Index: webform.module =================================================================== RCS file: /cvs/drupal-contrib/contributions/modules/webform/webform.module,v retrieving revision 1.196.2.54 diff -u -r1.196.2.54 webform.module --- webform.module 8 Sep 2010 05:23:47 -0000 1.196.2.54 +++ webform.module 14 Sep 2010 16:14:44 -0000 @@ -481,6 +481,7 @@ 'access own webform submissions', 'edit own webform submissions', 'delete own webform submissions', + 'access all webform submission limits', ); } @@ -1182,7 +1183,7 @@ module_load_include('inc', 'webform', 'includes/webform.submissions'); // Disable the form if the limit is exceeded and page cache is not active. - if (($limit_exceeded = _webform_submission_limit_check($node)) && ($user->uid != 0 || variable_get('cache', 0) == 0)) { + if (($limit_exceeded = webform_submission_limit_check($node)) && ($user->uid != 0 || variable_get('cache', 0) == 0)) { $enabled = FALSE; } } @@ -1669,7 +1670,7 @@ if ($node->webform['submit_limit'] != -1) { // -1: Submissions are never throttled. module_load_include('inc', 'webform', 'includes/webform.submissions'); - if (!$finished && $limit_exceeded = _webform_submission_limit_check($node)) { + if (!$finished && $limit_exceeded = webform_submission_limit_check($node)) { $error = theme('webform_view_messages', $node, 0, 1, 0, $limit_exceeded, array_keys(user_roles())); form_set_error('', $error); return; Index: includes/webform.submissions.inc =================================================================== RCS file: /cvs/drupal-contrib/contributions/modules/webform/includes/webform.submissions.inc,v retrieving revision 1.18.2.12 diff -u -r1.18.2.12 webform.submissions.inc --- includes/webform.submissions.inc 8 Sep 2010 05:23:47 -0000 1.18.2.12 +++ includes/webform.submissions.inc 14 Sep 2010 16:14:44 -0000 @@ -429,11 +429,46 @@ * * @param $node * The webform node to be checked. + * @param $account + * Optional parameter. Specify the account you want to check the limit + * against. * @return * Boolean TRUE if the user has exceeded their limit. FALSE otherwise. */ -function _webform_submission_limit_check($node) { +function webform_submission_limit_check($node, $account = NULL) { global $user; + + // If the $account variable is populated, begin permission/validation checks + if (isset($account) && !empty($account)) { + if ($account->uid > 0) { + if ($user->uid != $account->uid) { + // Check if the user has the rights to check another user's submission limit + if (user_access('access all webform submission limits')) { + // The check can continue on the specified account + } + else { + // User doesn't have rights to perform the check + drupal_set_message(t('Access denied. You do not have permission to check another user\'s submission limit.'), 'warning'); + watchdog('webform', 'User %uid attempted to access submission limits for %aid.', array('%uid' => check_plain($user->uid), '%aid' => check_plain($account->uid)), WATCHDOG_WARNING); + return FALSE; + } + } + else { + // They're checking their own account. Assign global $user to $account + $account = $user; + } + } + else { + // Can't check the anonymous user limit. This limit is controlled by cookies in the browser. + drupal_set_message(t('Unable to check anonymous user submission limit.'), 'warning'); + return FALSE; + } + } + else { + // We're checking the current user + $account = $user; + } + // Check if submission limiting is enabled. if ($node->webform['submit_limit'] == '-1') { @@ -447,11 +482,11 @@ 'AND submitted > %d AND nid = %d AND is_draft = 0'; // Fetch all the entries from the database within the submit interval with this username and IP. - $num_submissions_database = db_result(db_query($query, $user->uid, ip_address(), $user->uid, ($node->webform['submit_interval'] != -1) ? (time() - $node->webform['submit_interval']) : $node->webform['submit_interval'], $node->nid)); + $num_submissions_database = db_result(db_query($query, $account->uid, ip_address(), $account->uid, ($node->webform['submit_interval'] != -1) ? (time() - $node->webform['submit_interval']) : $node->webform['submit_interval'], $node->nid)); // Double check the submission history from the users machine using cookies. $num_submissions_cookie = 0; - if ($user->uid == 0 && variable_get('webform_use_cookies', 0)) { + if ($account->uid == 0 && variable_get('webform_use_cookies', 0)) { $cookie_name = 'webform-' . $node->nid; if (isset($_COOKIE[$cookie_name]) && is_array($_COOKIE[$cookie_name])) { Index: .project =================================================================== RCS file: .project diff -N .project --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ .project 1 Jan 1970 00:00:00 -0000 @@ -0,0 +1,11 @@ + + + webform + + + + + + + +