From 9b5328d888e02968815e091a3b113b0209fe939e Mon Sep 17 00:00:00 2001 From: Nils Asmussen Date: Wed, 3 Aug 2016 22:58:17 +0200 Subject: [PATCH] Don't validate merge request on server. Since we don't show the user invalid merge requests to send to the server, the user would have to handcraft such requests. Only admins can merge albums, which we trust anyway. So, let's remove this check. --- php/Modules/Album.php | 7 ------- 1 file changed, 7 deletions(-) diff --git a/php/Modules/Album.php b/php/Modules/Album.php index 06b40ab..0c91348 100644 --- a/php/Modules/Album.php +++ b/php/Modules/Album.php @@ -637,13 +637,6 @@ final class Album { $albumID = array_splice($albumIDs, 0, 1); $albumID = $albumID[0]; - // Ensure that we don't merge an album into its own subalbum - foreach($albumIDs as $id) { - foreach($this->getSubAlbums($id) as $sid) { - if($sid == $albumID) return false; - } - } - // Move photos $query = Database::prepare(Database::get(), "UPDATE ? SET album = ? WHERE album IN (?)", array(LYCHEE_TABLE_PHOTOS, $albumID, $this->albumIDs)); $result = Database::execute(Database::get(), $query, __METHOD__, __LINE__);