From: brockhaus <brockhaus>
Date: Tue, 17 Jul 2007 14:29:09 +0000 (+0000)
Subject: The recent entries sidebar plugin shiped with s9y listed entries not accessable by... 
X-Git-Url: http://git.mjollnir.org/gw?a=commitdiff_plain;h=385d57d6071f0cedf5a8edd41c01b06cb42676b3;p=s9y.git

The recent entries sidebar plugin shiped with s9y listed entries not accessable by the current user because of right restrictions.
---

diff --git a/docs/NEWS b/docs/NEWS
index ec74bb9..abfd084 100644
--- a/docs/NEWS
+++ b/docs/NEWS
@@ -3,6 +3,10 @@
 Version 1.3 ()
 ------------------------------------------------------------------------
 
+    * The recent entries sidebar plugin shiped with s9y listed entries
+      not accessable by the current user because of right restrictions.
+      (brockhaus)
+
     * The archive sidebar plugin shiped with s9y now displays numbers
       of articles correctly for month, catergories and so on, even
       if multicategory articles are used. (brockhaus)
diff --git a/plugins/serendipity_plugin_recententries/serendipity_plugin_recententries.php b/plugins/serendipity_plugin_recententries/serendipity_plugin_recententries.php
index 12b7a35..f815831 100644
--- a/plugins/serendipity_plugin_recententries/serendipity_plugin_recententries.php
+++ b/plugins/serendipity_plugin_recententries/serendipity_plugin_recententries.php
@@ -32,6 +32,7 @@ class serendipity_plugin_recententries extends serendipity_plugin {
     }
 
     function introspect_config_item($name, &$propbag) {
+        global $serendipity;
         switch($name) {
             case 'title':
                 $propbag->add('type',        'string');
@@ -122,11 +123,13 @@ class serendipity_plugin_recententries extends serendipity_plugin {
         $number_from_sw = $this->get_config('number_from');
         $randomize      = ($this->get_config('randomize') == "yes") ? true : false ;
 
-        $sql_join   = '';
-        $sql_where  = '';
+        $sql_condition = array();
+        $sql_condition['joins'] = '';
+        $sql_condition['and']   = '';
         if ($category != 'none') {
-            $sql_join = 'LEFT OUTER JOIN ' . $serendipity['dbPrefix'] . 'entrycat AS ec ON id = ec.entryid
-                         LEFT OUTER JOIN ' . $serendipity['dbPrefix'] . 'category AS c  ON ec.categoryid = c.categoryid';
+            $sql_condition['joins'] .= 
+                'LEFT OUTER JOIN ' . $serendipity['dbPrefix'] . 'entrycat AS ec ON id = ec.entryid
+                 LEFT OUTER JOIN ' . $serendipity['dbPrefix'] . 'category AS c  ON ec.categoryid = c.categoryid';
                          
             $sql_categories = array();
             if (is_numeric($category)) {
@@ -140,7 +143,7 @@ class serendipity_plugin_recententries extends serendipity_plugin {
                 $category_parts[] = "\n" . implode(' AND ', serendipity_fetchCategoryRange($sql_category));
             }
 
-            $sql_where = ' AND (c.category_left BETWEEN ' . implode(' OR c.category_left BETWEEN ', $category_parts) . ')';
+            $sql_condition['and'] .= ' AND (c.category_left BETWEEN ' . implode(' OR c.category_left BETWEEN ', $category_parts) . ')';
         }
 
         if (!$number || !is_numeric($number) || $number < 1) {
@@ -170,15 +173,18 @@ class serendipity_plugin_recententries extends serendipity_plugin {
             $sql_order = "ORDER BY timestamp DESC ";
         }
 
+        $sql_condition['and'] = "AND timestamp <= " . time();
+        serendipity_ACL_SQL($sql_condition, $category == 'none');
+
         $entries_query = "SELECT DISTINCT id,
                                 title,
                                 timestamp
-                           FROM {$serendipity['dbPrefix']}entries
-                                $sql_join
-                          WHERE isdraft = 'false' AND timestamp <= " . time() . "
-                                $sql_where
+                           FROM {$serendipity['dbPrefix']}entries AS e
+                                {$sql_condition['joins']}
+                          WHERE isdraft = 'false' {$sql_condition['and']}
                                 $sql_order
                                 $sql_number";
+        
         $entries = serendipity_db_query($entries_query);
 
         if (isset($entries) && is_array($entries)) {