Index: cck_field_privacy.module =================================================================== --- cck_field_privacy.module (revision 351) +++ cck_field_privacy.module (working copy) @@ -94,119 +94,20 @@ } /** - * Implementation of hook_nodeapi(). - * Removes fields if a user does not have perms to view it. + * Implementation of hook_field_access(). */ -function cck_field_privacy_nodeapi(&$node, $op, $a3 = NULL, $a4 = NULL) { - global $user; - $deny = FALSE; - - if ($user->uid != $node->uid) { - $node_user = user_load(array('uid' => $node->uid)); - if ($op == 'view') { - //Check to see if the database table is in 'trouble' status - if (variable_get('cckfp_trouble', FALSE)) { - return; +function cck_field_privacy_field_access($op, $field, $account, $node) { + if ($op == 'view') { + if ($node != NULL) { + if (_cck_get_inaccessible_fields($account, $node, $field['field_name'])) { + return FALSE; } - //Assume we are 'all clear' first, and see if anything changes that status - $access_clear = TRUE; - $type = $node->type; - $permissions = array(); - $types = variable_get('cckfp_types', NULL); - //check node type is enabled - if (in_array($type, $types, TRUE)) { - $result = db_query("SELECT field_name, permission FROM {cckfp} WHERE uid = %d AND type_name = '%s' ORDER BY field_name DESC", $node->uid, $node->type); - - if ($result) { - //Put all of the permissions entries into an array so we can process them all at once. - while ($row = db_fetch_object($result)) { - $row->permission = unserialize($row->permission); - $permissions[$row->field_name] = $row; - } - foreach ($permissions as $field_name => $fieldpriv) { - //A permission setting exists, so let's handle the permissions - foreach ($fieldpriv->permission as $priv) { - $clear = _cck_field_privacy_access_check($priv, $node, $user, $node_user); - if ($clear) { - $access_clear = TRUE; - break; - } - else { - $access_clear = FALSE; - } - } - if ($access_clear == FALSE) { - $node->$field_name['#access'] = FALSE; - $node->content[$field_name]['#access'] = FALSE; - } - else { - //A fieldgroup may be clear for access, but its child fields may not. Check to see if the field is a group, then process its children. - if (is_array($node->content[$field_name]['group'])) { - $node_groups = fieldgroup_groups($node->type); - $group_fields = $node_groups[$field_name]['fields']; - - foreach ($group_fields as $child) { - if (array_key_exists($child['field_name'], $permissions)) { - //print_r($permissions[$child['field_name']]); - foreach ($permissions[$child['field_name']]->permission as $child_priv) { - $child_clear = _cck_field_privacy_access_check($child_priv, $node, $user, $node_user); - if ($child_clear) { - $child_access = TRUE; - break; - } - else { - $child_access = FALSE; - } - } - if ($child_access == FALSE) { - //$node->$field_name[$child['field_name']]['#access'] = FALSE; - $node->content[$field_name]['group'][$child['field_name']]['field']['#access'] = FALSE; - } - } - } - } - } - } - } - } } } + return TRUE; } /** - * Return a specific field's permission setting. - * @param $permission - * An object containing the field data from the cckfp database table - * @param $node - * A node object - * @param $user - * The current user object - * @param $node_user - * The user object corresponding to the node's author - * @return $access_clear - * A boolean stating whether or not the field has clear/open access - */ -function _cck_field_privacy_access_check($permission, $node, $user, $node_user) { - $access_clear = TRUE; - - if ($permission == 'everyone') { - } - else if ($permission == 'nobody') { - $access_clear = FALSE; - } - else{ - foreach (module_invoke_all('cck_field_privacy_access', $node_user, $user, $permission) as $access_result ) { - if (!$access_result) { - $access_clear=FALSE; - } - continue; - } - } - - return $access_clear; -} - -/** * Implementation of hook_form_alter(). */ function cck_field_privacy_form_alter(&$form, &$form_state, $form_id) { @@ -623,40 +524,46 @@ $active_fields = _cck_field_privacy_get_active_fields($node->type); // do expensive db check only if it's a privacy controlled field (and if field is specified only if the field requested is privacy controlled) - if (!empty($active_fields) && (is_null($field) || array_key_exists($field, $active_fields)) && $user->uid != $node->uid) { - $cached_result = $cached_results[$node->uid][$node->type]; + if (!empty($active_fields) && (is_null($field) || array_key_exists($field, $active_fields))) { + // Make sure node is full. May be empty if passed in through certain hooks. + if (is_null($node->uid)) + $node = node_load($node->nid); + if ($user->uid != $node->uid) { + + $cached_result = $cached_results[$node->uid][$node->type]; - if (isset($cached_result)) { - return is_null($field) ? $cached_result : isset($cached_result[$field]); - } - - $result = db_query("SELECT field_name, permission FROM {cckfp} WHERE uid = %d AND type_name = '%s' ORDER BY field_name DESC", $node->uid, $node->type); - - if ($result) { - while ($permissions = db_fetch_object($result)) { - if (is_array($permissions->permission)) { - foreach ($permissions->permission as $perm) { - if ($perm == 'everyone') { - continue; - } - else if ($perm == 'nobody') { - $inaccessible_fields[$permissions->field_name] = $permissions->field_name; - } - else if (!empty($perm)) { - $node_user = user_load(array('uid' => $node->uid)); - $plugin_access_result = module_invoke($perm, 'cck_field_privacy_access', $node_user, $user); - //Uncomment the next line to enable debug output to the watchdog when testing views access - //watchdog('cckfp', 'result of module '.