diff --git a/includes/node.inc b/includes/node.inc index a42cc0232cc..01f5c17a0ed 100644 --- a/includes/node.inc +++ b/includes/node.inc @@ -1,31 +1,10 @@ status == 1) || user_access("administer nodes"); -} - function node_get_comments($nid) { $comment = db_fetch_object(db_query("SELECT COUNT(c.lid) AS number FROM node n LEFT JOIN comments c ON n.nid = c.lid WHERE n.nid = '$nid' GROUP BY n.nid")); return $comment->number ? $comment->number : 0; @@ -210,21 +189,21 @@ function node_save($node, $filter) { } -function node_delete($conditions) { +function node_delete($node) { - if ($node = node_load($conditions)) { - - // delete the node and its comments: - db_query("DELETE FROM node WHERE nid = '$node->nid'"); - db_query("DELETE FROM comments WHERE lid = '$node->nid'"); - db_query("DELETE FROM moderate WHERE nid = '$node->nid'"); - - // call the node specific callback (if any): - module_invoke($node->type, "delete", &$node); - - watchdog("special", "node: deleted '$node->title'"); + if (is_array($node)) { + $node = node_object($node); } + // delete the node and its comments: + db_query("DELETE FROM node WHERE nid = '$node->nid'"); + db_query("DELETE FROM comments WHERE lid = '$node->nid'"); + db_query("DELETE FROM moderate WHERE nid = '$node->nid'"); + + // call the node specific callback (if any): + module_invoke($node->type, "delete", &$node); + + watchdog("special", "node: deleted '$node->title'"); } function node_view($node, $main = 0) { diff --git a/modules/aggregator.module b/modules/aggregator.module index 51de2e52af6..0c3c16b1aa2 100644 --- a/modules/aggregator.module +++ b/modules/aggregator.module @@ -497,7 +497,7 @@ function import_page_last() { $output .= ""; while ($item = db_fetch_object($result)) { - $links[] = "iid\">". t("blog it") .""; + $links[] = "iid\">". t("blog it") .""; $links[] = "fid\">". t("feed") .""; if ($item->link) { @@ -530,7 +530,7 @@ function import_page_feed($fid) { $output .= "
"; while ($item = db_fetch_object($result)) { - $links[] = "iid\">". t("blog it") .""; + $links[] = "iid\">". t("blog it") .""; $links[] = "link\">". t("visit") .""; if ($item->link) { @@ -564,7 +564,7 @@ function import_page_bundle($bid) { $output .= "
"; while ($item = db_fetch_object($result)) { - $links[] = "iid\">". t("blog it") .""; + $links[] = "iid\">". t("blog it") .""; $links[] = "fid\">". t("feed") .""; $links[] = "link\">". t("visit") .""; diff --git a/modules/aggregator/aggregator.module b/modules/aggregator/aggregator.module index 51de2e52af6..0c3c16b1aa2 100644 --- a/modules/aggregator/aggregator.module +++ b/modules/aggregator/aggregator.module @@ -497,7 +497,7 @@ function import_page_last() { $output .= "
"; while ($item = db_fetch_object($result)) { - $links[] = "iid\">". t("blog it") .""; + $links[] = "iid\">". t("blog it") .""; $links[] = "fid\">". t("feed") .""; if ($item->link) { @@ -530,7 +530,7 @@ function import_page_feed($fid) { $output .= "
"; while ($item = db_fetch_object($result)) { - $links[] = "iid\">". t("blog it") .""; + $links[] = "iid\">". t("blog it") .""; $links[] = "link\">". t("visit") .""; if ($item->link) { @@ -564,7 +564,7 @@ function import_page_bundle($bid) { $output .= "
"; while ($item = db_fetch_object($result)) { - $links[] = "iid\">". t("blog it") .""; + $links[] = "iid\">". t("blog it") .""; $links[] = "fid\">". t("feed") .""; $links[] = "link\">". t("visit") .""; diff --git a/modules/blog.module b/modules/blog.module index 97c9a8559a7..a0489928bdd 100644 --- a/modules/blog.module +++ b/modules/blog.module @@ -1,6 +1,35 @@ "personal blog"); + + return $info[$field]; +} + +function blog_access($op, $node) { + global $user; + + if ($op == "view") { + return $node->nid && $node->status && !$node->moderate; + } + + if ($op == "create") { + return $user->uid; + } + + if ($op == "update") { + return user_access("administer nodes") || ($user->uid == $node->uid); + } + + if ($op == "delete") { + return user_access("administer nodes") || ($user->uid == $node->uid); + } + +} + function blog_help() { ?>

Drupal's blog module allows registered users to maintain an online blog or diary. It provides easy-to-write and easy-to-read online diaries or journals that can be filled with daily thoughts, poetry, boneless blabber, spiritual theories, intimate details, valuable experiences, cynical rants, semi-coherent comments, writing experiments, artistic babblings, critics on current facts, fresh insights, diverse dreams, chronicles and mumbling madness available for public consumption.

