Commit 73663766 authored by Chris Graham's avatar Chris Graham
Browse files

Fixed MANTIS-4822 (Gallery narrow-in functionality should check privileges)

parent 1f089f1c

sources/blocks/main_gallery_embed.php

+21 −1
Original line number Diff line number Diff line
@@ -49,7 +49,7 @@ class Block_main_gallery_embed 
    public function caching_environment()

    {

        $info = array();

        $info['cache_on'] = '(preg_match(\'#<\w+>#\',(array_key_exists(\'filter\',$map)?$map[\'filter\']:\'\').(array_key_exists(\'video_filter\',$map)?$map[\'video_filter\']:\'\'))!=0)?null:array(array_key_exists(\'as_guest\',$map)?($map[\'as_guest\']==\'1\'):false,array_key_exists(\'guid\',$map)?$map[\'guid\']:\'\',get_param_integer($block_id.\'_max\',array_key_exists(\'max\',$map)?intval($map[\'max\']):null),get_param_integer($block_id.\'_start\',array_key_exists(\'start\',$map)?intval($map[\'start\']):0),((array_key_exists(\'pagination\',$map)?$map[\'pagination\']:\'0\')==\'1\'),((array_key_exists(\'root\',$map)) && ($map[\'root\']!=\'\'))?$map[\'root\']:get_param_string(\'keep_gallery_root\',null),array_key_exists(\'filter\',$map)?$map[\'filter\']:\'\',array_key_exists(\'video_filter\',$map)?$map[\'video_filter\']:\'\',array_key_exists(\'render_if_empty\',$map)?$map[\'render_if_empty\']:\'0\',array_key_exists(\'days\',$map)?$map[\'days\']:\'\',array_key_exists(\'sort\',$map)?$map[\'sort\']:\'add_date DESC\',get_param_integer(\'mge_start\',0),array_key_exists(\'param\',$map)?$map[\'param\']:db_get_first_id(),array_key_exists(\'zone\',$map)?$map[\'zone\']:\'\',((is_null($map)) || (!array_key_exists(\'select\',$map)))?\'*\':$map[\'select\'],((is_null($map)) || (!array_key_exists(\'video_select\',$map)))?\'*\':$map[\'video_select\'],array_key_exists(\'title\',$map)?$map[\'title\']:\'\')';

        $info['cache_on'] = '(((isset($map[\'param\'])) && (strpos($map[\'param\'], \'*\') !== false || strpos($map[\'param\'], \'>\') !== false)) || (preg_match(\'#<\w+>#\',(array_key_exists(\'filter\',$map)?$map[\'filter\']:\'\').(array_key_exists(\'video_filter\',$map)?$map[\'video_filter\']:\'\'))!=0)) ? null : array(array_key_exists(\'as_guest\',$map)?($map[\'as_guest\']==\'1\'):false,array_key_exists(\'guid\',$map)?$map[\'guid\']:\'\',get_param_integer($block_id.\'_max\',array_key_exists(\'max\',$map)?intval($map[\'max\']):null),get_param_integer($block_id.\'_start\',array_key_exists(\'start\',$map)?intval($map[\'start\']):0),((array_key_exists(\'pagination\',$map)?$map[\'pagination\']:\'0\')==\'1\'),((array_key_exists(\'root\',$map)) && ($map[\'root\']!=\'\'))?$map[\'root\']:get_param_string(\'keep_gallery_root\',null),array_key_exists(\'filter\',$map)?$map[\'filter\']:\'\',array_key_exists(\'video_filter\',$map)?$map[\'video_filter\']:\'\',array_key_exists(\'render_if_empty\',$map)?$map[\'render_if_empty\']:\'0\',array_key_exists(\'days\',$map)?$map[\'days\']:\'\',array_key_exists(\'sort\',$map)?$map[\'sort\']:\'add_date DESC\',get_param_integer(\'mge_start\',0),array_key_exists(\'param\',$map)?$map[\'param\']:db_get_first_id(),array_key_exists(\'zone\',$map)?$map[\'zone\']:\'\',((is_null($map)) || (!array_key_exists(\'select\',$map)))?\'*\':$map[\'select\'],((is_null($map)) || (!array_key_exists(\'video_select\',$map)))?\'*\':$map[\'video_select\'],array_key_exists(\'title\',$map)?$map[\'title\']:\'\')';

        $info['special_cache_flags'] = CACHE_AGAINST_DEFAULT | CACHE_AGAINST_PERMISSIVE_GROUPS;

        if (addon_installed('content_privacy')) {

            $info['special_cache_flags'] |= CACHE_AGAINST_MEMBER;
@@ -170,6 +170,26 @@ class Block_main_gallery_embed 
            $extra_where_video .= $privacy_where_video;

        }



        if ((strpos($cat, '*') !== false || strpos($cat, '>') !== false) && (db_has_subqueries($GLOBALS['SITE_DB']->connection_read)) && (!$GLOBALS['FORUM_DRIVER']->is_super_admin(get_member()))) {

            // Check gallery permissions for "narrow in" functionality...



            $_groups = $GLOBALS['FORUM_DRIVER']->get_members_groups(get_member(), false, true);

            $groups = '';

            foreach ($_groups as $group) {

                if ($groups != '') {

                    $groups .= ' OR ';

                }

                $groups .= 'a.group_id=' . strval($group);

            }



            $permissions_where = 'AND (';

            $permissions_where .= 'EXISTS (SELECT * FROM ' . get_table_prefix() . 'group_category_access a WHERE ' . db_string_equal_to('a.module_the_name', 'galleries') . ' AND r.cat=a.category_name AND (' . $groups . '))';

            $permissions_where .= ' OR EXISTS (SELECT * FROM ' . get_table_prefix() . 'member_category_access ma WHERE ' . db_string_equal_to('ma.module_the_name', 'galleries') . ' AND r.cat=ma.category_name AND ((ma.active_until IS NULL OR ma.active_until>' . strval(time()) . ') AND ma.member_id=' . strval(get_member()) . '))';

            $permissions_where .= ')';

            $extra_where_image .= $permissions_where;

            $extra_where_video .= $permissions_where;

        }



        if (get_option('filter_regions') == '1') {

            require_code('locations');

            $extra_where_image .= sql_region_filter('image', 'r.id');