Added new function `canViewObject` to `ICommentManager` to check access to any object...

diff --git a/wcfsetup/install/files/lib/system/comment/manager/AbstractCommentManager.class.php b/wcfsetup/install/files/lib/system/comment/manager/AbstractCommentManager.class.php
index b2fb5fd5799c14977be33567112690d4d80458df..3170f23ac418332ca568b22e8cc77959d53f321c 100644 (file)
--- a/wcfsetup/install/files/lib/system/comment/manager/AbstractCommentManager.class.php
+++ b/wcfsetup/install/files/lib/system/comment/manager/AbstractCommentManager.class.php
@@ -164,6 +164,9 @@ abstract class AbstractCommentManager extends SingletonFactory implements IComme
     #[\Override]
     public function canModerateObject(int $objectTypeID, int $objectID, UserProfile $user): bool
     {
+        if (!$this->canViewObject($objectID, $user)) {
+            return false;
+        }
         return (bool)$user->getPermission($this->permissionCanModerate);
     }
 

diff --git a/wcfsetup/install/files/lib/system/comment/manager/ArticleCommentManager.class.php b/wcfsetup/install/files/lib/system/comment/manager/ArticleCommentManager.class.php
index 768c027182f151fd406eed7cf208fe31594ac572..5f6b6d1d840fd4d391db3bbcca88722a0c6e9460 100644 (file)
--- a/wcfsetup/install/files/lib/system/comment/manager/ArticleCommentManager.class.php
+++ b/wcfsetup/install/files/lib/system/comment/manager/ArticleCommentManager.class.php
@@ -6,6 +6,7 @@ use wcf\data\article\content\ArticleContent;
 use wcf\data\article\content\ArticleContentEditor;
 use wcf\data\article\content\ArticleContentList;
 use wcf\data\object\type\ObjectTypeCache;
+use wcf\data\user\UserProfile;
 use wcf\system\cache\runtime\UserProfileRuntimeCache;
 use wcf\system\cache\runtime\ViewableArticleContentRuntimeCache;
 use wcf\system\cache\runtime\ViewableCommentResponseRuntimeCache;
@@ -71,6 +72,16 @@ class ArticleCommentManager extends AbstractCommentManager implements IViewableL
         return true;
     }
 
+    #[\Override]
+    public function canViewObject(int $objectID, UserProfile $user): bool
+    {
+        $articleContent = new ArticleContent($objectID);
+        if (!$articleContent->articleContentID) {
+            return false;
+        }
+        return $articleContent->getArticle()->canRead($user);
+    }
+
     /**
      * @inheritDoc
      */

diff --git a/wcfsetup/install/files/lib/system/comment/manager/ICommentManager.class.php b/wcfsetup/install/files/lib/system/comment/manager/ICommentManager.class.php
index 5500208cd31bd7770cd23c9378448815a46b1547..12f6dc8939d3af6fb47b556ac5a20c7b15c60edc 100644 (file)
--- a/wcfsetup/install/files/lib/system/comment/manager/ICommentManager.class.php
+++ b/wcfsetup/install/files/lib/system/comment/manager/ICommentManager.class.php
@@ -69,7 +69,7 @@ interface ICommentManager
      * @param int $objectTypeID
      * @param int $objectID
      * @return  bool
-     * @deprecated 6.1
+     * @deprecated 6.1 use `canModerateObject` instead
      */
     public function canModerate($objectTypeID, $objectID);
 
@@ -131,6 +131,11 @@ interface ICommentManager
      */
     public function isAccessible($objectID, $validateWritePermission = false);
 
+    /**
+     * Returns true if the user may read content identified by object type id and object id.
+     */
+    public function canViewObject(int $objectID, UserProfile $user): bool;
+
     /**
      * Updates total count of comments (includes responses).
      *

diff --git a/wcfsetup/install/files/lib/system/comment/manager/ModerationQueueCommentManager.class.php b/wcfsetup/install/files/lib/system/comment/manager/ModerationQueueCommentManager.class.php
index f86c6ae7b355d8a276a2c2d10dea557dcb2b0fb2..e13b625dd469ea1c3ced0044c8d7d88270c37cd2 100644 (file)
--- a/wcfsetup/install/files/lib/system/comment/manager/ModerationQueueCommentManager.class.php
+++ b/wcfsetup/install/files/lib/system/comment/manager/ModerationQueueCommentManager.class.php
@@ -5,6 +5,7 @@ namespace wcf\system\comment\manager;
 use wcf\data\moderation\queue\ModerationQueue;
 use wcf\data\moderation\queue\ModerationQueueEditor;
 use wcf\data\moderation\queue\ViewableModerationQueue;
+use wcf\data\user\UserProfile;
 
