Version 4.7.23

applications/cms/widgets/RecordFeed.php

@@ -12,6 +12,9 @@
 namespace IPS\cms\widgets;
 
 /* To prevent PHP errors (extending class does not exist) revealing path */
+
+use IPS\Db;
+
 if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
 {
 	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
@@ -219,9 +222,28 @@ class _RecordFeed extends \IPS\Content\Widget
 	protected function buildWhere()
 	{
 		static::$class = '\IPS\cms\Records' . $this->configuration['cms_rf_database'];
+		$class = static::$class;
 		
 		$where = parent::buildWhere();
 
+		/* If we did not select any categories and we are honoring permissions, filter out club categories */
+		if( empty( $this->configuration['widget_feed_container'] ) and !empty( $this->configuration['widget_feed_use_perms'] ) )
+		{
+			$database = \IPS\cms\Databases::load( $this->configuration['cms_rf_database'] );
+			if( $database->use_categories and $database->allow_club_categories )
+			{
+				/* Loop through and get only the categories that the user can view */
+				$nodes = [];
+				$categoriesClass = 'IPS\cms\Categories' . $this->configuration['cms_rf_database'];
+				foreach( $categoriesClass::roots( 'read' ) as $cat )
+				{
+					$nodes[] = $cat->_id;
+				}
+
+				$where[] = [ Db::i()->in( $class::$databaseTable . '.category_id', $nodes ) ];
+			}
+		}
+
 		$fieldClass   = 'IPS\cms\Fields' .  $this->configuration['cms_rf_database'];
 		$customFields = $fieldClass::data( 'view', NULL, $fieldClass::FIELD_SKIP_TITLE_CONTENT | $fieldClass::FIELD_DISPLAY_FILTERS );