From 2737280fa498ddb468cdb433d39d8f7bb3e3fd56 Mon Sep 17 00:00:00 2001
From: cmrd Senya <senya@riseup.net>
Date: Mon, 25 Apr 2016 17:39:01 +0000
Subject: [PATCH 1/2] Don't include wrong shareable types in scopes

---
 lib/diaspora/shareable.rb           |  7 ++++---
 spec/lib/diaspora/shareable_spec.rb | 25 +++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/lib/diaspora/shareable.rb b/lib/diaspora/shareable.rb
index a4c58ed86..28efb8a84 100644
--- a/lib/diaspora/shareable.rb
+++ b/lib/diaspora/shareable.rb
@@ -21,11 +21,13 @@ module Diaspora
         scope :all_public, -> { where(public: true, pending: false) }
 
         scope :with_visibility, -> {
-          joins("LEFT OUTER JOIN share_visibilities ON share_visibilities.shareable_id = #{table_name}.id")
+          joins("LEFT OUTER JOIN share_visibilities ON share_visibilities.shareable_id = #{table_name}.id AND "\
+            "share_visibilities.shareable_type = '#{base_class}'")
         }
 
         scope :with_aspects, -> {
-          joins("LEFT OUTER JOIN aspect_visibilities ON aspect_visibilities.shareable_id = #{table_name}.id")
+          joins("LEFT OUTER JOIN aspect_visibilities ON aspect_visibilities.shareable_id = #{table_name}.id AND "\
+          " aspect_visibilities.shareable_type = '#{base_class}'")
         }
 
         def self.owned_or_visible_by_user(user)
@@ -57,7 +59,6 @@ module Diaspora
 
         def self.visible_by_user(user)
           ShareVisibility.arel_table[:user_id].eq(user.id)
-            .and(ShareVisibility.arel_table[:shareable_type].eq(base_class.to_s))
         end
         private_class_method :visible_by_user
       end
diff --git a/spec/lib/diaspora/shareable_spec.rb b/spec/lib/diaspora/shareable_spec.rb
index b98434106..29e4c0503 100644
--- a/spec/lib/diaspora/shareable_spec.rb
+++ b/spec/lib/diaspora/shareable_spec.rb
@@ -17,5 +17,30 @@ describe Diaspora::Shareable do
         expect(Post.all_public.map(&:id)).to eq([])
       end
     end
+
+    context "having multiple objects with equal db IDs" do
+      before do
+        # Determine the next database key ID, free on both Photo and StatusMessage
+        id = [Photo, StatusMessage].map {|model| model.maximum(:id).try(:next).to_i }.push(1).max
+
+        alice.post(:status_message, id: id, text: "I'm #{alice.username}", to: alice.aspects.first.id, public: false)
+        alice.post(:photo, id: id, user_file: uploaded_photo, to: alice.aspects.first.id, public: false)
+        expect(StatusMessage.where(id: id)).to exist
+        expect(Photo.where(id: id)).to exist
+      end
+
+      {with_visibility: ShareVisibility, with_aspects: AspectVisibility}.each do |method, visibility_class|
+        describe ".#{method}" do
+          it "includes only object of a right type" do
+            [Photo, Post].each do |klass|
+              expect(klass.send(method).where(visibility_class.arel_table[:shareable_type].eq(klass.to_s)).count)
+                .not_to eq(0)
+              expect(klass.send(method).where.not(visibility_class.arel_table[:shareable_type].eq(klass.to_s)).count)
+                .to eq(0)
+            end
+          end
+        end
+      end
+    end
   end
 end

From 204f58e6a72c94d4acb66fa83b5709669c189462 Mon Sep 17 00:00:00 2001
From: cmrd Senya <senya@riseup.net>
Date: Tue, 31 May 2016 17:56:04 +0300
Subject: [PATCH 2/2] Remove repetion of shareable initialization code

---
 app/models/photo.rb       | 6 +-----
 app/models/post.rb        | 4 +---
 lib/diaspora/shareable.rb | 6 ++++++
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/app/models/photo.rb b/app/models/photo.rb
index 76a851012..5c41374e3 100644
--- a/app/models/photo.rb
+++ b/app/models/photo.rb
@@ -82,11 +82,7 @@ class Photo < ActiveRecord::Base
   end
 
   def self.diaspora_initialize(params = {})
-    photo = self.new params.to_hash.slice(:text, :pending)
-    photo.author = params[:author]
-    photo.public = params[:public] if params[:public]
-    photo.pending = params[:pending] if params[:pending]
-
+    photo = shareable_initialize(params)
     photo.random_string = SecureRandom.hex(10)
 
     if photo.author.local?
diff --git a/app/models/post.rb b/app/models/post.rb
index e7618157d..02582c80a 100644
--- a/app/models/post.rb
+++ b/app/models/post.rb
@@ -133,9 +133,7 @@ class Post < ActiveRecord::Base
   #############
 
   def self.diaspora_initialize(params)
-    new(params.to_hash.stringify_keys.slice(*column_names)).tap do |new_post|
-      new_post.author = params[:author]
-    end
+    shareable_initialize(params)
   end
 
   # @return Returns true if this Post will accept updates (i.e. updates to the caption of a photo).
diff --git a/lib/diaspora/shareable.rb b/lib/diaspora/shareable.rb
index 28efb8a84..93ac4adf4 100644
--- a/lib/diaspora/shareable.rb
+++ b/lib/diaspora/shareable.rb
@@ -57,6 +57,12 @@ module Diaspora
           user.person.send(table_name).where(pending: false)
         end
 
+        def self.shareable_initialize(params)
+          new(params.to_hash.stringify_keys.slice(*column_names)).tap do |new_shareable|
+            new_shareable.author = params[:author]
+          end
+        end
+
         def self.visible_by_user(user)
           ShareVisibility.arel_table[:user_id].eq(user.id)
         end