From f990a9ccc508176383794e92371cf8d7f3b8df54 Mon Sep 17 00:00:00 2001
From: Matthias Schmidt <gravatronics@live.com>
Date: Thu, 11 Jun 2020 15:44:32 +0200
Subject: [PATCH] Add permission to restrict hiding online status (#3363)

Close #3248
---
 com.woltlab.wcf/userGroupOption.xml           |  6 ++
 com.woltlab.wcf/userOption.xml                |  1 +
 .../files/lib/data/user/UserProfile.class.php |  5 +-
 .../lib/data/user/online/UserOnline.class.php |  5 +-
 .../user/online/UsersOnlineList.class.php     | 75 ++++++++++++++++---
 .../box/WhoWasOnlineBoxController.class.php   |  2 +-
 wcfsetup/install/lang/de.xml                  |  1 +
 wcfsetup/install/lang/en.xml                  |  1 +
 8 files changed, 84 insertions(+), 12 deletions(-)

diff --git a/com.woltlab.wcf/userGroupOption.xml b/com.woltlab.wcf/userGroupOption.xml
index 9fd4679bf1..81f26c995c 100644
--- a/com.woltlab.wcf/userGroupOption.xml
+++ b/com.woltlab.wcf/userGroupOption.xml
@@ -743,6 +743,12 @@ pdf</defaultvalue>
 				<defaultvalue>1</defaultvalue>
 				<usersonly>1</usersonly>
 			</option>
+			<option name="user.profile.canHideOnlineStatus">
+				<categoryname>user.profile</categoryname>
+				<optiontype>boolean</optiontype>
+				<defaultvalue>1</defaultvalue>
+				<usersonly>1</usersonly>
+			</option>
 			<option name="user.profile.avatar.canSeeAvatars">
 				<categoryname>user.profile.avatar</categoryname>
 				<optiontype>boolean</optiontype>
diff --git a/com.woltlab.wcf/userOption.xml b/com.woltlab.wcf/userOption.xml
index 769aade42c..e8503fc1e7 100644
--- a/com.woltlab.wcf/userOption.xml
+++ b/com.woltlab.wcf/userOption.xml
@@ -183,6 +183,7 @@
 2:wcf.user.access.following
 3:wcf.user.access.nobody</selectoptions>
 				<editable>3</editable>
+				<permissions>user.profile.canHideOnlineStatus</permissions>
 			</option>
 			<option name="canViewProfile">
 				<categoryname>settings.privacy.content</categoryname>
diff --git a/wcfsetup/install/files/lib/data/user/UserProfile.class.php b/wcfsetup/install/files/lib/data/user/UserProfile.class.php
index 4ec1b523d9..88240858bb 100644
--- a/wcfsetup/install/files/lib/data/user/UserProfile.class.php
+++ b/wcfsetup/install/files/lib/data/user/UserProfile.class.php
@@ -406,7 +406,10 @@ class UserProfile extends DatabaseObjectDecorator implements ITitledLinkObject {
 	 * @return	boolean
 	 */
 	public function canViewOnlineStatus() {
-		return (WCF::getUser()->userID == $this->userID || WCF::getSession()->getPermission('admin.user.canViewInvisible') || $this->isAccessible('canViewOnlineStatus'));
+		return WCF::getUser()->userID == $this->userID
+			|| WCF::getSession()->getPermission('admin.user.canViewInvisible')
+			|| !$this->getPermission('user.profile.canHideOnlineStatus')
+			|| $this->isAccessible('canViewOnlineStatus');
 	}
 	
 	/**
diff --git a/wcfsetup/install/files/lib/data/user/online/UserOnline.class.php b/wcfsetup/install/files/lib/data/user/online/UserOnline.class.php
index 154127a437..6cdcad3610 100644
--- a/wcfsetup/install/files/lib/data/user/online/UserOnline.class.php
+++ b/wcfsetup/install/files/lib/data/user/online/UserOnline.class.php
@@ -48,7 +48,10 @@ class UserOnline extends UserProfile {
 			$username = str_replace('%s', $username, $this->userOnlineMarking);
 		}
 		
