From 4dcb996a51c95d6a5dca8c8a6faaa213ea05ebfc Mon Sep 17 00:00:00 2001
From: christianbeeznst <christian.fasanando@beeznest.com>
Date: Wed, 22 May 2024 14:59:10 -0500
Subject: [PATCH] Social: Fix shared profile accessible - refs BT#21101

---
 assets/vue/composables/useSocialInfo.js       |  7 ++++++-
 assets/vue/views/social/SocialWall.vue        |  5 +++--
 .../Authorization/Voter/UserVoter.php         | 20 ++++++++++++++++++-
 3 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/assets/vue/composables/useSocialInfo.js b/assets/vue/composables/useSocialInfo.js
index e6c08182b2..a37424d81e 100644
--- a/assets/vue/composables/useSocialInfo.js
+++ b/assets/vue/composables/useSocialInfo.js
@@ -43,7 +43,12 @@ export function useSocialInfo() {
   const loadUser = async () => {
     try {
       if (route.query.id) {
-        user.value = await store.dispatch("user/load", "/api/users/" + route.query.id)
+        const params = { ...route.query }
+        if (route.path.includes("/social")) {
+          params.page_origin = "social"
+        }
+        const response = await axios.get(`/api/users/${route.query.id}`, { params })
+        user.value = response.data
         isCurrentUser.value = false
       } else {
         user.value = securityStore.user
diff --git a/assets/vue/views/social/SocialWall.vue b/assets/vue/views/social/SocialWall.vue
index 899f52ed89..b5fdfa5de0 100644
--- a/assets/vue/views/social/SocialWall.vue
+++ b/assets/vue/views/social/SocialWall.vue
@@ -1,12 +1,12 @@
 <template>
   <div>
-    <SocialWallPostForm v-if="!hidePostForm"  @post-created="refreshPosts" class="mb-6" />
+    <SocialWallPostForm v-if="!hidePostForm && isCurrentUser"  @post-created="refreshPosts" class="mb-6" />
     <SocialWallPostList ref="postListRef" class="mb-6" />
   </div>
 </template>
 
 <script setup>
-import { ref } from 'vue';
+import { inject, ref } from "vue"
 import SocialWallPostForm from "../../components/social/SocialWallPostForm.vue"
 import SocialWallPostList from "../../components/social/SocialWallPostList.vue"
 
@@ -18,6 +18,7 @@ const props = defineProps({
 });
 
 const postListRef = ref(null);
+const isCurrentUser = inject('is-current-user')
 
 function refreshPosts() {
   if (postListRef.value) {
diff --git a/src/CoreBundle/Security/Authorization/Voter/UserVoter.php b/src/CoreBundle/Security/Authorization/Voter/UserVoter.php
index 867c79432a..105552f166 100644
--- a/src/CoreBundle/Security/Authorization/Voter/UserVoter.php
+++ b/src/CoreBundle/Security/Authorization/Voter/UserVoter.php
@@ -11,6 +11,7 @@ use Chamilo\CoreBundle\Entity\User;
 use Chamilo\CoreBundle\Entity\UserRelUser;
 use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\HttpFoundation\RequestStack;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 use Symfony\Component\Security\Core\Authorization\Voter\Voter;
 use Symfony\Component\Security\Core\User\UserInterface;
@@ -27,7 +28,8 @@ class UserVoter extends Voter
 
     public function __construct(
         private Security $security,
-        private EntityManagerInterface $entityManager
+        private EntityManagerInterface $entityManager,
+        private RequestStack $requestStack
     ) {}
 
     protected function supports(string $attribute, $subject): bool
@@ -64,6 +66,11 @@ class UserVoter extends Voter
         $user = $subject;
 
         if (self::VIEW === $attribute) {
+            // If the user is on the social page and is logged in, allow access
+            if ($this->isFromSocialPage() && $currentUser->getId() !== null) {
+                return true;
+            }
+
             if ($currentUser === $user) {
                 return true;
             }
@@ -92,6 +99,17 @@ class UserVoter extends Voter
         return false;
     }
 
+    private function isFromSocialPage(): bool
+    {
+        $request = $this->requestStack->getCurrentRequest();
+        if ($request) {
+            $pageOrigin = $request->query->get('page_origin');
+            return $pageOrigin === 'social';
+        }
+
+        return false;
+    }
+
     private function haveSharedMessages(User $currentUser, User $targetUser): bool
     {
         $messageRepository = $this->entityManager->getRepository(Message::class);