 /**
  * Moderation queue comment manager implementation.
@@ -25,6 +26,14 @@ class ModerationQueueCommentManager extends AbstractCommentManager
         return $entry->canEdit();
     }
 
+    #[\Override]
+    public function canViewObject(int $objectID, UserProfile $user): bool
+    {
+        $entry = new ModerationQueue($objectID);
+
+        return $entry->canEdit($user->getDecoratedObject());
+    }
+
     /**
      * @inheritDoc
      */

diff --git a/wcfsetup/install/files/lib/system/comment/manager/PageCommentManager.class.php b/wcfsetup/install/files/lib/system/comment/manager/PageCommentManager.class.php
index 317d6f0ecdaa0ad6069525f8039e0758a52b4ffe..1537fcc87d0dad469dc00849790848fb3e405ad1 100644 (file)
--- a/wcfsetup/install/files/lib/system/comment/manager/PageCommentManager.class.php
+++ b/wcfsetup/install/files/lib/system/comment/manager/PageCommentManager.class.php
@@ -5,6 +5,7 @@ namespace wcf\system\comment\manager;
 use wcf\data\object\type\ObjectTypeCache;
 use wcf\data\page\Page;
 use wcf\data\page\PageList;
+use wcf\data\user\UserProfile;
 use wcf\system\cache\runtime\UserProfileRuntimeCache;
 use wcf\system\cache\runtime\ViewableCommentResponseRuntimeCache;
 use wcf\system\cache\runtime\ViewableCommentRuntimeCache;
@@ -70,6 +71,23 @@ class PageCommentManager extends AbstractCommentManager implements IViewableLike
         return true;
     }
 
+    #[\Override]
+    public function canViewObject(int $objectID, UserProfile $user): bool
+    {
+        $page = new Page($objectID);
+        if (!$page->pageID) {
+            return false;
+        }
+        return $page->isAccessible($user->getDecoratedObject());
+    }
+
+    #[\Override]
+    public function canWriteComments(int $objectID, UserProfile $user): bool
+    {
+        return $this->canViewObject($objectID, $user);
+    }
+
+
     /**
      * @inheritDoc
      */

diff --git a/wcfsetup/install/files/lib/system/comment/manager/UserProfileCommentManager.class.php b/wcfsetup/install/files/lib/system/comment/manager/UserProfileCommentManager.class.php
index 6525f1d68ca4e6615433a2d7cbc978dfe5de995c..e0f852c40ddf8eb3fa101386565fa2998d1bb8f7 100644 (file)
--- a/wcfsetup/install/files/lib/system/comment/manager/UserProfileCommentManager.class.php
+++ b/wcfsetup/install/files/lib/system/comment/manager/UserProfileCommentManager.class.php
@@ -6,6 +6,7 @@ use wcf\data\comment\Comment;
 use wcf\data\comment\response\CommentResponse;
 use wcf\data\object\type\ObjectTypeCache;
 use wcf\data\user\ignore\UserIgnore;
+use wcf\data\user\UserProfile;
 use wcf\system\cache\runtime\UserProfileRuntimeCache;
 use wcf\system\cache\runtime\UserRuntimeCache;
 use wcf\system\cache\runtime\ViewableCommentResponseRuntimeCache;
@@ -90,6 +91,20 @@ class UserProfileCommentManager extends AbstractCommentManager implements IViewa
         return true;
     }
 
+    #[\Override]
+    public function canViewObject(int $objectID, UserProfile $user): bool
+    {
+        $userProfile = UserProfileRuntimeCache::getInstance()->getObject($objectID);
+        if ($userProfile === null) {
+            return false;
+        }
+
+        /** @see UserProfile::isProtected() */
+        return !$user->getPermission('admin.general.canViewPrivateUserOptions')
+            && !$userProfile->isAccessible('canViewProfile', $user->userID)
+            && $userProfile->userID != $user->userID;
+    }
+
     /**
      * @inheritDoc
      */