From c2c79778ca51ed47557c132b9b55ff8317ca642d Mon Sep 17 00:00:00 2001 From: ECYaz Date: Tue, 28 Jul 2026 22:16:26 -0400 Subject: [PATCH] Restrict the branch filter to validated revisions The category and index contribution listings matched a contribution against the branch filter whenever any revision row existed for that branch, regardless of the revision's validation state. The only revision_validated check sat inside the permission clause, where it is skipped for moderators and bypassed by the author and view-authorised OR-branches, so a style whose only 3.3 revision had been denied still appeared under the 3.3.x filter with a 3.2 version badge. Build the validated requirement into the branch condition itself, using the same semantics as the version list rendered on the very same page: gated on require_validation, with the validation-free types exempt. The now redundant check in the permission clause is removed. --- includes/overlords/contribs.php | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/includes/overlords/contribs.php b/includes/overlords/contribs.php index 285860cc8..df50e6e2c 100644 --- a/includes/overlords/contribs.php +++ b/includes/overlords/contribs.php @@ -188,6 +188,22 @@ public static function display_contribs($mode, $hierarchy_ids, $branch = false, $branch = ($branch) ? (int) $branch : null; + // Limit the branch filter to validated revisions, so contributions whose + // only revision for the branch was denied or pulled do not match. + $branch_filter = ''; + + if ($branch) + { + $branch_filter = " AND rp.phpbb_version_branch = $branch"; + + if (titania::$config->require_validation) + { + $validation_free = $types->find_validation_free(); + $branch_filter .= ' AND (rp.revision_validated = 1' . + ((sizeof($validation_free)) ? ' OR ' . phpbb::$db->sql_in_set('c.contrib_type', $validation_free) : '') . ')'; + } + } + $select = 'DISTINCT(c.contrib_id), c.contrib_name, c.contrib_name_clean, c.contrib_status, c.contrib_downloads, c.contrib_views, c.contrib_rating, c.contrib_rating_count, c.contrib_type, c.contrib_last_update, c.contrib_user_id, @@ -306,7 +322,7 @@ public static function display_contribs($mode, $hierarchy_ids, $branch = false, // If multiple categories, use the stripped list. If it's just the single hidden category, that's okay // as presumably someone has gone looking for the hidden category, or it has been linked to, etc. 'WHERE' => phpbb::$db->sql_in_set('cic.category_id', $visible_category_ids, false, true) . ' - AND c.contrib_visible = 1 ' . (($branch) ? " AND rp.phpbb_version_branch = $branch" : '') . + AND c.contrib_visible = 1' . $branch_filter . (($status_filter) ? $status_filter : ''), 'ORDER_BY' => $sort->get_order_by(), @@ -381,8 +397,7 @@ public static function display_contribs($mode, $hierarchy_ids, $branch = false, ), ), - 'WHERE' => 'c.contrib_visible = 1' . - (($branch) ? " AND rp.phpbb_version_branch = $branch" : '') . + 'WHERE' => 'c.contrib_visible = 1' . $branch_filter . (($status_filter) ? $status_filter : '') . ((isset($featured_where_clause)) ? $featured_where_clause : ''), @@ -416,7 +431,6 @@ public static function display_contribs($mode, $hierarchy_ids, $branch = false, $view_unapproved = array_unique($view_unapproved); $sql_ary['WHERE'] .= ' AND (' . phpbb::$db->sql_in_set('c.contrib_status', array(ext::TITANIA_CONTRIB_APPROVED, ext::TITANIA_CONTRIB_DOWNLOAD_DISABLED)) . - ($branch ? ' AND rp.revision_validated = 1' : '') . ((sizeof($view_unapproved)) ? ' OR ' . phpbb::$db->sql_in_set('c.contrib_type', array_map('intval', $view_unapproved)) : '') . ' OR c.contrib_user_id = ' . phpbb::$user->data['user_id'] . ' OR cc.active = 1)';