From 43bfd48fa9091c695025e532d5585c9ea7ae1891 Mon Sep 17 00:00:00 2001
From: veselcraft <veselcraft@icloud.com>
Date: Wed, 22 Dec 2021 16:42:02 +0300
Subject: [PATCH] Groups, Users: Fix right for Groups and Friends list

---
 Web/Presenters/templates/User/Friends.xml | 62 ++++++++++++-----------
 Web/Presenters/templates/User/Groups.xml  |  2 +-
 2 files changed, 33 insertions(+), 31 deletions(-)

diff --git a/Web/Presenters/templates/User/Friends.xml b/Web/Presenters/templates/User/Friends.xml
index e6c9f50c..94a5f524 100644
--- a/Web/Presenters/templates/User/Friends.xml
+++ b/Web/Presenters/templates/User/Friends.xml
@@ -81,35 +81,37 @@
 {/block}
 
 {block actions}
-    {var subStatus = $x->getSubscriptionStatus($thisUser)}
-    {if $subStatus === 0}
-        <form action="/setSub/user" method="post" class="profile_link_form">
-            <input type="hidden" name="act" value="add" />
-            <input type="hidden" name="id"  value="{$x->getId()}" />
-            <input type="hidden" name="hash" value="{$csrfToken}" />
-            <input type="submit" class="profile_link" value="{_"friends_add"}" />
-        </form>
-    {elseif $subStatus === 1}
-        <form action="/setSub/user" method="post" class="profile_link_form">
-            <input type="hidden" name="act" value="add" />
-            <input type="hidden" name="id"  value="{$x->getId()}" />
-            <input type="hidden" name="hash" value="{$csrfToken}" />
-            <input type="submit" class="profile_link" value="{_"friends_accept"}" />
-        </form>
-    {elseif $subStatus === 2}
-        <form action="/setSub/user" method="post" class="profile_link_form">
-            <input type="hidden" name="act" value="rem" />
-            <input type="hidden" name="id"  value="{$x->getId()}" />
-            <input type="hidden" name="hash" value="{$csrfToken}" />
-            <input type="submit" class="profile_link" value="{_"friends_reject"}" />
-        </form>
-    {elseif $subStatus === 3}
-        <a href="/im?sel={$x->getId()}" class="profile_link">{_"send_message"}</a>
-        <form action="/setSub/user" method="post" class="profile_link_form">
-            <input type="hidden" name="act" value="rem" />
-            <input type="hidden" name="id"  value="{$x->getId()}" />
-            <input type="hidden" name="hash" value="{$csrfToken}" />
-            <input type="submit" class="profile_link" value="{_"friends_delete"}" />
-        </form>
+    {if $x->getId() !== $thisUser->getId()}
+        {var subStatus = $x->getSubscriptionStatus($thisUser)}
+        {if $subStatus === 0}
+            <form action="/setSub/user" method="post" class="profile_link_form">
+                <input type="hidden" name="act" value="add" />
+                <input type="hidden" name="id"  value="{$x->getId()}" />
+                <input type="hidden" name="hash" value="{$csrfToken}" />
+                <input type="submit" class="profile_link" value="{_"friends_add"}" />
+            </form>
+        {elseif $subStatus === 1}
+            <form action="/setSub/user" method="post" class="profile_link_form">
+                <input type="hidden" name="act" value="add" />
+                <input type="hidden" name="id"  value="{$x->getId()}" />
+                <input type="hidden" name="hash" value="{$csrfToken}" />
+                <input type="submit" class="profile_link" value="{_"friends_accept"}" />
+            </form>
+        {elseif $subStatus === 2}
+            <form action="/setSub/user" method="post" class="profile_link_form">
+                <input type="hidden" name="act" value="rem" />
+                <input type="hidden" name="id"  value="{$x->getId()}" />
+                <input type="hidden" name="hash" value="{$csrfToken}" />
+                <input type="submit" class="profile_link" value="{_"friends_reject"}" />
+            </form>
+        {elseif $subStatus === 3}
+            <a href="/im?sel={$x->getId()}" class="profile_link">{_"send_message"}</a>
+            <form action="/setSub/user" method="post" class="profile_link_form">
+                <input type="hidden" name="act" value="rem" />
+                <input type="hidden" name="id"  value="{$x->getId()}" />
+                <input type="hidden" name="hash" value="{$csrfToken}" />
+                <input type="submit" class="profile_link" value="{_"friends_delete"}" />
+            </form>
+        {/if}
     {/if}
 {/block}
diff --git a/Web/Presenters/templates/User/Groups.xml b/Web/Presenters/templates/User/Groups.xml
index 29ad35be..ad80222c 100644
--- a/Web/Presenters/templates/User/Groups.xml
+++ b/Web/Presenters/templates/User/Groups.xml
@@ -52,7 +52,7 @@
 {/block}
 
 {var clubPinned = $thisUser->isClubPinned($x)}
-{if $clubPinned || $thisUser->getPinnedClubCount() <= 10 || $x->canBeModifiedBy($thisUser ?? NULL)}
+{if $x->canBeModifiedBy($thisUser ?? NULL) || $clubPinned || $thisUser->getPinnedClubCount() <= 10}
     {block actions}
         <a class="profile_link" href="/groups_pin?club={$x->getId()}&hash={rawurlencode($csrfToken)}" id="_pinGroup" data-group-name="{$x->getName()}" data-group-url="{$x->getUrl()}">
             {if $clubPinned}