Stable twin of #1147, filter half only.
Every filter token on /photos is an OR of two halves: what THIS viewer marked, and what ANYONE marked. The fields built from the second half are gated on show_feedback_to_guests; the filter was not, so with the setting off ?filter=liked still returned exactly the photos other people liked — the membership instead of the count, one token at a time.
The half it left standing was also the wrong half: it read guest_identifier from the guest_id query parameter, which never matched anything, and accepting a caller-supplied identifier was a way back through the gate. Resolved from the request now, hidden rows excluded to match what the viewer can see.
Not carried: the color: token and the photo_admin_marks concurrent-write fix — colour labels and admin marks are not on this branch.
Merged with admin privileges: the author cannot self-approve.
Paul Nothaft
eaa8b41ba3