fix bug #1371893: Wrong category read permissions

diff --git a/docs/NEWS b/docs/NEWS
index de64457df3f229aae210a3deb1916184534a1a17..004e0aab92679bc873a8506177efbfd552acde34 100644 (file)
--- a/docs/NEWS
+++ b/docs/NEWS
@@ -3,6 +3,10 @@
 Version 0.9.2 ()
 ------------------------------------------------------------------------
 
+    * Fix bug #1371893: Category write permissions are not properly
+      evaluated when writing into a category that a user has no
+      access to. Thanks to cydvicious! (garvinhicking)
+
     * Fix bug #1371630: Write permissions to category are stored with
       input data of the 'Read permissions' author listing.
 

diff --git a/include/functions_entries.inc.php b/include/functions_entries.inc.php
index 1233fdc13dc44ab65a2449872f877bffb701ee68..5644446b647df222876ea655d27c4303526a673d 100644 (file)
--- a/include/functions_entries.inc.php
+++ b/include/functions_entries.inc.php
@@ -430,15 +430,17 @@ function serendipity_fetchCategories($authorid = null, $name = null, $order = nu
 
     $where = '';
     if ($authorid != 'all' && is_numeric($authorid)) {
+        $sql_authorid = $authorid;
         if (!serendipity_checkPermission('adminCategoriesMaintainOthers', $authorid)) {
             $where = " WHERE (c.authorid = $authorid OR c.authorid = 0)";
             $where .= "OR (
                           acl.artifact_type = 'category'
                           AND acl.artifact_mode = '" . serendipity_db_escape_string($artifact_mode) . "'
-                         )";
+                         ) ";
 
         }
     } else {
+        $sql_authorid = 'c.authorid';
         $where = '';
     }
 
@@ -473,7 +475,7 @@ function serendipity_fetchCategories($authorid = null, $name = null, $order = nu
                            a.realname
                       FROM {$serendipity['dbPrefix']}category AS c
            LEFT OUTER JOIN {$serendipity['dbPrefix']}authors AS a
-                        ON c.authorid = a.authorid 
+                        ON c.authorid = $sql_authorid
            LEFT OUTER JOIN {$serendipity['dbPrefix']}authorgroups AS ag
                         ON ag.authorid = a.authorid
            LEFT OUTER JOIN {$serendipity['dbPrefix']}access AS acl