follow access

application/Espo/Hooks/Common/Stream.php

@@ -35,11 +35,11 @@ class Stream extends \Espo\Core\Hooks\Base
 {
     protected $streamService = null;
 
-    protected $auditedFieldsCache = array();
+    protected $auditedFieldsCache = [];
 
-    protected $hasStreamCache = array();
+    protected $hasStreamCache = [];
 
-    protected $isLinkObservableInStreamCache = array();
+    protected $isLinkObservableInStreamCache = [];
 
     protected $statusFields = null;
 

application/Espo/Services/Record.php

@@ -1857,6 +1857,7 @@ class Record extends \Espo\Core\Services\Base
     public function follow($id, $userId = null)
     {
         $entity = $this->getRepository()->get($id);
+        if (!$entity) throw new NotFoundSilent();
 
         if (!$this->getAcl()->check($entity, 'stream')) {
             throw new Forbidden();
@@ -1872,6 +1873,7 @@ class Record extends \Espo\Core\Services\Base
     public function unfollow($id, $userId = null)
     {
         $entity = $this->getRepository()->get($id);
+        if (!$entity) throw new NotFoundSilent();
 
         if (empty($userId)) {
             $userId = $this->getUser()->id;

application/Espo/Services/Stream.php

@@ -143,7 +143,8 @@ class Stream extends \Espo\Core\Services\Base
 
         foreach ($userIdList as $i => $userId) {
             $user = $this->getEntityManager()->getEntity('User', $userId);
-            if (!$user){
+            if (!$user) {
+                unset($userIdList[$i]);
                 continue;
             }
             if (!$this->getAclManager()->check($user, $entity, 'stream')) {
@@ -165,10 +166,10 @@ class Stream extends \Espo\Core\Services\Base
 
         $this->followEntityMass($entity, $userIdList);
 
-        $noteList = $this->getEntityManager()->getRepository('Note')->where(array(
+        $noteList = $this->getEntityManager()->getRepository('Note')->where([
             'parentType' => $entityType,
             'parentId' => $entityId
-        ))->order('number', 'ASC')->find();
+        ])->order('number', 'ASC')->find();
 
         foreach ($noteList as $note) {
             $this->getNotificationService()->notifyAboutNote($userIdList, $note);
@@ -197,9 +198,9 @@ class Stream extends \Espo\Core\Services\Base
         return false;
     }
 
-    public function followEntityMass(Entity $entity, array $sourceUserIdList)
+    public function followEntityMass(Entity $entity, array $sourceUserIdList, bool $skipAclCheck = false)
     {
-        if (!$this->getMetadata()->get('scopes.' . $entity->getEntityName() . '.stream')) {
+        if (!$this->getMetadata()->get(['scopes', $entity->getEntityType(), 'stream'])) {
             return false;
         }
 
@@ -213,6 +214,27 @@ class Stream extends \Espo\Core\Services\Base
 
         $userIdList = array_unique($userIdList);
 
+        if (!$skipAclCheck) {
+            foreach ($userIdList as $i => $userId) {
+                $user = $this->getEntityManager()->getRepository('User')
+                    ->select(['id', 'type', 'isActive'])
+                    ->where([
+                        'id' => $userId,
+                        'isActive' => true,
+                    ])->findOne();
+
+                if (!$user) {
+                    unset($userIdList[$i]);
+                    continue;
+                }
+
+                if (!$this->getAclManager()->check($user, $entity, 'stream')) {
+                    unset($userIdList[$i]);
+                }
+            }
+            $userIdList = array_values($userIdList);
+        }
+
         if (empty($userIdList)) {
             return;
         }