Commit 6098f0a1 authored by Zot's avatar Zot

add owner permission checks to AS item fetch

parent 193fe740
......@@ -875,10 +875,46 @@ function pubcrawl_item_mod_init($x) {
$sql_extra = item_permissions_sql(0);
$r = q("select * from item where (uuid = '%s' or mid like '%s') $item_normal $sql_extra limit 1",
dbesc($item_id),
dbesc($item_id . '%')
$r = null;
// first see if we have this item owned by the current signer
$x = q("select * from xchan where xchan_hash = '%s'",
dbesc($sigdata['portable_id'])
);
if ($x) {
// include xchans for all zot-like networks - these will have the same guid and public key
$xchans = q("select xchan_hash from xchan where xchan_hash = '%s' OR ( xchan_guid = '%s' AND xchan_pubkey = '%s' ) ",
dbesc($sigdata['portable_id']),
dbesc($x[0]['xchan_guid']),
dbesc($x[0]['xchan_pubkey'])
);
if ($xchans) {
$hashes = ids_to_querystr($xchans,'xchan_hash',true);
$r = q("select * from item where ( uuid = '%s' or mid like '%s') $item_normal and owner_xchan in ( " . protect_sprintf($hashes) . " ) ",
dbesc($item_id),
dbesc($item_id . '%')
);
}
}
// then see if we can access it as a visitor
if (! $r) {
$r = q("select * from item where (uuid = '%s' or mid like '%s') $item_normal $sql_extra limit 1",
dbesc($item_id),
dbesc($item_id . '%')
);
}
// fetch once more with no extra conditions to see what error condition applies
if(! $r) {
$r = q("select * from item where (uuid = '%s' or mid like '%s') $item_normal limit 1",
dbesc($item_id),
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment