From 9f96090cc419f828e54e69a91a906a3f3d92c255 Mon Sep 17 00:00:00 2001
From: Roman Kelesidis <roman25052006.kelesh@gmail.com>
Date: Wed, 16 Apr 2025 23:29:00 +0700
Subject: [PATCH] fix: Displaying `Network news` and `Latest news` for guests
 when foums are private (#1879)

---
 admin/admin_forumauth.php      | 1 +
 admin/admin_forumauth_list.php | 1 +
 filelist.php                   | 8 +++++++-
 index.php                      | 8 ++++++++
 4 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/admin/admin_forumauth.php b/admin/admin_forumauth.php
index 797842a0a..fec7aa909 100644
--- a/admin/admin_forumauth.php
+++ b/admin/admin_forumauth.php
@@ -123,6 +123,7 @@ if ($submit) {
     }
 
     $datastore->update('cat_forums');
+    CACHE('bb_cache')->rm();
     bb_die($lang['FORUM_AUTH_UPDATED'] . '<br /><br />' . sprintf($lang['CLICK_RETURN_FORUMAUTH'], '<a href="' . 'admin_forumauth.php' . '">', '</a>'));
 }
 
diff --git a/admin/admin_forumauth_list.php b/admin/admin_forumauth_list.php
index c45aa0092..37c49d251 100644
--- a/admin/admin_forumauth_list.php
+++ b/admin/admin_forumauth_list.php
@@ -153,6 +153,7 @@ if ($submit) {
     }
 
     $datastore->update('cat_forums');
+    CACHE('bb_cache')->rm();
     bb_die($lang['FORUM_AUTH_UPDATED'] . '<br /><br />' . sprintf($lang['CLICK_RETURN_FORUMAUTH'], '<a href="admin_forumauth_list.php">', '</a>'));
 } // End of submit
 
diff --git a/filelist.php b/filelist.php
index f9792c989..8e256dc67 100644
--- a/filelist.php
+++ b/filelist.php
@@ -23,7 +23,7 @@ if (!$topic_id) {
     bb_die($lang['INVALID_TOPIC_ID'], 404);
 }
 
-$sql = 'SELECT t.attach_id, t.info_hash, t.info_hash_v2, t.size, ad.physical_filename
+$sql = 'SELECT t.forum_id, t.attach_id, t.info_hash, t.info_hash_v2, t.size, ad.physical_filename
         FROM ' . BB_BT_TORRENTS . ' t
         LEFT JOIN ' . BB_ATTACHMENTS_DESC . ' ad
         ON t.attach_id = ad.attach_id
@@ -34,6 +34,12 @@ if (!$row = DB()->fetch_row($sql)) {
     bb_die($lang['INVALID_TOPIC_ID_DB'], 404);
 }
 
+// Check rights
+$is_auth = auth(AUTH_ALL, $row['forum_id'], $userdata);
+if (!$is_auth['auth_view']) {
+    bb_die($lang['SORRY_AUTH_VIEW_ATTACH'], 403);
+}
+
 // Protocol meta
 $meta_v1 = !empty($row['info_hash']);
 $meta_v2 = !empty($row['info_hash_v2']);
diff --git a/index.php b/index.php
index 29548df6d..965378564 100644
--- a/index.php
+++ b/index.php
@@ -329,6 +329,10 @@ if ($bb_cfg['show_latest_news']) {
     $template->assign_vars(['SHOW_LATEST_NEWS' => true]);
 
     foreach ($latest_news as $news) {
+        if (in_array($news['forum_id'], $user->get_excluded_forums(AUTH_VIEW, 'array'))) {
+            continue;
+        }
+
         $template->assign_block_vars('news', [
             'NEWS_TOPIC_ID' => $news['topic_id'],
             'NEWS_TITLE' => str_short($wordCensor->censorString($news['topic_title']), $bb_cfg['max_news_title']),
@@ -348,6 +352,10 @@ if ($bb_cfg['show_network_news']) {
     $template->assign_vars(['SHOW_NETWORK_NEWS' => true]);
 
     foreach ($network_news as $net) {
+        if (in_array($net['forum_id'], $user->get_excluded_forums(AUTH_VIEW, 'array'))) {
+            continue;
+        }
+
         $template->assign_block_vars('net', [
             'NEWS_TOPIC_ID' => $net['topic_id'],
             'NEWS_TITLE' => str_short($wordCensor->censorString($net['topic_title']), $bb_cfg['max_net_title']),