{"action":"created","issue":{"url":"https://api.github.com/repos/moxi9/phpfox/issues/1309","repository_url":"https://api.github.com/repos/moxi9/phpfox","labels_url":"https://api.github.com/repos/moxi9/phpfox/issues/1309/labels{/name}","comments_url":"https://api.github.com/repos/moxi9/phpfox/issues/1309/comments","events_url":"https://api.github.com/repos/moxi9/phpfox/issues/1309/events","html_url":"https://github.com/moxi9/phpfox/issues/1309","id":146431733,"number":1309,"title":" Privacy issue on posting to profile ","user":{"login":"phpFox-webwolf","id":3979422,"avatar_url":"https://avatars.githubusercontent.com/u/3979422?v=3","gravatar_id":"","url":"https://api.github.com/users/phpFox-webwolf","html_url":"https://github.com/phpFox-webwolf","followers_url":"https://api.github.com/users/phpFox-webwolf/followers","following_url":"https://api.github.com/users/phpFox-webwolf/following{/other_user}","gists_url":"https://api.github.com/users/phpFox-webwolf/gists{/gist_id}","starred_url":"https://api.github.com/users/phpFox-webwolf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phpFox-webwolf/subscriptions","organizations_url":"https://api.github.com/users/phpFox-webwolf/orgs","repos_url":"https://api.github.com/users/phpFox-webwolf/repos","events_url":"https://api.github.com/users/phpFox-webwolf/events{/privacy}","received_events_url":"https://api.github.com/users/phpFox-webwolf/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-04-06T20:53:57Z","updated_at":"2016-05-03T10:33:13Z","closed_at":null,"body":"This is the same issue as [Privacy issue on posting to profile  #1168](https://github.com/moxi9/phpfox/issues/1168).  It is repeated here because it was not fixed.  I just repeated the bug with v4.3.1(2).\r\nI believe that the issue is with the feed template default block display.html.php file.  Older versions had conditional code to hide the form if privacy settings prevented profile postings.\r\n`\t{if Phpfox::isUser() && !PHPFOX_IS_AJAX && $sCustomViewType === null}\r\n\t\t{if (Phpfox::getUserBy('profile_page_id') > 0 && defined('PHPFOX_IS_USER_PROFILE')) \r\n\t\t\t|| (isset($aFeedCallback.disable_share) && $aFeedCallback.disable_share) \r\n\t\t\t|| (defined('PHPFOX_IS_USER_PROFILE') && !Phpfox::getService('user.privacy')->hasAccess('' . $aUser.user_id . '', 'feed.share_on_wall'))\r\n\t\t\t|| (defined('PHPFOX_IS_USER_PROFILE') && !Phpfox::getUserParam('profile.can_post_comment_on_profile') && $aUser.user_id != Phpfox::getUserId())\r\n\t\t}\r\n\r\n\t\t{else}\r\n\t\t\t{if !Phpfox::getService('profile')->timeline()}\r\n\t\t\t\t<div id=\"js_main_feed_holder\">\r\n\t\t\t\t\t{template file='feed.block.form'}\r\n\t\t\t\t</div>\r\n\t\t\t{/if}\r\n\t\t{/if}\r\n`\r\n\r\nBut the current version has no such restrictions:\r\n\r\n`\t{if Phpfox::isUser() && !PHPFOX_IS_AJAX && $sCustomViewType === null && $bUseFeedForm}\r\n\t\t<div id=\"js_main_feed_holder\">\r\n\t\t\t{template file='feed.block.form'}\r\n\t\t</div>\r\n`\r\nSince posts can be made to profiles against their privacy settings it seems that there is no submission filtering either.  I believe that both are required."},"comment":{"url":"https://api.github.com/repos/moxi9/phpfox/issues/comments/216490757","html_url":"https://github.com/moxi9/phpfox/issues/1309#issuecomment-216490757","issue_url":"https://api.github.com/repos/moxi9/phpfox/issues/1309","id":216490757,"user":{"login":"Data66PF","id":6908282,"avatar_url":"https://avatars.githubusercontent.com/u/6908282?v=3","gravatar_id":"","url":"https://api.github.com/users/Data66PF","html_url":"https://github.com/Data66PF","followers_url":"https://api.github.com/users/Data66PF/followers","following_url":"https://api.github.com/users/Data66PF/following{/other_user}","gists_url":"https://api.github.com/users/Data66PF/gists{/gist_id}","starred_url":"https://api.github.com/users/Data66PF/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Data66PF/subscriptions","organizations_url":"https://api.github.com/users/Data66PF/orgs","repos_url":"https://api.github.com/users/Data66PF/repos","events_url":"https://api.github.com/users/Data66PF/events{/privacy}","received_events_url":"https://api.github.com/users/Data66PF/received_events","type":"User","site_admin":false},"created_at":"2016-05-03T10:33:13Z","updated_at":"2016-05-03T10:33:13Z","body":"@neil96 please test this."}}