|
1
|
<?php
|
|
2
|
|
|
3
|
/**
|
|
4
|
* @file
|
|
5
|
* Provides various callbacks for the whole core module integration.
|
|
6
|
* This is a copy of Entity API's functionality for use when Entity API isn't
|
|
7
|
* Enabled, and only works on view functions.
|
|
8
|
*/
|
|
9
|
|
|
10
|
/**
|
|
11
|
* Core hack to include entity api-esque 'access callback' functions to core
|
|
12
|
* entities without needing to rely on entity api.
|
|
13
|
* Exception: We don't touch file entity. You must have entity API enabled to
|
|
14
|
* view files.
|
|
15
|
*/
|
|
16
|
function _ctools_entity_access(&$entity_info, $entity_type) {
|
|
17
|
// If the access callback is already set, don't change anything.
|
|
18
|
if (isset($entity_info['access callback'])) {
|
|
19
|
return;
|
|
20
|
}
|
|
21
|
|
|
22
|
switch ($entity_type) {
|
|
23
|
case 'node':
|
|
24
|
// Sad panda, we don't use Entity API, lets manually add access callbacks.
|
|
25
|
$entity_info['access callback'] = 'ctools_metadata_no_hook_node_access';
|
|
26
|
break;
|
|
27
|
case 'user':
|
|
28
|
$entity_info['access callback'] = 'ctools_metadata_user_access';
|
|
29
|
break;
|
|
30
|
case 'comment':
|
|
31
|
if (module_exists('comment')) {
|
|
32
|
$entity_info['access callback'] = 'ctools_metadata_comment_access';
|
|
33
|
}
|
|
34
|
break;
|
|
35
|
case 'taxonomy_term':
|
|
36
|
if (module_exists('taxonomy')) {
|
|
37
|
$entity_info['access callback'] = 'ctools_metadata_taxonomy_access';
|
|
38
|
}
|
|
39
|
break;
|
|
40
|
case 'taxonomy_vocabulary':
|
|
41
|
if (module_exists('taxonomy')) {
|
|
42
|
$entity_info['access callback'] = 'ctools_metadata_taxonomy_access';
|
|
43
|
}
|
|
44
|
break;
|
|
45
|
}
|
|
46
|
}
|
|
47
|
|
|
48
|
/**
|
|
49
|
* Access callback for the node entity.
|
|
50
|
*
|
|
51
|
* This function does not implement hook_node_access(), thus it may not be
|
|
52
|
* called ctools_metadata_node_access().
|
|
53
|
*
|
|
54
|
* @see entity_access()
|
|
55
|
*
|
|
56
|
* @param $op
|
|
57
|
* The operation being performed. One of 'view', 'update', 'create' or
|
|
58
|
* 'delete'.
|
|
59
|
* @param $node
|
|
60
|
* A node to check access for. Must be a node object. Must have nid,
|
|
61
|
* except in the case of 'create' operations.
|
|
62
|
* @param $account
|
|
63
|
* The user to check for. Leave it to NULL to check for the global user.
|
|
64
|
*
|
|
65
|
* @throws EntityMalformedException
|
|
66
|
*
|
|
67
|
* @return boolean
|
|
68
|
* TRUE if access is allowed, FALSE otherwise.
|
|
69
|
*/
|
|
70
|
function ctools_metadata_no_hook_node_access($op, $node = NULL, $account = NULL) {
|
|
71
|
// First deal with the case where a $node is provided.
|
|
72
|
if (isset($node)) {
|
|
73
|
// If a non-default revision is given, incorporate revision access.
|
|
74
|
$default_revision = node_load($node->nid);
|
|
75
|
if ($node->vid !== $default_revision->vid) {
|
|
76
|
return _node_revision_access($node, $op, $account);
|
|
77
|
}
|
|
78
|
else {
|
|
79
|
return node_access($op, $node, $account);
|
|
80
|
}
|
|
81
|
}
|
|
82
|
// No node is provided. Check for access to all nodes.
|
|
83
|
if (user_access('bypass node access', $account)) {
|
|
84
|
return TRUE;
|
|
85
|
}
|
|
86
|
if (!user_access('access content', $account)) {
|
|
87
|
return FALSE;
|
|
88
|
}
|
|
89
|
if ($op == 'view' && node_access_view_all_nodes($account)) {
|
|
90
|
return TRUE;
|
|
91
|
}
|
|
92
|
return FALSE;
|
|
93
|
}
|
|
94
|
|
|
95
|
/**
|
|
96
|
* Access callback for the user entity.
|
|
97
|
*/
|
|
98
|
function ctools_metadata_user_access($op, $entity = NULL, $account = NULL, $entity_type) {
|
|
99
|
$account = isset($account) ? $account : $GLOBALS['user'];
|
|
100
|
// Grant access to the users own user account and to the anonymous one.
|
|
101
|
if (isset($entity) && $op != 'delete' && (($entity->uid == $account->uid && $entity->uid) || (!$entity->uid && $op == 'view'))) {
|
|
102
|
return TRUE;
|
|
103
|
}
|
|
104
|
if (user_access('administer users', $account) || user_access('access user profiles', $account) && $op == 'view' && $entity->status) {
|
|
105
|
return TRUE;
|
|
106
|
}
|
|
107
|
return FALSE;
|
|
108
|
}
|
|
109
|
|
|
110
|
/**
|
|
111
|
* Access callback for the comment entity.
|
|
112
|
*/
|
|
113
|
function ctools_metadata_comment_access($op, $entity = NULL, $account = NULL) {
|
|
114
|
// When determining access to a comment, if comment has an associated node,
|
|
115
|
// the user must be able to view the node in order to access the comment.
|
|
116
|
if (isset($entity->nid)) {
|
|
117
|
if (!node_access('view', node_load($entity->nid), $account)) {
|
|
118
|
return FALSE;
|
|
119
|
}
|
|
120
|
}
|
|
121
|
|
|
122
|
// Comment administrators are allowed to perform all operations on all
|
|
123
|
// comments.
|
|
124
|
if (user_access('administer comments', $account)) {
|
|
125
|
return TRUE;
|
|
126
|
}
|
|
127
|
|
|
128
|
// Unpublished comments can never be accessed by non-admins.
|
|
129
|
if (isset($entity->status) && $entity->status == COMMENT_NOT_PUBLISHED) {
|
|
130
|
return FALSE;
|
|
131
|
}
|
|
132
|
|
|
133
|
if (user_access('access comments', $account) && $op == 'view') {
|
|
134
|
return TRUE;
|
|
135
|
}
|
|
136
|
return FALSE;
|
|
137
|
}
|
|
138
|
|
|
139
|
/**
|
|
140
|
* Access callback for the taxonomy entities.
|
|
141
|
*/
|
|
142
|
function ctools_metadata_taxonomy_access($op, $entity = NULL, $account = NULL, $entity_type) {
|
|
143
|
if ($entity_type == 'taxonomy_vocabulary') {
|
|
144
|
return user_access('administer taxonomy', $account);
|
|
145
|
}
|
|
146
|
if (user_access('administer taxonomy', $account) || user_access('access content', $account) && $op == 'view') {
|
|
147
|
return TRUE;
|
|
148
|
}
|
|
149
|
return FALSE;
|
|
150
|
}
|