-		if ($this->canViewOnlineStatus == 3) {
+		if (
+			$this->getPermission('user.profile.canHideOnlineStatus')
+			&& $this->canViewOnlineStatus == UserProfile::ACCESS_NOBODY
+		) {
 			$username .= WCF::getLanguage()->get('wcf.user.usersOnline.invisible');
 		}
 		
diff --git a/wcfsetup/install/files/lib/data/user/online/UsersOnlineList.class.php b/wcfsetup/install/files/lib/data/user/online/UsersOnlineList.class.php
index 1069985dd7..af400413a8 100644
--- a/wcfsetup/install/files/lib/data/user/online/UsersOnlineList.class.php
+++ b/wcfsetup/install/files/lib/data/user/online/UsersOnlineList.class.php
@@ -4,7 +4,9 @@ use wcf\data\option\OptionAction;
 use wcf\data\session\SessionList;
 use wcf\data\user\group\UserGroup;
 use wcf\data\user\User;
+use wcf\data\user\UserProfile;
 use wcf\system\event\EventHandler;
+use wcf\system\user\storage\UserStorageHandler;
 use wcf\system\WCF;
 use wcf\util\StringUtil;
 
@@ -70,9 +72,11 @@ class UsersOnlineList extends SessionList {
 		$objects = $this->objects;
 		$this->indexToObject = $this->objects = [];
 		
+		UserStorageHandler::getInstance()->loadStorage($this->objectIDs);
+		
 		foreach ($objects as $object) {
 			$object = new UserOnline(new User(null, null, $object));
-			if (!$object->userID || self::isVisible($object->userID, $object->canViewOnlineStatus)) {
+			if (!$object->userID || self::isVisibleUser($object)) {
 				$this->objects[$object->sessionID] = $object;
 				$this->indexToObject[] = $object->sessionID;
 			}
@@ -96,11 +100,13 @@ class UsersOnlineList extends SessionList {
 		$statement = WCF::getDB()->prepareStatement($sql);
 		$statement->execute($conditionBuilder->getParameters());
 		while ($row = $statement->fetchArray()) {
+			$user = new UserOnline(new User(null, $row));
+			
 			$this->stats['total']++;
-			if ($row['userID']) {
+			if ($user->userID) {
 				$this->stats['members']++;
 				
-				if ($row['canViewOnlineStatus'] && !self::isVisible($row['userID'], $row['canViewOnlineStatus'])) {
+				if ($user->canViewOnlineStatus && !self::isVisibleUser($user)) {
 					$this->stats['invisible']++;
 				}
 			}
@@ -155,20 +161,29 @@ class UsersOnlineList extends SessionList {
 	 * @param	integer		$userID
 	 * @param	integer		$canViewOnlineStatus
 	 * @return	boolean
+	 * @deprecated  5.3             Use `isVisibleUser` instead
 	 */
 	public static function isVisible($userID, $canViewOnlineStatus) {
-		if (WCF::getSession()->getPermission('admin.user.canViewInvisible') || $userID == WCF::getUser()->userID) return true;
-
-		$data = ['result' => false, 'userID' => $userID, 'canViewOnlineStatus' => $canViewOnlineStatus];
+		if (WCF::getSession()->getPermission('admin.user.canViewInvisible') || $userID == WCF::getUser()->userID) {
+			return true;
+		}
+		
+		$data = [
+			'result' => false,
+			'userID' => $userID,
+			'canViewOnlineStatus' => $canViewOnlineStatus,
+		];
 		
 		switch ($canViewOnlineStatus) {
-			case 0: // everyone
+			case UserProfile::ACCESS_EVERYONE:
 				$data['result'] = true;
 				break;
-			case 1: // registered
+				
+			case UserProfile::ACCESS_REGISTERED:
 				if (WCF::getUser()->userID) $data['result'] = true;
 				break;
-			case 2: // following
+				
+			case UserProfile::ACCESS_FOLLOWING:
 				/** @noinspection PhpUndefinedMethodInspection */
 				if (WCF::getUserProfileHandler()->isFollower($userID)) $data['result'] = true;
 				break;
@@ -178,4 +193,46 @@ class UsersOnlineList extends SessionList {
 		
