keith/friendica
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Don't try to auth for public images

Browse source
This commit is contained in:
Dean Townsley 2019-06-24 19:45:50 -05:00
parent 26accbe3ef
commit 59553ab978
1 changed files with 8 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
src/Model/Photo.php
View file

@ -130,18 +130,21 @@ class Photo extends BaseObject
*/ */
public static function getPhoto($resourceid, $scale = 0) public static function getPhoto($resourceid, $scale = 0)
{ {
$r = self::selectFirst(["uid"], ["resource-id" => $resourceid]); $r = self::selectFirst(["uid","allow_cid","allow_gid","deny_cid","deny_gid"], ["resource-id" => $resourceid]);
if ($r === false) { if ($r === false) {
return false; return false;
} }
$uid = $r["uid"]; $uid = $r["uid"];
// This is the first place, when retrieving just a photo, that we know who owns the photo. // This is the first place, when retrieving just a photo, that we know who owns the photo.
// Make sure that the requester's session is appropriately authenticated to that user // Check if the photo is public (empty allow and deny means public), if so, skip auth attempt, if not
// make sure that the requester's session is appropriately authenticated to that user
// otherwise permissions checks done by getPermissionsSQLByUserId() won't work correctly // otherwise permissions checks done by getPermissionsSQLByUserId() won't work correctly
$r = DBA::selectFirst("user", ["nickname"], ["uid" => $uid], []); if (!empty($r["allow_cid"]) || !empty($r["allow_gid"]) || !empty($r["deny_cid"]) || !empty($r["deny_gid"])) {
// this will either just return (if auth all ok) or will redirect and exit (starting over) $r = DBA::selectFirst("user", ["nickname"], ["uid" => $uid], []);
DFRN::autoRedir(self::getApp(), $r["nickname"]); // this will either just return (if auth all ok) or will redirect and exit (starting over)
DFRN::autoRedir(self::getApp(), $r["nickname"]);
}
$sql_acl = Security::getPermissionsSQLByUserId($uid); $sql_acl = Security::getPermissionsSQLByUserId($uid);