1 files changed, 49 insertions, 44 deletions
diff --git a/mod/notifications/actions/groupsave.php b/mod/notifications/actions/groupsave.php
index 8a0ebd24b..e79dae5cc 100644
--- a/mod/notifications/actions/groupsave.php
+++ b/mod/notifications/actions/groupsave.php
@@ -1,44 +1,49 @@
-<?php
-
-	/**
-	 * Elgg notifications group save
-	 * 
-	 * @package ElggNotifications
-	 * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
-	 * @author Curverider Ltd
-	 * @copyright Curverider Ltd 2008-2009
-	 * @link http://elgg.com/
-	 */
-
-	// Restrict to logged in users
-		gatekeeper();
-		
-	// Load important global vars
-		global $SESSION;
-		global $NOTIFICATION_HANDLERS;
-
-	// Get group memberships and condense them down to an array of guids
-		$groups = array();
-		if ($groupmemberships = get_entities_from_relationship('member',$_SESSION['user']->guid,false,'group','',0,'',9999)) {
-			foreach($groupmemberships as $groupmembership)
-				$groups[] = $groupmembership->guid;
-		}		
-		
-		foreach($NOTIFICATION_HANDLERS as $method => $foo) {
-			$subscriptions[$method] = get_input($method.'subscriptions');
-			$personal[$method] = get_input($method.'personal');
-			$collections[$method] = get_input($method.'collections');
-			if (!empty($groups))
-				foreach($groups as $group)
-					if (in_array($group,$subscriptions[$method])) {
-						add_entity_relationship($SESSION['user']->guid,'notify'.$method,$group);
-					} else {
-						remove_entity_relationship($SESSION['user']->guid,'notify'.$method,$group);
-					}
-		}
-				
-		system_message(elgg_echo('notifications:subscriptions:success'));
-		
-		forward($_SERVER['HTTP_REFERER']);
-
-?>
-\ No newline at end of file
+<?php
+
+/**
+ * Elgg notifications group save
+ *
+ * @package ElggNotifications
+ */
+
+$current_user = elgg_get_logged_in_user_entity();
+
+$guid = (int) get_input('guid', 0);
+if (!$guid || !($user = get_entity($guid))) {
+	forward();
+}
+if (($user->guid != $current_user->guid) && !$current_user->isAdmin()) {
+	forward();
+}
+
+// Get group memberships and condense them down to an array of guids
+$groups = array();
+$options = array(
+	'relationship' => 'member',
+	'relationship_guid' => $user->guid,
+	'type' => 'group',
+	'limit' => false,
+);
+if ($groupmemberships = elgg_get_entities_from_relationship($options)) {
+	foreach($groupmemberships as $groupmembership) {
+		$groups[] = $groupmembership->guid;
+	}
+}
+
+if (!empty($groups)) {
+	global $NOTIFICATION_HANDLERS;
+	foreach ($NOTIFICATION_HANDLERS as $method => $foo) {
+		$subscriptions[$method] = get_input($method.'subscriptions', array());
+		foreach ($groups as $group) {
+			if (in_array($group, $subscriptions[$method])) {
+				add_entity_relationship($user->guid, 'notify'.$method, $group);
+			} else {
+				remove_entity_relationship($user->guid, 'notify'.$method, $group);
+			}
+		}
+	}
+}
+
+system_message(elgg_echo('notifications:subscriptions:success'));
+
+forward(REFERER);