 		return $data['result'];
 	}
+	
+	/**
+	 * Checks the 'canViewOnlineStatus' setting for the given user.
+	 * 
+	 * @param       UserOnline      $userOnline
+	 * @return      boolean
+	 * @since       5.3
+	 */
+	public static function isVisibleUser(UserOnline $userOnline) {
+		if (WCF::getSession()->getPermission('admin.user.canViewInvisible') || $userOnline->userID == WCF::getUser()->userID) {
+			return true;
+		}
+		
+		$data = [
+			'result' => false,
+			'userOnline' => $userOnline,
+		];
+		
+		if ($userOnline->getPermission('user.profile.canHideOnlineStatus')) {
+			switch ($userOnline->canViewOnlineStatus) {
+				case UserProfile::ACCESS_EVERYONE:
+					$data['result'] = true;
+					break;
+				
+				case UserProfile::ACCESS_REGISTERED:
+					if (WCF::getUser()->userID) $data['result'] = true;
+					break;
+				
+				case UserProfile::ACCESS_FOLLOWING:
+					/** @noinspection PhpUndefinedMethodInspection */
+					if (WCF::getUserProfileHandler()->isFollower($userID)) $data['result'] = true;
+					break;
+			}
+		}
+		else {
+			$data['result'] = true;
+		}
+		
+		EventHandler::getInstance()->fireAction(get_called_class(), 'isVisibleUser', $data);
+		
+		return $data['result'];
+	}
 }
diff --git a/wcfsetup/install/files/lib/system/box/WhoWasOnlineBoxController.class.php b/wcfsetup/install/files/lib/system/box/WhoWasOnlineBoxController.class.php
index 495c029753..5682de6b02 100644
--- a/wcfsetup/install/files/lib/system/box/WhoWasOnlineBoxController.class.php
+++ b/wcfsetup/install/files/lib/system/box/WhoWasOnlineBoxController.class.php
@@ -102,7 +102,7 @@ class WhoWasOnlineBoxController extends AbstractDatabaseObjectListBoxController
 			});
 			foreach ($this->users as $key => $user) {
 				// remove invisible users
-				if (!UsersOnlineList::isVisible($user->userID, $user->canViewOnlineStatus)) {
+				if (!UsersOnlineList::isVisibleUser($user)) {
 					unset($this->users[$key]);
 				}
 			}
diff --git a/wcfsetup/install/lang/de.xml b/wcfsetup/install/lang/de.xml
index d7e287dd91..b3ba3bb063 100644
--- a/wcfsetup/install/lang/de.xml
+++ b/wcfsetup/install/lang/de.xml
@@ -891,6 +891,7 @@ ACHTUNG: Die oben genannten Meldungen sind stark gekürzt. Sie können Details z
 		<item name="wcf.acp.group.option.user.contactForm.attachment.allowedExtensions.description"><![CDATA[Eine Dateiendung pro Zeile]]></item>
 		<item name="wcf.acp.group.option.user.contactForm.attachment.maxCount"><![CDATA[Maximale Dateianhänge pro Nachricht]]></item>
 		<item name="wcf.acp.group.option.user.profile.canEditUserProfile"><![CDATA[Kann eigenes Profil bearbeiten]]></item>
+		<item name="wcf.acp.group.option.user.profile.canHideOnlineStatus"><![CDATA[Kann Online-Status verbergen]]></item>
 		<item name="wcf.acp.group.allowMention"><![CDATA[Benutzergruppe kann erwähnt werden]]></item>
 		<item name="wcf.acp.group.type.owner"><![CDATA[Besitzer]]></item>
 		<item name="wcf.acp.group.type.owner.description"><![CDATA[Die Besitzer-Gruppe verfügt über nicht entziehbare Berechtigungen und kann von anderen Gruppen nicht bearbeitet werden, diese Gruppe kann nur durch die Besitzer-Gruppe selbst bearbeitet werden. Mitglieder dieser Gruppe können andere Benutzer zu dieser Gruppe hinzufügen, sich aber selbst nicht daraus entfernen.]]></item>
diff --git a/wcfsetup/install/lang/en.xml b/wcfsetup/install/lang/en.xml
index b30d0f59d6..ada3909315 100644
--- a/wcfsetup/install/lang/en.xml
+++ b/wcfsetup/install/lang/en.xml
@@ -868,6 +868,7 @@ ATTENTION: The messages listed above are greatly shortened. You can view details
 		<item name="wcf.acp.group.option.user.contactForm.attachment.allowedExtensions.description"><![CDATA[Enter one extension per line.]]></item>
 		<item name="wcf.acp.group.option.user.contactForm.attachment.maxCount"><![CDATA[Maximum Attachments per Message]]></item>
 		<item name="wcf.acp.group.option.user.profile.canEditUserProfile"><![CDATA[Can edit their profile]]></item>
+		<item name="wcf.acp.group.option.user.profile.canHideOnlineStatus"><![CDATA[Can hide their online status]]></item>
 		<item name="wcf.acp.group.allowMention"><![CDATA[User group can be mentioned]]></item>
 		<item name="wcf.acp.group.type.owner"><![CDATA[Owner]]></item>
 		<item name="wcf.acp.group.type.owner.description"><![CDATA[The owner group features a few irrevocable permissions and is protected from edits by other groups, only the owner group can edit itself. Members of this group can add other users to this group, but cannot remove themselves.]]></item>
-- 
2.20.1