'.t('Select one or more containers which limit access.')."
\n"; + // Special handling is required when this form is submitted. + $ret=system_settings_form($form); + $ret['#submit']['_cac_lite_admin_settings_submit'] = array(); + + return $ret; +} - $output .= system_settings_form('cac_lite_admin_settings', $form); - return $output; +/** + * This form submit callback ensures that the form values are saved, and also + * the node access database table is rebuilt. + */ +function _cac_lite_admin_settings_submit($form_id, $form_values) { + // First, save settings the default way. + system_settings_form_submit($form_id, $form_values); + // Next, rebuild the node_access table. + node_access_rebuild(); + drupal_set_message(t('The content access permissions have been rebuilt.')); } function cac_lite_admin_settings_defaults() { @@ -146,13 +161,20 @@ function cac_lite_admin_settings_default if (count($cids)) { $all_defaults = variable_get('cac_lite_default_grants', array()); $form['cac_lite_default_grants'] = - array('#tree' => true); + array('#tree' => true, + '#prefix' => '' + .t('For each role below, select the categories which members of the role are allowed to view.') + ."
\n" + .'' + .t('You may grant individual users access to categories in addition to those selected here. See the cac_lite tab on the user edit page.') + ."
\n" + ); foreach ($roles as $rid => $role_name) { $form['cac_lite_default_grants'][$rid] = array('#type' => 'fieldset', '#tree' => true, '#title' => t('Access for %role', array('%role' => $role_name)), - // '#description' => t('Users of the \'%role\' role will have these privileges in addition to rights you grant them individually.', array('%role' => $role_name)), + '#description' => t('Users of the \'%role\' role will have these privileges in addition to rights you grant them individually.', array('%role' => $role_name)), ); $defaults = $all_defaults[$rid]; foreach ($cids as $vid) { @@ -166,10 +188,7 @@ function cac_lite_admin_settings_default '<'.t('none').'>'); } } - $output .= ''.t('For each role below, select the categories which members of the role are allowed to view.')."
\n"; - $output .= ''.t('You may grant individual users access to categories in addition to those selected here. See the cac_lite tab on the user edit page.')."
\n"; - $output .= system_settings_form('cac_lite_admin_settings_defaults', $form); - return $output; + return system_settings_form($form); } else { print theme('page', @@ -228,124 +247,75 @@ function cac_lite_user($op, $edit, $acco } /** - * Implementation of hook_nodeapi(). + * Implementation of hook_node_access_records + * */ -function cac_lite_nodeapi(&$node, $op, $arg = 0) { - //drupal_set_message("cac_lite_nodeapi($op)"); // debug - switch ($op) { - case 'update': - case 'insert': - _cac_lite_node_save($node); - break; - case 'delete': - _cac_lite_node_delete($node); - break; - } -} - -function _cac_lite_node_save(&$node) { - //drupal_set_message(theme('devel', $node)); - // delete any old access control - db_query('DELETE FROM {node_access} WHERE nid=%d AND realm=\'%s\'', - $node->nid, - 'cac_lite'); - - $access_restricted = false; - - +function cac_lite_node_access_records($node) { // we are really interested only in the containers the admin has // selected for access control + + $grants = array(); + $cnids = variable_get('cac_lite_containers', null); if (!is_array($cnids) || !count($cnids)) { drupal_set_message(t('cac_lite module has been installed, but has not been configured.')); - return; + return $grants; } - // we want to restrict access to this node if the node itself is a term in a restriced category. - // will this work? we have to be called after the data is inserted into category_hierarchy! - // perhaps the new module weight can help us out here. TODO! + // We want to restrict access to this node if the node itself is a category in a restriced container + // We have to be called after the data is inserted into category_hierarchy! + // Perhaps the new module weight can help us out here. TODO! + $result = db_query("SELECT * FROM {category_hierarchy} WHERE cid=%d AND parent IN(%s)", $node->nid, implode(', ', $cnids)); + if (db_num_rows($result)) { - db_query('INSERT INTO {node_access} (nid, gid, realm, grant_view, grant_update, grant_delete) VALUES (%d, %d, \'%s\', %d, %d, %d)', - $node->nid, - $node->nid, - 'cac_lite', - 1, 0, 0); - $access_restricted = true; + // yes, this node is itself a category in this