Index: buddylist.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/buddylist/buddylist.module,v
retrieving revision 1.83
diff -u -p -r1.83 buddylist.module
--- buddylist.module	2 Jan 2007 14:41:17 -0000	1.83
+++ buddylist.module	2 Jan 2007 17:45:11 -0000
@@ -71,7 +71,7 @@ array('@userprofiles' => url('profile'),
  * Implementation of hook_perm
  */
 function buddylist_perm() {
-  return array('maintain buddy list', 'view buddy lists');
+  return array('maintain buddy list', 'view all buddy lists', 'view buddies\' buddy list');
 }
 
 /**
@@ -128,7 +128,7 @@ function buddylist_menu($may_cache) {
     );
 
     // 'view only' tabs
-    $viewAccess = (($id == $user->uid) || user_access('view buddy lists'));
+    $viewAccess = buddylist_view_access($id);
     $items[] = array(
       'path' => 'buddylist/'. $id .'/buddies',
       'title' => t('@Buddies', buddylist_translation()),
@@ -474,8 +474,7 @@ function buddylist_user($type, &$edit, &
  * @param $buddy_of If set to TRUE, a formatted list of users is returned, for whom this user is a buddy.
  */
 function buddylist_get_buddylist($user, $buddy_of = FALSE) {
-
-	if (user_access('view buddy lists') && !$buddy_of) {
+	if (buddylist_view_access($user->uid) && !$buddy_of) {
     $i = 0;
     if ($buddies = buddylist_get_buddies($user->uid)) {
       foreach(array_keys($buddies) as $buddy) {
@@ -489,7 +488,7 @@ function buddylist_get_buddylist($user, 
       return theme('user_list', $listbuddies);
     }
 	}
-  else if (user_access('view buddy lists') && !variable_get('buddylist_require_approval', 0)) {
+  else if (buddylist_view_access($user->uid) && !variable_get('buddylist_require_approval', 0)) {
     // This portion of code is used to see if this $thisuser is a buddy of others and, if s/he is, returns a list
     // of people s/he is a buddy of.
     // Note the distinction between having a buddy and being someone else's buddy (i.e., 'buddyof')
@@ -1308,6 +1307,15 @@ function buddylist_deletebuddy($uid) {
   drupal_goto();
 }
 
+function buddylist_view_access($bid) {
+  global $user;
+  return ($user->uid == $bid) || user_access('view all buddy lists') || (user_access('view buddies\' buddy list') && buddylist_is_buddy($user->uid,$bid));
+}
+
+function buddylist_is_buddy($uid,$bid) {
+  $isbuddy = db_result(db_query("SELECT * FROM {buddylist} WHERE uid = %d AND buddy = %d",$uid, $bid));
+  return $isbuddy;
+}
 /**
  * Confirm and add a buddy.
  */