Renamed function, beginning to replace the "remote_user" function

boot.php

@@ -416,19 +416,12 @@ function public_contact()
  */
 function remote_user($uid = null)
 {
-	// You cannot be both local and remote.
-	// Unncommented by rabuzarus because remote authentication to local
-	// profiles wasn't possible anymore (2018-04-12).
-//	if (local_user()) {
-//		return false;
-//	}
-
 	if (empty($_SESSION['authenticated'])) {
 		return false;
 	}
 
 	if (!is_null($uid)) {
-		return Session::getVisitorContactIDForUserID($uid);
+		return Session::getRemoteContactID($uid);
 	} elseif (is_null($uid) && !empty($_SESSION['visitor_id'])) {
 		return intval($_SESSION['visitor_id']);
 	}

include/items.php

@@ -13,6 +13,7 @@ use Friendica\Core\PConfig;
 use Friendica\Core\Protocol;
 use Friendica\Core\Renderer;
 use Friendica\Core\System;
+use Friendica\Core\Session;
 use Friendica\Database\DBA;
 use Friendica\Model\Item;
 use Friendica\Protocol\DFRN;
@@ -362,7 +363,7 @@ function drop_item($id, $return = '')
 	$contact_id = 0;
 
 	// check if logged in user is either the author or owner of this item
-	if (remote_user($item['uid']) == $item['contact-id']) {
+	if (Session::getRemoteContactID($item['uid']) == $item['contact-id']) {
 		$contact_id = $item['contact-id'];
 	}
 

mod/photos.php

@@ -904,7 +904,7 @@ function photos_content(App $a)
 		return;
 	}
 
-	$sql_extra = Security::getPermissionsSQLByUserId($owner_uid, $remote_contact);
+	$sql_extra = Security::getPermissionsSQLByUserId($owner_uid);
 
 	$o = "";
 

src/Content/Widget.php

@@ -11,6 +11,7 @@ use Friendica\Core\PConfig;
 use Friendica\Core\Protocol;
 use Friendica\Core\Renderer;
 use Friendica\Core\System;
+use Friendica\Core\Session;
 use Friendica\Database\DBA;
 use Friendica\Model\Contact;
 use Friendica\Model\FileTag;
@@ -339,7 +340,7 @@ class Widget
 
 		$zcid = 0;
 
-		$cid = remote_user($profile_uid);
+		$cid = Session::getRemoteContactID($profile_uid);
 
 		if (!$cid) {
 			if (Profile::getMyURL()) {

src/Core/Session.php

@@ -212,7 +212,7 @@ class Session
 	 * @param integer $uid User ID
 	 * @return integer Contact ID of visitor for given user ID
 	 */
-	public static function getVisitorContactIDForUserID($uid)
+	public static function getRemoteContactID($uid)
 	{
 		if (empty($_SESSION['remote'][$uid])) {
 			return false;

src/Model/Item.php

@@ -18,6 +18,7 @@ use Friendica\Core\PConfig;
 use Friendica\Core\Protocol;
 use Friendica\Core\Renderer;
 use Friendica\Core\System;
+use Friendica\Core\Session;
 use Friendica\Core\Worker;
 use Friendica\Database\DBA;
 use Friendica\Protocol\ActivityPub;
@@ -3263,7 +3264,7 @@ class Item extends BaseObject
 	public static function getPermissionsSQLByUserId($owner_id)
 	{
 		$local_user = local_user();
-		$remote_user = remote_user($owner_id);
+		$remote_user = Session::getRemoteContactID($owner_id);
 
 		/*
 		 * Construct permissions

src/Util/Security.php

@@ -10,6 +10,7 @@ use Friendica\Database\DBA;
 use Friendica\Model\Contact;
 use Friendica\Model\Group;
 use Friendica\Model\User;
+use Friendica\Core\Session;
 
 /**
  * Secures that User is allow to do requests
@@ -33,7 +34,7 @@ class Security extends BaseObject
 			return true;
 		}
 
-		if (remote_user($owner)) {
+		if (!empty(Session::getRemoteContactID($owner))) {
 			// use remembered decision and avoid a DB lookup for each and every display item
 			// DO NOT use this function if there are going to be multiple owners
 			// We have a contact-id for an authenticated remote user, this block determines if the contact
@@ -44,7 +45,7 @@ class Security extends BaseObject
 			} elseif ($verified === 1) {
 				return false;
 			} else {
-				$cid = remote_user($owner);
+				$cid = Session::getRemoteContactID($owner);
 				if (!$cid) {
 					return false;
 				}
@@ -71,11 +72,10 @@ class Security extends BaseObject
 		return false;
 	}
 
-	/// @TODO $groups should be array
+	public static function getPermissionsSQLByUserId($owner_id)
-	public static function getPermissionsSQLByUserId($owner_id, $remote_verified = false, $groups = null)
 	{
 		$local_user = local_user();
-		$remote_user = remote_user($owner_id);
+		$remote_contact = Session::getRemoteContactID($owner_id);
 
 		/*
 		 * Construct permissions
@@ -93,48 +93,27 @@ class Security extends BaseObject
 		if ($local_user && $local_user == $owner_id) {
 			$sql = '';
 		/*
-		 * Authenticated visitor. Unless pre-verified,
+		 * Authenticated visitor. Load the groups the visitor belongs to.
-		 * check that the contact belongs to this $owner_id
-		 * and load the groups the visitor belongs to.
-		 * If pre-verified, the caller is expected to have already
-		 * done this and passed the groups into this function.
 		 */
-		} elseif ($remote_user) {
+		} elseif ($remote_contact) {
-			$cid = \Friendica\Core\Session::getVisitorContactIDForUserID($owner_id);
+			$gs = '<<>>'; // should be impossible to match
 
-			/*
+			$groups = Group::getIdsByContactId($remote_contact);
-			 * Authenticated visitor. Unless pre-verified,
-			 * check that the contact belongs to this $owner_id
-			 * and load the groups the visitor belongs to.
-			 * If pre-verified, the caller is expected to have already
-			 * done this and passed the groups into this function.
-			 */
 
-			if (!$remote_verified) {
+			if (is_array($groups)) {
-				if ($cid && DBA::exists('contact', ['id' => $cid, 'uid' => $owner_id, 'blocked' => false])) {
+				foreach ($groups as $g) {
-					$remote_verified = true;
+					$gs .= '|<' . intval($g) . '>';
-					$groups = Group::getIdsByContactId($cid);
 				}
 			}
 
-			if ($remote_verified) {
+			$sql = sprintf(
-				$gs = '<<>>'; // should be impossible to match
+				" AND (NOT (deny_cid REGEXP '<%d>' OR deny_gid REGEXP '%s')
-
+				  AND (allow_cid REGEXP '<%d>' OR allow_gid REGEXP '%s' OR (allow_cid = '' AND allow_gid = ''))) ",
-				if (is_array($groups)) {
+				intval($remote_contact),
-					foreach ($groups as $g) {
+				DBA::escape($gs),
-						$gs .= '|<' . intval($g) . '>';
+				intval($remote_contact),
-					}
+				DBA::escape($gs)
-				}
+			);
-
-				$sql = sprintf(
-					" AND (NOT (deny_cid REGEXP '<%d>' OR deny_gid REGEXP '%s')
-					  AND (allow_cid REGEXP '<%d>' OR allow_gid REGEXP '%s' OR (allow_cid = '' AND allow_gid = ''))) ",
-					intval($cid),
-					DBA::escape($gs),
-					intval($cid),
-					DBA::escape($gs)
-				);
-			}
 		}
 		return $sql;
 	}