From 6fd1030c5d9fff9059cd1284f7dee272dd82cead Mon Sep 17 00:00:00 2001
From: DariusIII <dkrisan@gmail.com>
Date: Mon, 6 Jan 2020 00:07:16 +0100
Subject: [PATCH] Fix access to user profiles as admin. Closes #1058

---
 Changelog                                  |  2 ++
 app/Http/Controllers/ProfileController.php |  9 +++++++--
 resources/views/themes/Gentele/profile.tpl | 14 +++++++-------
 3 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/Changelog b/Changelog
index b7ba8bfab..e8e87e6b8 100755
--- a/Changelog
+++ b/Changelog
@@ -1,3 +1,5 @@
+2020-01-06 DariusIII
+	* Fix: Fix access to user profiles as admin
 2020-01-02 DariusIII
 	* Chg: Add ElasticSearch support
 2019-12-30 DariusIII
diff --git a/app/Http/Controllers/ProfileController.php b/app/Http/Controllers/ProfileController.php
index aedd1fb1a..08fedd43d 100644
--- a/app/Http/Controllers/ProfileController.php
+++ b/app/Http/Controllers/ProfileController.php
@@ -43,12 +43,17 @@ class ProfileController extends BasePageController
             if ($altID === false && $altUsername !== false) {
                 $user = User::getByUsername($altUsername);
                 if ($user) {
+                    $this->userdata = $user;
                     $altID = $user['id'];
                     $userID = $altID;
                 }
             } elseif ($altID !== false) {
-                $userID = $altID;
-                $publicView = true;
+                $user = User::find($altID);
+                if ($user) {
+                    $this->userdata = $user;
+                    $userID = $altID;
+                    $publicView = true;
+                }
             }
         }
 
diff --git a/resources/views/themes/Gentele/profile.tpl b/resources/views/themes/Gentele/profile.tpl
index 6b4383e84..5bfe98637 100755
--- a/resources/views/themes/Gentele/profile.tpl
+++ b/resources/views/themes/Gentele/profile.tpl
@@ -33,7 +33,7 @@
                                                         <th width="200">Username</th>
                                                         <td>{$user.username|escape:"htmlall"}</td>
                                                     </tr>
-                                                    {if isset($isadmin) || !$publicview}
+                                                    {if (isset($isadmin) && $isadmin === "true") || !$publicview}
                                                         <tr>
                                                             <th width="200" title="Not public">E-mail</th>
                                                             <td>{$user.email}</td>
@@ -135,7 +135,7 @@
                                                             </td>
                                                         </tr>
                                                     {/if}
-                                                    {if isset($isadmin) || !$publicview}
+                                                    {if (isset($isadmin) && $isadmin === "true") || !$publicview}
                                                         <tr>
                                                             <th title="Not public">API/RSS Key</th>
                                                             <td>
@@ -149,14 +149,14 @@
                                                             <th title="Admin Notes">Notes:</th>
                                                             <td>{$user.notes|escape:htmlall}{if $user.notes|count_characters > 0}
                                                                     <br/>
-                                                                {/if}{if isset($isadmin)}<a
+                                                                {/if}{if (isset($isadmin) && $isadmin === "true")}<a
                                                                     href="{{url("/admin/user-edit.php?id={$user.id}#notes")}}"
                                                                     class="badge badge-info">Add/Edit</a>{/if}</td>
                                                         </tr>
                                                     {/if}
                                                     </tbody>
                                                 </table>
-                                                {if ($user.id == $userdata.id || $isadmin) && $site->registerstatus == 1}
+                                                {if ($user.id === $userdata.id || $isadmin === "true") && $site->registerstatus == 1}
                                                     <table class="data data table table-striped">
                                                         <tbody>
                                                         <tr class="bg-blue-sky">
@@ -206,7 +206,7 @@
                                                         </tbody>
                                                     </table>
                                                 {/if}
-                                                {if isset($isadmin) && $downloadlist|@count > 0}
+                                                {if (isset($isadmin) && $isadmin === "true") && $downloadlist|@count > 0}
                                                     <table class="data data table table-striped">
                                                         <tbody>
                                                         <tr class="bg-blue-sky">
@@ -244,11 +244,11 @@
                                 </li>
                             </ul>
                         </div>
-                        {if isset($isadmin) || !$publicview}
+                        {if (isset($isadmin) && $isadmin === "true") || !$publicview}
                             <a class="btn btn-success" href="{{route("profileedit")}}">Edit
                                 Profile</a>
                         {/if}
-                        {if !isset($isadmin)}
+                        {if $isadmin === "false" && !$publicview}
                             <a class="btn btn-warning confirm_action"
                                href="{{url("profile_delete?id={$user.id}")}}">Delete your account</a>
                         {/if}