'.t('While this module has been designed to be as simple as possible to use, there are several steps required to set it up.')."
\n"; $output .= "'.t('Select one or more containers which limit access.')."
\n"; + $containers = category_get_containers(); + if (!count($containers)) { + $form['body'] = array('#type' => 'markup', + '#value' => t('You must create a container before you can use cac_lite.'), + ); + return $form; + } + else { + $options = array(); + foreach (category_get_containers() as $key => $value) { + $options[$key] = $value->title; + } + + $form['cac_lite_containers'] = + array('#type' => 'select', + '#title' => 'Containers', + '#default_value' => variable_get('cac_lite_containers', null), + '#options' => $options, + '#description' => t('Select one or more containers to control privacy.'), + '#multiple' => true, + ); + + $ret = system_settings_form($form); + // Special handling is required when this form is submitted. + $ret['#submit']['_cac_lite_admin_settings_submit'] = array(); + return $ret; + } +} - $output .= system_settings_form('cac_lite_admin_settings', $form); - return $output; +/** + * This form submit callback ensures that the form values are saved, and also + * the node access database table is rebuilt. + */ +function _cac_lite_admin_settings_submit($form_id, $form_values) { + // First, save settings the default way. + system_settings_form_submit($form_id, $form_values); + // Next, rebuild the node_access table. + node_access_rebuild(); + drupal_set_message(t('The content access permissions have been rebuilt.')); } +/** + * Returns the form for role-based privileges. + */ function cac_lite_admin_settings_defaults() { $cids = variable_get('cac_lite_containers', null); @@ -166,14 +150,16 @@ function cac_lite_admin_settings_default '<'.t('none').'>'); } } - $output .= ''.t('For each role below, select the categories which members of the role are allowed to view.')."
\n"; - $output .= ''.t('You may grant individual users access to categories in addition to those selected here. See the cac_lite tab on the user edit page.')."
\n"; - $output .= system_settings_form('cac_lite_admin_settings_defaults', $form); - return $output; + + $form['header'] = array('#type' => 'markup', '#weight' => -1); + $form['header']['#value'] = ''.t('For each role below, select the categories which members of the role are allowed to view.')."
\n"; + $form['header']['#value'] .= ''.t('You may grant individual users access to categories in addition to those selected here. See the cac_lite tab on the user edit page.')."
\n"; + + return system_settings_form($form); } else { - print theme('page', - t('First select vocabularies on the cac_lite settings page.')); + return (array('body' => array('#type' => 'markup', + '#value' => t('First select containers on the cac_lite settings page.')))); } } /** @@ -214,7 +200,7 @@ function cac_lite_user($op, $edit, $acco $form['cac_lite'][0] = array('#type' => 'markup', '#value' => ''.t('You may grant this user view access to any of the terms below. These grants are in addition to !grant_per_role_link.', - array('!grant_per_role_link' => l(t('access granted to the user by virtue of his/her roles'), 'admin/access/cac_lite/roles'))) . "
\n", + array('!grant_per_role_link' => l(t('access granted to the user by virtue of his/her roles'), 'admin/user/access/cac_lite/roles'))) . "\n", '#weight' => -1); $form['cac_lite']['cac_lite']['#tree'] = true; return $form; @@ -228,125 +214,49 @@ function cac_lite_user($op, $edit, $acco } /** - * Implementation of hook_nodeapi(). + * Implementation of hook_node_access_records + * */ -function cac_lite_nodeapi(&$node, $op, $arg = 0) { - //drupal_set_message("cac_lite_nodeapi($op)"); // debug - switch ($op) { - case 'update': - case 'insert': - _cac_lite_node_save($node); - break; - case 'delete': - _cac_lite_node_delete($node); - break; - } -} - -function _cac_lite_node_save(&$node) { - //drupal_set_message(theme('devel', $node)); - // delete any old access control - db_query('DELETE FROM {node_access} WHERE nid=%d AND realm=\'%s\'', - $node->nid, - 'cac_lite'); - - $access_restricted = false; - +function cac_lite_node_access_records($node) { + $grants = array(); - // we are really interested only in the containers the admin has - // selected for access control + // just the vocabs we're interested in $cnids = variable_get('cac_lite_containers', null); - - if (!is_array($cnids) || !count($cnids)) { - drupal_set_message(t('cac_lite module has been installed, but has not been configured.')); - return; + if (count($cnids)) { + // first, is this node a category. If so, maybe it needs to have access restricted. + // is this query a reasonable way to determine this? + $result = db_query("SELECT * FROM {category_hierarchy} WHERE cid=%d AND parent IN(%s)", + $node->nid, implode(', ', $cnids)); + if (db_num_rows($result)) { + // yes, this node itself is a protected category + $grants[] = array('realm' => 'cac_lite', + 'gid' => $node->nid, + 'grant_view' => TRUE); + } } - - // we want to restrict access to this node if the node itself is a term in a restriced category. - // will this work? we have to be called after the data is inserted into category_hierarchy! - // perhaps the new module weight can help us out here. TODO! - $result = db_query("SELECT * FROM {category_hierarchy} WHERE cid=%d AND parent IN(%s)", - $node->nid, implode(', ', $cnids)); - if (db_num_rows($result)) { - db_query('INSERT INTO {node_access} (nid, gid, realm, grant_view, grant_update, grant_delete) VALUES (%d, %d, \'%s\', %d, %d, %d)', - $node->nid, - $node->nid, - 'cac_lite', - 1, 0, 0); - $access_restricted = true; + else { + // Let user know they have not configured this module. + drupal_set_message(t('cac_lite module has been installed, but has not been configured.')); } - - - // find all categories associated with this node - $node_categories = category_node_get_categories($node->nid, 'cid', true); + + // all categories associated with this node + $node_categories = category_node_get_categories($node->nid, 'cid', TRUE); if (count($node_categories) && count($cnids)) { - // here, we are restricting access to this node. - // let's first check that no other access control module has granted access to everyone - db_query('DELETE FROM {node_access} WHERE nid=%d AND gid = 0', - $node->nid); - // now grant our privileges - foreach ($node_categories as $cid => $category) { - if (in_array($category->cnid, $cnids)) { - // flag this node in node_access table - db_query('INSERT INTO {node_access} (nid, gid, realm, grant_view, grant_update, grant_delete) VALUES (%d, %d, \'%s\', %d, %d, %d)', - $node->nid, - $cid, - 'cac_lite', - 1, 0, 0); - $access_restricted = true; - } - } - } - - if (!$access_restricted && count($cnids) && count($node_categories)) { - // access has not been restricted by any of the categories this - // node is directly associated with. But what if this node - // belongs to a category whos access is restricted by an ancestor - // container? Here we attempt to restrict access in that case, by - // inheriting the same restrictions as the category we are - // associated with. - $cids = array_keys($node_categories); - $result = db_query("SELECT na.* from {node_access} na WHERE na.nid IN (%s)", implode(',', $cids)); - $gids = array(); - while ($data = db_fetch_object($result)) { - $gids[$data->gid] = $data->gid; - } - // if any of our categories are restricted access, we inherit the - // restriction - foreach ($gids as $gid) { - if ($gid != 0) { - db_query('INSERT INTO {node_access} (nid, gid, realm, grant_view, grant_update, grant_delete) VALUES (%d, %d, \'%s\', %d, %d, %d)', - $node->nid, - $gid, - 'cac_lite', - 1, 0, 0); - $access_restricted = true; - } - } - } - - if (!$access_restricted) { - // here, the access to the node is not restricted. At least not by this module. - // if no other module is restricting access, it's safe for us to grant access to everyone by inserting grant id 0 - $result = db_query('SELECT nid FROM {node_access} WHERE nid=%d AND gid != 0', - $node->nid); - if (!db_num_rows($result)) { - db_query('INSERT INTO {node_access} (nid, gid, realm, grant_view, grant_update, grant_delete) VALUES (%d, %d, \'%s\', %d, %d, %d)', - $node->nid, - 0, // gid = 0 means all users access - 'cac_lite', - 1, 0, 0); - - } + // If here, the node has categories associated with it. We need to check if these terms control privacy. + foreach ($node_categories as $cid => $category) { + if (in_array($category->cnid, $cnids)) { + // Yes, the term affects privacy + $grants[] = array('realm' => 'cac_lite', + 'gid' => $cid, + 'grant_view' => TRUE, + ); + } + } } + return $grants; } -function _cac_lite_node_delete(&$node) { - db_query('DELETE FROM {node_access} WHERE nid=%d AND realm=\'%s\'', - $node->nid, - 