Fixes #4138: Admin can edit any users' notifications

4 files changed, 40 insertions, 11 deletions

diff --git a/mod/notifications/views/default/notifications/subscriptions/collections.php b/mod/notifications/views/default/notifications/subscriptions/collections.php
index 28d9fb5b8..b8787570d 100644
--- a/mod/notifications/views/default/notifications/subscriptions/collections.php
+++ b/mod/notifications/views/default/notifications/subscriptions/collections.php
@@ -1,4 +1,12 @@
-<?php //@todo JS 1.8: no ?>
+<?php
+/**
+ * @uses $vars['user'] ElggUser
+ */
+
+/* @var ElggUser $user */
+$user = $vars['user'];
+
+//@todo JS 1.8: no ?>
 <script type="text/javascript">
 	
 	function setCollection(members, method, id) {
@@ -42,7 +50,7 @@
 	</tr>
 <?php
 	$members = array();
-	if ($friends = get_user_friends(elgg_get_logged_in_user_guid(), '', 9999, 0)) {
+	if ($friends = get_user_friends($user->guid, '', 9999, 0)) {
 		foreach($friends as $friend) {
 			$members[] = $friend->guid;
 		}
@@ -63,7 +71,7 @@
 	$i = 0;
 	foreach($NOTIFICATION_HANDLERS as $method => $foo) {
 		$metaname = 'collections_notifications_preferences_' . $method;
-		if ($collections_preferences = elgg_get_logged_in_user_entity()->$metaname) {
+		if ($collections_preferences = $user->$metaname) {
 			if (!empty($collections_preferences) && !is_array($collections_preferences)) {
 				$collections_preferences = array($collections_preferences);
 			}
diff --git a/mod/notifications/views/default/notifications/subscriptions/form.php b/mod/notifications/views/default/notifications/subscriptions/form.php
index f2f6238f9..8ae27f829 100644
--- a/mod/notifications/views/default/notifications/subscriptions/form.php
+++ b/mod/notifications/views/default/notifications/subscriptions/form.php
@@ -1,11 +1,16 @@
 <?php
 /**
  * Elgg personal notifications
+ *
+ * @uses $vars['user'] ElggUser
  */
 
 	
-echo elgg_view('subscriptions/form/additions',$vars);
+echo elgg_view('subscriptions/form/additions', $vars);
 	
 // Display a description
 
-echo elgg_view_form('notificationsettings/save', array('class' => 'elgg-form-alt'));
+echo elgg_view_form('notificationsettings/save', array(
+	'class' => 'elgg-form-alt',
+	'user' => $vars['user']
+));
diff --git a/mod/notifications/views/default/notifications/subscriptions/forminternals.php b/mod/notifications/views/default/notifications/subscriptions/forminternals.php
index e89ce02be..11f266303 100644
--- a/mod/notifications/views/default/notifications/subscriptions/forminternals.php
+++ b/mod/notifications/views/default/notifications/subscriptions/forminternals.php
@@ -1,8 +1,13 @@
 <?php
 /**
  * Hacked up friends picker that needs to be replaced
+ *
+ * @uses $vars['user'] ElggUser
  */
 
+/* @var ElggUser $user */
+$user = $vars['user'];
+
 elgg_load_js('elgg.friendspicker');
 elgg_load_js('jquery.easing');
 
@@ -19,11 +24,16 @@ elgg_load_js('jquery.easing');
 <?php
 
 // Get friends and subscriptions
-$friends = get_user_friends(elgg_get_logged_in_user_guid(),'',9999,0);
+$friends = get_user_friends($user->guid, '', 9999, 0);
 		
 global $NOTIFICATION_HANDLERS;
 foreach($NOTIFICATION_HANDLERS as $method => $foo) {
-	$subsbig[$method] = elgg_get_entities_from_relationship(array('relationship' => 'notify' . $method, 'relationship_guid' => elgg_get_logged_in_user_guid(), 'types' => 'user', 'limit' => 99999));
+	$subsbig[$method] = elgg_get_entities_from_relationship(array(
+		'relationship' => 'notify' . $method,
+		'relationship_guid' => $user->guid,
+		'types' => 'user',
+		'limit' => 99999,
+	));
 }
 		
 $subs = array();
@@ -88,9 +98,9 @@ if (isset($vars['formtarget'])) {
 		
 // Sort users by letter
 if (is_array($friends) && sizeof($friends)) {
-	foreach($friends as $user) {
+	foreach($friends as $friend) {
 				
-		$letter = elgg_substr($user->name,0,1);
+		$letter = elgg_substr($friend->name,0,1);
 		$letter = elgg_strtoupper($letter);
 		if (!elgg_substr_count($chararray,$letter)) {
 			$letter = "*";
@@ -98,7 +108,7 @@ if (is_array($friends) && sizeof($friends)) {
 		if (!isset($users[$letter])) {
 			$users[$letter] = array();
 		}
-		$users[$letter][$user->guid] = $user;
+		$users[$letter][$friend->guid] = $friend;
 	}
 }
 
diff --git a/mod/notifications/views/default/notifications/subscriptions/personal.php b/mod/notifications/views/default/notifications/subscriptions/personal.php
index 7dac908fc..cf05426e2 100644
--- a/mod/notifications/views/default/notifications/subscriptions/personal.php
+++ b/mod/notifications/views/default/notifications/subscriptions/personal.php
@@ -1,4 +1,10 @@
 <?php
+/**
+ * @uses $vars['user'] ElggUser
+ */
+
+/* @var ElggUser $user */
+$user = $vars['user'];
 
 global $NOTIFICATION_HANDLERS;
 
@@ -40,7 +46,7 @@ foreach($NOTIFICATION_HANDLERS as $method => $foo) {
 $fields = '';
 $i = 0;
 foreach($NOTIFICATION_HANDLERS as $method => $foo) {
-	if ($notification_settings = get_user_notification_settings(elgg_get_logged_in_user_guid())) {
+	if ($notification_settings = get_user_notification_settings($user->guid)) {
 		if ($notification_settings->$method) {
 			$personalchecked[$method] = 'checked="checked"';
 		} else {