restricted container + $grants[] = array('realm' => 'cac_lite', + 'gid' => $node->nid, // use category id as grant id + 'grant_view' => TRUE); + $access_restricted = true; } - // find all categories associated with this node $node_categories = category_node_get_categories($node->nid, 'cid', true); if (count($node_categories) && count($cnids)) { - // here, we are restricting access to this node. - // let's first check that no other access control module has granted access to everyone - db_query('DELETE FROM {node_access} WHERE nid=%d AND gid = 0', - $node->nid); - // now grant our privileges - foreach ($node_categories as $cid => $category) { - if (in_array($category->cnid, $cnids)) { - // flag this node in node_access table - db_query('INSERT INTO {node_access} (nid, gid, realm, grant_view, grant_update, grant_delete) VALUES (%d, %d, \'%s\', %d, %d, %d)', - $node->nid, - $cid, - 'cac_lite', - 1, 0, 0); - $access_restricted = true; - } - } + foreach ($node_categories as $cid => $category) { + if (in_array($category->cnid, $cnids)) { + // the category tagged to this node is in a restricted container so + $grants[] = array('realm' => 'cac_lite', + 'gid' => $cid, + 'grant_view' => TRUE); + $access_restricted = true; + } + } } if (!$access_restricted && count($cnids) && count($node_categories)) { - // access has not been restricted by any of the categories this - // node is directly associated with. But what if this node - // belongs to a category whos access is restricted by an ancestor - // container? Here we attempt to restrict access in that case, by - // inheriting the same restrictions as the category we are - // associated with. - $cids = array_keys($node_categories); - $result = db_query("SELECT na.* from {node_access} na WHERE na.nid IN (%s)", implode(',', $cids)); - $gids = array(); - while ($data = db_fetch_object($result)) { - $gids[$data->gid] = $data->gid; - } - // if any of our categories are restricted access, we inherit the - // restriction - foreach ($gids as $gid) { - if ($gid != 0) { - db_query('INSERT INTO {node_access} (nid, gid, realm, grant_view, grant_update, grant_delete) VALUES (%d, %d, \'%s\', %d, %d, %d)', - $node->nid, - $gid, - 'cac_lite', - 1, 0, 0); - $access_restricted = true; - } - } - } - - if (!$access_restricted) { - // here, the access to the node is not restricted. At least not by this module. - // if no other module is restricting access, it's safe for us to grant access to everyone by inserting grant id 0 - $result = db_query('SELECT nid FROM {node_access} WHERE nid=%d AND gid != 0', - $node->nid); - if (!db_num_rows($result)) { - db_query('INSERT INTO {node_access} (nid, gid, realm, grant_view, grant_update, grant_delete) VALUES (%d, %d, \'%s\', %d, %d, %d)', - $node->nid, - 0, // gid = 0 means all users access - 'cac_lite', - 1, 0, 0); - - } - } -} - -function _cac_lite_node_delete(&$node) { - db_query('DELETE FROM {node_access} WHERE nid=%d AND realm=\'%s\'', - $node->nid, - 'cac_lite'); + // access has not been restricted by any of the categories this node is directly associated with. + // But what if this node belongs to a category whos access is restricted by an ancestor + // container? Here we attempt to restrict access in that case, by inheriting the same + // restrictions as the category we are associated with. + $cids = array_keys($node_categories); + $result = db_query("SELECT na.* from {node_access} na WHERE na.nid IN (%s)", implode(',', $cids)); + $gids = array(); + while ($data = db_fetch_object($result)) { + $gids[$data->gid] = $data->gid; + } + // if any of our categories are restricted access, we inherit the + // restriction + foreach ($gids as $gid) { + if ($gid != 0) { + $grants[] = array('realm' => 'cac_lite', + 'gid' => $gid, + 'grant_view' => TRUE); + $access_restricted = true; + } + } + } + return $grants; } /** @@ -378,18 +348,11 @@ function _cac_lite_user_tids(&$account) } function cac_lite_node_grants(&$account, &$op) { - // allow administrators to view all - // (relies on drupal's default entry in node_access table.) - if (user_access('administer_cac_lite')) - $all = array(0); - else - $all = array(-1); $grants = _cac_lite_user_tids($account); // TODO: differentiate between view, update, delete - return array('all' => $all, // this disables the default setting (view all) - 'cac_lite' => $grants); + return array('cac_lite' => $grants); } function cac_lite_db_rewrite_sql($query, $primary_table, $primary_field, $args) {