'cac_lite'); -} /** * Return the term ids of terms this user is allowed to access @@ -354,7 +264,7 @@ function _cac_lite_node_delete(&$node) { function _cac_lite_user_tids(&$account) { $grants = array(); if (count($account->cac_lite)) { - // $account->cac_lite is array. Keys are vids, values are array of tids within that vocabulary, to which the user has access + // $account->cac_lite is array. Keys are cnids, values are array of tids within that vocabulary, to which the user has access foreach ($account->cac_lite as $tids) { $grants = array_merge($grants, $tids); } @@ -378,20 +288,18 @@ function _cac_lite_user_tids(&$account) } function cac_lite_node_grants(&$account, &$op) { - // allow administrators to view all - // (relies on drupal's default entry in node_access table.) - if (user_access('administer_cac_lite')) - $all = array(0); - else - $all = array(-1); - - $grants = _cac_lite_user_tids($account); - - // TODO: differentiate between view, update, delete - return array('all' => $all, // this disables the default setting (view all) - 'cac_lite' => $grants); + // cac_lite deals only with 'view' permission + if ($op == 'view') { + $grants = _cac_lite_user_tids($account); + return array('cac_lite' => $grants); + } } +/** + * hook_db_rewrite_sql + * + * When querying for lists of categories, we use this hook to hide protected ones. + */ function cac_lite_db_rewrite_sql($query, $primary_table, $primary_field, $args) { global $user; @@ -401,37 +309,41 @@ function cac_lite_db_rewrite_sql($query, } // the vocabularies containing protected info. - $vids = variable_get('cac_lite_containers', array(0)); - + $cnids = variable_get('cac_lite_containers', array(0)); + // the terms this user is allowed to see $tids = _cac_lite_user_tids($user); - + switch ($primary_field) { - case 'cid': - // prevent users from seeing terms they do not have permission to read. - // this is called during category_get_tree, and possibly other cases. - - // this first clause prevents a user from seeing categories in - // protected containers. Recently a change was made so that the - // categories inherit the node access restrictions of parents, - // making this clause probably unnecessary. Worth looking into - // later. For now I do not want to change working code. - $join = "LEFT JOIN {category} ca_c ON $primary_table.cid = ca_c.cid"; - $where = "($primary_table.cid IN (". implode(', ', $tids) .") OR ca_c.cnid NOT IN (". implode(',', $vids) ."))"; - - // Categories are also nodes. So we need a clause that inspects - // the node_access table to see if the user can see these - // categories. Because category_get_tree constructs a query where - // the primary table is category instead of node. In my opinion - // that is a mistake and will trip up other node_access modules as - // well. - $join .= " LEFT JOIN {node_access} cac_lite_na ON $primary_table.cid = cac_lite_na.nid"; - $where .= " AND cac_lite_na.gid IN (".implode(',', $tids).")"; - - return array('join' => $join, 'where' => $where); - break; - + case 'cid': + $join = ''; + $where = ''; + // prevent users from seeing terms they do not have permission to read. + // this is called during category_get_tree, and possibly other cases. + + // this first clause prevents a user from seeing categories in + // protected containers. Recently a change was made so that the + // categories inherit the node access restrictions of parents, + // making this clause probably unnecessary. Worth looking into + // later. For now I do not want to change working code. + if (count($tids) && count($cnids)) { + $join .= "LEFT JOIN {category} ca_c ON $primary_table.cid = ca_c.cid"; + $where .= "($primary_table.cid IN (". implode(', ', $tids) .") OR ca_c.cnid NOT IN (". implode(',', $cnids) ."))"; + } + // Categories are also nodes. So we need a clause that inspects + // the node_access table to see if the user can see these + // categories. Because category_get_tree constructs a query where + // the primary table is category instead of node. In my opinion + // that is a mistake and will trip up other node_access modules as + // well. + if (count($tids)) { + $join .= " LEFT JOIN {node_access} cac_lite_na ON $primary_table.cid = cac_lite_na.nid"; + $where .= " AND cac_lite_na.gid IN (".implode(',', $tids).")"; + } + return array('join' => $join, 'where' => $where); + break; + } } -?> +?> \ No newline at end of file