$permissions->permission.' check: '.print_r($plugin_access_result, TRUE)); - if ($plugin_access_result === FALSE) { + if (isset($cached_result)) { + return is_null($field) ? $cached_result : isset($cached_result[$field]); + } + + $result = db_query("SELECT field_name, permission FROM {cckfp} WHERE uid = %d AND type_name = '%s' ORDER BY field_name DESC", $node->uid, $node->type); + + if ($result) { + while ($permissions = db_fetch_object($result)) { + if (is_array($permissions->permission)) { + foreach ($permissions->permission as $perm) { + if ($perm == 'everyone') { + continue; + } + else if ($perm == 'nobody') { $inaccessible_fields[$permissions->field_name] = $permissions->field_name; + } + else if (!empty($perm)) { + $node_user = user_load(array('uid' => $node->uid)); + $plugin_access_result = module_invoke($perm, 'cck_field_privacy_access', $node_user, $user); + //Uncomment the next line to enable debug output to the watchdog when testing views access + //watchdog('cckfp', 'result of module '.$permissions->permission.' check: '.print_r($plugin_access_result, TRUE)); + if ($plugin_access_result === FALSE) { + $inaccessible_fields[$permissions->field_name] = $permissions->field_name; + } } } } } } - } - $cached_results[$node->uid][$node->type] = $inaccessible_fields; - return is_null($field) ? $inaccessible_fields : isset($inaccessible_fields[$field]); + $cached_results[$node->uid][$node->type] = $inaccessible_fields; + return is_null($field) ? $inaccessible_fields : isset($inaccessible_fields[$field]); + } } } Index: cck_field_privacy.views.inc =================================================================== --- cck_field_privacy.views.inc (revision 351) +++ cck_field_privacy.views.inc (working copy) @@ -1,108 +0,0 @@ -field as $field_handler_name => &$field_handler) { - if (is_subclass_of($field_handler, 'content_handler_field')) { - // check if this field is cckfp enabled - only decorate cckfp enabled fields - $active_fields = _cck_field_privacy_get_active_fields(); - - // get the field name - $field_name = $field_handler->definition['content_field_name']; - - if (isset($active_fields[$field_name])) { - $cckfp_handler = new cckFieldPrivacyViewsFieldHandler($field_handler); - $view->field[$field_handler_name] = $cckfp_handler; - } - } - } -} - -/** - * Decorator for views cck field handler - content_handler_field - to control access to cckfp enabled fields - * @todo improve performance - this approach runs through the result set for each cck field in the view - */ -class cckFieldPrivacyViewsFieldHandler { - var $handler; - - /** - * constructor - saves reference to the decorated handler object - */ - function __construct( content_handler_field $handler ) { - $this->handler =& $handler; - } - - /** - * implement pre_render decorator to check field access and strip field data from results if access is not granted - */ - function pre_render($values) { - global $user; - - if (isset($this->handler->definition['content_field_name'])) { - // the cck field name - $cck_field_name = $this->handler->definition['content_field_name']; - - foreach ($values as $key => $value) { - $node = node_load($value->nid); - - // check if this instance of field is inaccessible to the current user - $inaccessible = _cck_get_inaccessible_fields($user, $node, $cck_field_name); - - if ($inaccessible === TRUE) { - //Uncomment the next line to enable debug output into the watchdog for testing if the cckfp module is blocking fields correctly. - //watchdog('cckfp', 'user '. $user->name .', should not see the '. $cck_field_name .' for node '. $node->title .' which belongs to '. $node->uid); - // not accessible - remove all data associated with this field - if (!$this->handler->defer_query) { - // remove the actual data if the data has already been loaded by the query - i.e. not defer_query - unset($values[$key]->{$this->handler->field_alias}); - } - else { - // data has not already been loaded by the query - // remove the data that the handler uses to build the field - // clone because the data may be shared with other handlers whose field in this row is accessible - $values[$key] = clone $values[$key]; - unset($values[$key]->{$this->handler->field_alias}); - } - } - } - } - - // pass on call to decorated handlers own pre_render method - if ( method_exists( $this->handler, 'pre_render' )) { - return call_user_func_array( array( $this->handler, 'pre_render' ), array($values) ); - } - } - - /** - * pass through gets to decorated object - */ - function __get( $var ) { - if ( isset( $this->handler->$var )) { - return $this->handler->$var; - } - return FALSE; - } - - /** - * pass through sets to decorated object - */ - function __set( $var, $val ) { - $this->handler->$var = $val; - } - - /** - * pass through all method calls that aren't implemented by this decorator - */ - function __call( $method, $arguments ) { - if ( method_exists( $this->handler, $method )) { - return call_user_func_array( array( $this->handler, $method ), $arguments ); - } - return FALSE; - } -}