid); + $cid = Session::getRemoteContactID($profile_uid); if (!$cid) { if (Profile::getMyURL()) { diff --git a/src/Core/Session.php b/src/Core/Session.php index 55d8e550de..db455d3a25 100644 --- a/src/Core/Session.php +++ b/src/Core/Session.php @@ -212,7 +212,7 @@ class Session * @param integer $uid User ID * @return integer Contact ID of visitor for given user ID */ - public static function getVisitorContactIDForUserID($uid) + public static function getRemoteContactID($uid) { if (empty($_SESSION['remote'][$uid])) { return false; diff --git a/src/Model/Item.php b/src/Model/Item.php index b5245acb56..8e138c0cb3 100644 --- a/src/Model/Item.php +++ b/src/Model/Item.php @@ -18,6 +18,7 @@ use Friendica\Core\PConfig; use Friendica\Core\Protocol; use Friendica\Core\Renderer; use Friendica\Core\System; +use Friendica\Core\Session; use Friendica\Core\Worker; use Friendica\Database\DBA; use Friendica\Protocol\ActivityPub; @@ -3263,7 +3264,7 @@ class Item extends BaseObject public static function getPermissionsSQLByUserId($owner_id) { $local_user = local_user(); - $remote_user = remote_user($owner_id); + $remote_user = Session::getRemoteContactID($owner_id); /* * Construct permissions diff --git a/src/Util/Security.php b/src/Util/Security.php index aa6209f324..1d7162ab8e 100644 --- a/src/Util/Security.php +++ b/src/Util/Security.php @@ -10,6 +10,7 @@ use Friendica\Database\DBA; use Friendica\Model\Contact; use Friendica\Model\Group; use Friendica\Model\User; +use Friendica\Core\Session; /** * Secures that User is allow to do requests @@ -33,7 +34,7 @@ class Security extends BaseObject return true; } - if (remote_user($owner)) { + if (!empty(Session::getRemoteContactID($owner))) { // use remembered decision and avoid a DB lookup for each and every display item // DO NOT use this function if there are going to be multiple owners // We have a contact-id for an authenticated remote user, this block determines if the contact @@ -44,7 +45,7 @@ class Security extends BaseObject } elseif ($verified === 1) { return false; } else { - $cid = remote_user($owner); + $cid = Session::getRemoteContactID($owner); if (!$cid) { return false; } @@ -71,11 +72,10 @@ class Security extends BaseObject return false; } - /// @TODO $groups should be array - public static function getPermissionsSQLByUserId($owner_id, $remote_verified = false, $groups = null) + public static function getPermissionsSQLByUserId($owner_id) { $local_user = local_user(); - $remote_user = remote_user($owner_id); + $remote_contact = Session::getRemoteContactID($owner_id); /* * Construct permissions @@ -93,48 +93,27 @@ class Security extends BaseObject if ($local_user && $local_user == $owner_id) { $sql = ''; /* - * Authenticated visitor. Unless pre-verified, - * check that the contact belongs to this $owner_id - * and load the groups the visitor belongs to. - * If pre-verified, the caller is expected to have already - * done this and passed the groups into this function. + * Authenticated visitor. Load the groups the visitor belongs to. */ - } elseif ($remote_user) { - $cid = \Friendica\Core\Session::getVisitorContactIDForUserID($owner_id); + } elseif ($remote_contact) { + $gs = '<<>>'; // should be impossible to match - /* - * Authenticated visitor. Unless pre-verified, - * check that the contact belongs to this $owner_id - * and load the groups the visitor belongs to. - * If pre-verified, the caller is expected to have already - * done this and passed the groups into this function. - */ + $groups = Group::getIdsByContactId($remote_contact); - if (!$remote_verified) { - if ($cid && DBA::exists('contact', ['id' => $cid, 'uid' => $owner_id, 'blocked' => false])) { - $remote_verified = true; - $groups = Group::getIdsByContactId($cid); + if (is_array($groups)) { + foreach ($groups as $g) { + $gs .= '|<' . intval($g) . '>'; } } - if ($remote_verified) { - $gs = '<<>>'; // should be impossible to match - - if (is_array($groups)) { - foreach ($groups as $g) { - $gs .= '|<' . intval($g) . '>'; - } - } - - $sql = sprintf( - " AND (NOT (deny_cid REGEXP '<%d>' OR deny_gid REGEXP '%s') - AND (allow_cid REGEXP '<%d>' OR allow_gid REGEXP '%s' OR (allow_cid = '' AND allow_gid = ''))) ", - intval($cid), - DBA::escape($gs), - intval($cid), - DBA::escape($gs) - ); - } + $sql = sprintf( + " AND (NOT (deny_cid REGEXP '<%d>' OR deny_gid REGEXP '%s') + AND (allow_cid REGEXP '<%d>' OR allow_gid REGEXP '%s' OR (allow_cid = '' AND allow_gid = ''))) ", + intval($remote_contact), + DBA::escape($gs), + intval($remote_contact), + DBA::escape($gs) + ); } return $sql; }