--- /home/data/projects/tractortube/tractortube.com/sites/all/modules/hierarchical_select/hierarchical_select.module 2013-05-17 17:45:17.097845382 +0200 +++ hierarchical_select.module 2013-05-19 12:00:45.869565109 +0200 @@ -1,6 +1,6 @@ ($config['animation_delay'] == 0) ? (int) variable_get('hierarchical_select_animation_delay', 400) : $config['animation_delay'], 'cacheId' => $config['module'] . '_' . md5(serialize($config['params'])), 'renderFlatSelect' => (isset($config['render_flat_select'])) ? (int) $config['render_flat_select'] : 0, - 'createNewItems' => (isset($config['editability']['status'])) ? (int) $config['editability']['status'] : 0, - 'createNewLevels' => (isset($config['editability']['allow_new_levels'])) ? (int) $config['editability']['allow_new_levels'] : 0, + 'createNewItems' => ((user_access('edit terms in ' .(string)$config['params']['vid'])) && + isset($config['editability']['status'])) ? (int) $config['editability']['status'] : 0, + 'createNewLevels' => ((user_access('edit terms in ' .(string)$config['params']['vid'])) && + isset($config['editability']['allow_new_levels'])) ? (int) $config['editability']['allow_new_levels'] : 0, 'resizable' => (isset($config['resizable'])) ? (int) $config['resizable'] : 0, 'ajax_url' => url('hierarchical_select_ajax/' . implode('/', $element['#array_parents']) . '/' . $complete_form['form_build_id']['#value']), ), @@ -775,8 +777,11 @@ // When the special "create_new_item" value is passed in a level, replace // that level with an inline modal form to create a new item, and hide all // subsequent selects. - list($element, $creating_new_item) = _hs_process_render_create_new_item($element, $hierarchy); - + // but only if user has edit permission for that taxonomy + if (user_access('edit terms in ' .(string)$config['params']['vid'])) { + list($element, $creating_new_item) = _hs_process_render_create_new_item($element, $hierarchy); + } + // Render the dropbox, if enabled. // Automatically hides the "Add" button when creating a new item. // Automatically disables HS' selects when reaching the dropbox limit. @@ -1021,7 +1026,7 @@ // When: // - no input data was provided (through POST nor GET) // - or #value is set directly and not by a Hierarchical Select POST (and - // therefor set either manually or by another module), + // therefore set either manually or by another module), // then use the value of #default_value, or when available, of #value. if (empty($form_state['input']) || (!isset($element['#value']['hierarchical_select']) && !isset($element['#value']['dropbox']))) { $value = (isset($element['#value'])) ? $element['#value'] : $element['#default_value']; @@ -1552,6 +1557,8 @@ $special_items['none'] = array_keys(array_filter($config['special_items'], '_hierarchical_select_special_item_none')); } + // Permission to edit/insert taxonomy terms + $perm_edit_term = user_access('edit terms in ' .(string)$config['params']['vid']); // // Build the lineage. @@ -1656,8 +1663,10 @@ // Prepend a "" option to the root level when: // - the editability setting is enabled, and // - the hook is implemented (this is an optional hook), and - // - the allowed_levels setting allows to create new items at this level. + // - the allowed_levels setting allows to create new items at this level, and + // - the user is allowed /has permission) to edit the taxonomy terms. if ($config['editability']['status'] + && $perm_edit_term && module_hook($config['module'], 'hierarchical_select_create_item') && _hierarchical_select_create_new_item_is_allowed($config, 0) ) { @@ -1697,8 +1706,9 @@ // when: // - the editability setting is enabled, and // - the hook is implemented (this is an optional hook), and - // - the allowed_levels setting allows to create new items at this level. - if ($config['editability']['status'] && module_hook($config['module'], 'hierarchical_select_create_item')) { + // - the allowed_levels setting allows to create new items at this level, and + // - the user is allowed to edit taxonomy term. + if ($config['editability']['status'] && $perm_edit_term && module_hook($config['module'], 'hierarchical_select_create_item')) { for ($depth = 1; $depth <= $max_depth; $depth++) { $item_type = t($config['editability']['item_types'][$depth]); $item_type = (!empty($item_type)) ? $item_type : t('item'); @@ -1721,9 +1731,11 @@ // - this is not the root level (the root level already has this), and // - the editability setting is enabled, and // - the hook is implemented (this is an optional hook), and - // - the allowed_levels setting allows to create new items at this level. + // - the allowed_levels setting allows to create new items at this level, and + // - the user is allowed to edit taxonomy term. if ($depth > 0 && $config['editability']['status'] + && $perm_edit_term && module_hook($config['module'], 'hierarchical_select_create_item') && _hierarchical_select_create_new_item_is_allowed($config, $depth) ) { @@ -1761,8 +1773,10 @@ // Prepend a "" option to the current level when: // - the editability setting is enabled, and // - the hook is implemented (this is an optional hook), and - // - the allowed_levels setting allows to create new items at this level. + // - the allowed_levels setting allows to create new items at this level, and + // - the user is allowed to edit taxonomy term. if ($config['editability']['status'] + && $perm_edit_term && module_hook($config['module'], 'hierarchical_select_create_item') && _hierarchical_select_create_new_item_is_allowed($config, $depth) ) { @@ -1788,8 +1802,10 @@ // - the allow_new_levels setting is enabled // - an additional level is permitted by the max_levels setting // - the deepest item of the lineage is a valid item + // - the user is allowed to edit taxonomy term. // NOTE: this uses an optional hook, so we also check if it's implemented. if ($config['editability']['status'] + && $perm_edit_term && $config['editability']['allow_new_levels'] && ($config['editability']['max_levels'] == 0 || count($hierarchy->lineage) < $config['editability']['max_levels']) && module_invoke($config['module'], 'hierarchical_select_valid_item', end($hierarchy->lineage), $config['params'])