Changeset 1498

Show
Ignore:
Timestamp:
12/24/07 11:40:57 (7 months ago)
Author:
ewout
Message:

Members of communities can now only edit their own content (blog posts and files).

Moderators can still edit everything. TODO: generalize the new permissions_check function
in elgglib so that we can modernize this to the new permission system.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • devel/mod/blog/lib/weblogs_actions.php

    r1401 r1498  
    7070            $exists = false; 
    7171            if ($oldpost = get_record('weblog_posts','ident',$post->ident)) { 
    72                 if (run("permissions:check", array("weblog:edit", $oldpost->owner))) { 
     72             if (run("permissions:check", array("weblog:edit", $oldpost->owner,$oldpost->weblog))) { 
    7373                    $exists = true; 
    7474                } 
    …… 
    132132        if (logged_on && !empty($id)) { 
    133133            if ($post_info = get_record('weblog_posts','ident',$id)) { 
    134                 if (run("permissions:check", array("weblog:edit", $post_info->owner))) { 
     134             if (run("permissions:check", array("weblog:edit", $post_info->owner),$post_info->weblog)) { 
    135135                    $post_info = plugin_hook("weblog_post","delete",$post_info); 
    136136                    if (!empty($post_info)) { 

  • devel/mod/blog/lib/weblogs_posts_add.php

    r1401 r1498  
    1919    $extensionContext = trim(optional_param('extension','weblog')); 
    2020 
    21     if (!run("permissions:check", array("weblog:edit",$profile_id))) { 
     21    if (!run("permissions:check", "weblog")) { // just check if the logged on user can add posts 
    2222      $messages[] = __gettext("Permission denied"); 
    2323      $messages[] = __gettext("You can modify only your own content!"); 

  • devel/mod/blog/lib/weblogs_posts_edit.php

    r1401 r1498  
    1313$extensionContext = trim(optional_param('extension','weblog')); 
    1414 
    15 if (!($aver=run("permissions:check", array("weblog:edit",$post->owner)))) { 
     15if (!($aver=run("permissions:check", array("weblog:edit",$post->owner,$post->weblog)))) { 
    1616    $messages[] = __gettext("Permission denied"); 
    1717    $messages[] = __gettext("You can modify only your own content!"); 

  • devel/mod/blog/lib/weblogs_posts_view.php

    r1395 r1498  
    121121    } 
    122122    // if ($post->owner == $_SESSION['userid'] && logged_on) { 
    123     if (run("permissions:check",array("weblog:edit",$post->owner))) { 
     123    if (run("permissions:check",array("weblog:edit",$post->owner,$post->weblog))) { 
    124124        $Edit = __gettext("Edit"); 
    125125        $Delete = __gettext("Delete"); 

  • devel/mod/community/lib/permissions_check.php

    r1248 r1498  
    3737    } else { 
    3838        switch($parameter[0]) { 
     39 
    3940        case    "files:edit": 
    4041        case    "weblog:edit": 
     42          // we need to know 2 things about file or post: its owner and the community it is 
     43          // posted to. 
    4144            $owner = $parameter[1]; 
    42             if (record_exists('users','ident',$owner,'owner',$USER->ident,'user_type','community')) { 
     45            if(isset($parameter[2])){ 
     46              $weblog=$parameter[2]; 
     47            } else { 
     48              $weblog=0; 
     49            } 
     50            // Here we only check wether the logged on user is the moderator of the community  
     51            // where the posts was made or file was uploaded ($weblog). 
     52            // Permission to edit their own content is granted in mod/blog/lib/permission_check.php and 
     53            // mod/file/lib/permission_check.php. 
     54            if (record_exists('users','ident',$weblog,'owner',$USER->ident,'user_type','community')) { 
    4355                $run_result = true; 
    4456            } 
    45             if (empty($run_result)) { 
    46                 if(run('community:membership',array($page_owner,$USER->ident))){ 
    47                     $run_result = true; 
    48                 } 
    49             } 
     57             
    5058            break; 
    5159        case    "userdetails:change":