Standardize the security SQL used to get entries for editing and
viewing.
Patch by fu.
diffs (39 lines):
diff -r f887f0643b6c -r 04ba85a71e7c cgi-bin/ljprotocol.pl
--- a/cgi-bin/ljprotocol.pl Sun May 02 06:47:33 2010 +0000
+++ b/cgi-bin/ljprotocol.pl Sun May 02 06:54:19 2010 +0000
@@ -2215,10 +2215,34 @@ sub getevents
return fail($err,200,"Invalid selecttype.");
}
+ my $mask = 0;
+ if ( $u && ( $u->is_person || $u->is_identity ) && $posterid != $ownerid )
{
+ # if this is a community we're viewing, fake the mask to select on, as
communities
+ # no longer have masks to users
+ if ( $uowner->is_community ) {
+ $mask = $u->member_of( $uowner ) ? 1 : 0;
+ } else {
+ $mask = $uowner->trustmask( $u );
+ }
+ }
+
+ # check security!
+ my $secwhere;
+ if ( $u && $u->can_manage( $uowner ) ) {
+ # journal owners and community admins can see everything
+ $secwhere = "";
+ } elsif ( $mask ) {
+ # can see public or things with them in the mask
+ $secwhere = "AND (security='public' OR (security='usemask' AND
allowmask & $mask != 0))";
+ } else {
+ # not on access list or a member; only see public.
+ $secwhere = "AND security='public'";
+ }
+
# common SQL template:
unless ($sql) {
$sql = "SELECT jitemid, eventtime, security, allowmask, anum, posterid
".
- "FROM log2 WHERE journalid=$ownerid $where $orderby $limit";
+ "FROM log2 WHERE journalid=$ownerid $where $secwhere $orderby
$limit";
}
# whatever selecttype might have wanted us to use the master db.
_______________________________________________
dw-changelog mailing list
[email protected]
http://lists.dwscoalition.org/mailman/listinfo/dw-changelog
