From a1b1489973a53681991f51ba49f95b119e142acd Mon Sep 17 00:00:00 2001
From: Roderik Muit <rm@wyz.biz>
Date: Sun, 4 Mar 2012 05:22:09 +0100
Subject: [PATCH] fix role access checks on internationalized sites

---
 homebox.admin.inc |   12 ++++++------
 homebox.install   |   32 ++++++++++++++++++++++++++++++++
 homebox.module    |   12 +++---------
 3 files changed, 41 insertions(+), 15 deletions(-)

diff --git a/homebox.admin.inc b/homebox.admin.inc
index 146c3c7..1f21b0f 100644
--- a/homebox.admin.inc
+++ b/homebox.admin.inc
@@ -94,15 +94,15 @@ function homebox_admin_page($form, &$form_state, $page = FALSE) {
     '#default_value' => $page ? $page->settings['full'] : 0,
   );
 
-  $result = db_query('SELECT rid, name FROM {role} ORDER BY name');
+  $result = db_query('SELECT rid, name FROM {role} ORDER BY weight, name');
   $role_options = array();
   foreach ($result as $role) {
-    $role_options[$role->name] = $role->name;
+    $role_options[$role->rid] = $role->name;
   }
   $form['page']['options']['roles'] = array(
     '#type' => 'checkboxes',
     '#title' => t('Allow only certain roles to access the page'),
-    '#default_value' => $page && count($page->settings['roles']) ? $page->settings['roles'] : array('authenticated user'),
+    '#default_value' => $page && count($page->settings['roles']) ? $page->settings['roles'] : array(1),
     '#options' => $role_options,
     '#description' => t('Select which roles can view the page.'),
   );
@@ -339,9 +339,9 @@ function homebox_admin_form_to_page(&$page, $form_state) {
   $page->settings['full'] = (int) $form_state['values']['full'];
   $page->settings['roles'] = array();
 
-  foreach ($form_state['values']['roles'] as $role) {
-    if ($role) {
-      $page->settings['roles'][] = $role;
+  foreach ($form_state['values']['roles'] as $rid) {
+    if ($rid) {
+      $page->settings['roles'][] = $rid;
     }
   }
 }
diff --git a/homebox.install b/homebox.install
index f3a298e..667ef14 100644
--- a/homebox.install
+++ b/homebox.install
@@ -64,3 +64,35 @@ function homebox_uninstall() {
   variable_del('homebox_user_tab');
   variable_del('homebox_version');
 }
+
+/**
+ * Change 'roles' settings to use IDs instead of names.
+ */
+function homebox_update_7001() {
+  // Get array of untranslated role names to work with.
+  // This is what is currently stored.
+  $result = db_query('SELECT rid, name FROM {role} ORDER BY name');
+  $role_ids = array();
+  foreach ($result as $role) {
+    $role_ids[$role->name] = $role->rid;
+  }
+
+  $result = db_query('SELECT name, settings FROM {homebox_pages}');
+  foreach ($result as $record) {
+    $change = FALSE;
+    $settings = unserialize($record->settings);
+    if (isset($settings['roles'])) {
+      foreach ($settings['roles'] as $key => $rolename) {
+        if (isset($role_ids[$rolename])) {
+          // Change role name to id
+          $settings['roles'][$key] = $role_ids[$rolename];
+          $change = TRUE;
+        }
+      }
+    }
+    if ($change) {
+      $record->settings = serialize($settings);
+      drupal_write_record('homebox_pages', $record, 'name');
+    }
+  }
+}
diff --git a/homebox.module b/homebox.module
index 74dfb85..7cf18f0 100644
--- a/homebox.module
+++ b/homebox.module
@@ -1564,15 +1564,9 @@ function _homebox_user_access_view_homebox($page, $require_login = FALSE) {
   }
   // Check page object for role restrictions
   elseif ($page->settings['roles']) {
-    // Iterate each role to look for a match
-    foreach ($page->settings['roles'] as $role) {
-      if (array_search($role, $user->roles)) {
-        return TRUE;
-      }
-    }
-
-    // No matches on restricted role
-    return FALSE;
+    // See which Role IDs are also in the user object
+    $matching_roles = array_intersect($page->settings['roles'], array_keys($user->roles));
+    return !empty($matching_roles);
   }
   else {
     // If here, no access
-- 
1.7.5.4