Fixes #4138: Admin can edit any users' notifications

2 files changed, 19 insertions, 5 deletions

diff --git a/mod/notifications/views/default/forms/notificationsettings/groupsave.php b/mod/notifications/views/default/forms/notificationsettings/groupsave.php
index 61b94ff8b..168639ab2 100644
--- a/mod/notifications/views/default/forms/notificationsettings/groupsave.php
+++ b/mod/notifications/views/default/forms/notificationsettings/groupsave.php
@@ -3,13 +3,18 @@
  * Elgg notifications groups subscription form
  *
  * @package ElggNotifications
+ *
+ * @uses $vars['user'] ElggUser
  */
 
+/* @var ElggUser $user */
+$user = $vars['user'];
+
 global $NOTIFICATION_HANDLERS;
 foreach ($NOTIFICATION_HANDLERS as $method => $foo) {
 	$subsbig[$method] = elgg_get_entities_from_relationship(array(
 		'relationship' => 'notify' . $method,
-		'relationship_guid' => elgg_get_logged_in_user_guid(),
+		'relationship_guid' => $user->guid,
 		'types' => 'group',
 		'limit' => 99999,
 	));
@@ -97,6 +102,7 @@ END;
 <?php
 }
 	echo '<div class="elgg-foot mtm">';
+	echo elgg_view('input/hidden', array('name' => 'guid', 'value' => $user->guid));
 	echo elgg_view('input/submit', array('value' => elgg_echo('save')));
 	echo '</div>';
 	
diff --git a/mod/notifications/views/default/forms/notificationsettings/save.php b/mod/notifications/views/default/forms/notificationsettings/save.php
index ff32d8558..9470256ca 100644
--- a/mod/notifications/views/default/forms/notificationsettings/save.php
+++ b/mod/notifications/views/default/forms/notificationsettings/save.php
@@ -1,13 +1,21 @@
 <?php
 /**
  * Personal notifications form body
+ *
+ * @uses $vars['user'] ElggUser
  */
 
-echo elgg_view('notifications/subscriptions/personal');
-echo elgg_view('notifications/subscriptions/collections');
-echo elgg_view('notifications/subscriptions/forminternals');
+/* @var ElggUser $user */
+$user = $vars['user'];
+
+echo elgg_view('notifications/subscriptions/personal', $vars);
+echo elgg_view('notifications/subscriptions/collections', $vars);
+echo elgg_view('notifications/subscriptions/forminternals', $vars);
 
 ?>
 <div class="elgg-foot">
-<?php echo elgg_view('input/submit', array('value' => elgg_echo('save'))); ?>
+<?php
+echo elgg_view('input/hidden', array('name' => 'guid', 'value' => $user->guid));
+echo elgg_view('input/submit', array('value' => elgg_echo('save')));
+?>
 </div>