Improve non_public photo handling.

Clear the photo cache if the non_public flag is switched on, do not
cache non_public or LOGIN_REQUIRED photos, remove non_public photos
from memcached recent lists, pass through any cookies on non_public
reports/updates, and check the non_public flag on photo lookup.

1 files changed, 20 insertions, 4 deletions

diff --git a/perllib/FixMyStreet/App/Controller/Photo.pm b/perllib/FixMyStreet/App/Controller/Photo.pm
index aeb40f520..d7a5b4bb3 100644
--- a/perllib/FixMyStreet/App/Controller/Photo.pm
+++ b/perllib/FixMyStreet/App/Controller/Photo.pm
@@ -39,6 +39,7 @@ sub during :LocalRegex('^(temp|fulltemp)\.([0-9a-f]{40}\.(?:jpeg|png|gif|tiff))$
     $size = $size eq 'temp' ? 'default' : 'full';
     my $photo = $photoset->get_image_data(size => $size, default => $c->cobrand->default_photo_resize);
 
+    $c->stash->{non_public} = 0;
     $c->forward( 'output', [ $photo ] );
 }
 
@@ -69,6 +70,19 @@ sub index :LocalRegex('^(c/)?([1-9]\d*)(?:\.(\d+))?(?:\.(full|tn|fp))?\.(?:jpeg|
 
     $c->detach( 'no_photo' ) unless $c->cobrand->allow_photo_display($item, $photo_number); # Should only be for reports, not updates
 
+    my $problem = $is_update ? $item->problem : $item;
+    $c->stash->{non_public} = $problem->non_public;
+
+    if ($c->stash->{non_public}) {
+        my $body_ids = $problem->bodies_str_ids;
+        # Check permission
+        $c->detach('no_photo') unless $c->user_exists;
+        $c->detach('no_photo') unless $c->user->is_superuser
+            || $c->user->id == $problem->user->id
+            || $c->user->has_permission_to('report_inspect', $body_ids)
+            || $c->user->has_permission_to('report_mark_private', $body_ids);
+    }
+
     my $photo;
     $photo = $item->get_photoset
         ->get_image_data( num => $photo_number, size => $size, default => $c->cobrand->default_photo_resize )
@@ -81,10 +95,12 @@ sub output : Private {
     my ( $self, $c, $photo ) = @_;
 
     # Save to file
-    path(FixMyStreet->path_to('web', 'photo', 'c'))->mkpath;
-    my $out = FixMyStreet->path_to('web', $c->req->path);
-    my $symlink_exists = $photo->{symlink} ? symlink($photo->{symlink}, $out) : undef;
-    path($out)->spew_raw($photo->{data}) unless $symlink_exists;
+    if (!FixMyStreet->config('LOGIN_REQUIRED') && !$c->stash->{non_public}) {
+        path(FixMyStreet->path_to('web', 'photo', 'c'))->mkpath;
+        my $out = FixMyStreet->path_to('web', $c->req->path);
+        my $symlink_exists = $photo->{symlink} ? symlink($photo->{symlink}, $out) : undef;
+        path($out)->spew_raw($photo->{data}) unless $symlink_exists;
+    }
 
     $c->res->content_type( $photo->{content_type} );
     $c->res->body( $photo->{data} );