@@ -94,7 +123,7 @@ function blog_page_user($uid = 0, $date = 0) { } if ($user->uid && user_access("post blogs")) { - $links[] = "nid\">". t("blog it") .""; + $links[] = "nid\">". t("blog it") .""; } if ($blog->comment) { @@ -131,7 +160,7 @@ function blog_page_last() { } if ($user->uid && user_access("post blogs")) { - $links[] = "nid\">". t("blog it") .""; + $links[] = "nid\">". t("blog it") .""; } if ($blog->comment) { @@ -150,6 +179,17 @@ function blog_page_last() { } function blog_form($edit) { + global $nid, $iid; + + if (!$edit->body) { + if ($nid && $blog = node_load(array("nid" => $nid))) { + $edit->body = "". $blog->body ." [uid&date=$blog->created\">$blog->name]"; + } + + if ($iid && $item = db_fetch_object(db_query("SELECT i.*, f.title as ftitle, f.link as flink FROM item i, feed f WHERE i.iid = '". check_input($iid) ."' AND i.fid = f.fid"))) { + $edit->body = "link\">$item->title - ". check_output($item->description) ." [flink\">$item->ftitle]\n"; + } + } $output = form_textarea(t("Body"), "body", $edit->body, 60, 15, t("Allowed HTML tags") .": ". htmlspecialchars(variable_get("allowed_html", ""))); @@ -157,30 +197,14 @@ function blog_form($edit) { } function blog_save($node) { - global $user; if ($node->nid) { - - /* - ** Load the original blog from the database to make sure that only - ** original author can update his blog. - */ - - $blog = node_load(array("nid" => $node->nid)); - - if ($user->uid && $user->uid == $node->uid && $user->uid == $blog->uid) { - return array(); - } - else if (user_access("adminster nodes")) { - return array(); - } - else { - return 0; - } + return array(); } else { return array("promote" => 0, "moderate" => 0, "status" => 1); } + } function blog_page() { diff --git a/modules/blog/blog.module b/modules/blog/blog.module index 97c9a8559a7..a0489928bdd 100644 --- a/modules/blog/blog.module +++ b/modules/blog/blog.module @@ -1,6 +1,35 @@ "personal blog"); + + return $info[$field]; +} + +function blog_access($op, $node) { + global $user; + + if ($op == "view") { + return $node->nid && $node->status && !$node->moderate; + } + + if ($op == "create") { + return $user->uid; + } + + if ($op == "update") { + return user_access("administer nodes") || ($user->uid == $node->uid); + } + + if ($op == "delete") { + return user_access("administer nodes") || ($user->uid == $node->uid); + } + +} + function blog_help() { ?>

Drupal's blog module allows registered users to maintain an online blog or diary. It provides easy-to-write and easy-to-read online diaries or journals that can be filled with daily thoughts, poetry, boneless blabber, spiritual theories, intimate details, valuable experiences, cynical rants, semi-coherent comments, writing experiments, artistic babblings, critics on current facts, fresh insights, diverse dreams, chronicles and mumbling madness available for public consumption.

@@ -94,7 +123,7 @@ function blog_page_user($uid = 0, $date = 0) { } if ($user->uid && user_access("post blogs")) { - $links[] = "nid\">". t("blog it") .""; + $links[] = "nid\">". t("blog it") .""; } if ($blog->comment) { @@ -131,7 +160,7 @@ function blog_page_last() { } if ($user->uid && user_access("post blogs")) { - $links[] = "nid\">". t("blog it") .""; + $links[] = "nid\">". t("blog it") .""; } if ($blog->comment) { @@ -150,6 +179,17 @@ function blog_page_last() { } function blog_form($edit) { + global $nid, $iid; + + if (!$edit->body) { + if ($nid && $blog = node_load(array("nid" => $nid))) { + $edit->body = "". $blog->body ." [uid&date=$blog->created\">$blog->name]"; + } + + if ($iid && $item = db_fetch_object(db_query("SELECT i.*, f.title as ftitle, f.link as flink FROM item i, feed f WHERE i.iid = '". check_input($iid) ."' AND i.fid = f.fid"))) { + $edit->body = "link\">$item->title - ". check_output($item->description) ." [flink\">$item->ftitle]\n"; + } + } $output = form_textarea(t("Body"), "body", $edit->body, 60, 15, t("Allowed HTML tags") .": ". htmlspecialchars(variable_get("allowed_html", ""))); @@ -157,30 +197,14 @@ function blog_form($edit) { } function blog_save($node) { - global $user; if ($node->nid) { - - /* - ** Load the original blog from the database to make sure that only - ** original author can update his blog. - */ - - $blog = node_load(array("nid" => $node->nid)); - - if ($user->uid && $user->uid == $node->uid && $user->uid == $blog->uid) { - return array(); - } - else if (user_access("adminster nodes")) { - return array(); - } - else { - return 0; - } + return array(); } else { return array("promote" => 0, "moderate" => 0, "status" => 1); } + } function blog_page() { diff --git a/modules/book.module b/modules/book.module index 39be32c6607..84c7d00dede 100644 --- a/modules/book.module +++ b/modules/book.module @@ -1,6 +1,35 @@ "book page"); + + return $info[$field]; +} + +function book_access($op, $node) { + global $user; + + if ($op == "view") { + return $node->nid && $node->status && !$node->moderate; + } + + if ($op == "create") { + return 1; + } + + if ($op == "update") { + return 1; + } + + if ($op == "delete") { + return user_access("adminster nodes"); + } + +} + function book_link($type) { if ($type == "page" && user_access("access content")) { $links[] = "". t("collaborative book") .""; @@ -36,17 +65,11 @@ function book_delete($node) { } function book_save($node) { - if ($node->nid) { - if (user_access("administer nodes")) { - return array("moderate" => 1, "promote" => 0, "status" => 0, "log", "parent", "weight"); - } - else { - // TODO: temporay disabled book page updates by regular users - return 0; - } + if ($node->nid && user_access("administer nodes")) { + return array("pid", "log", "parent", "weight"); } else { - return array("pid", "log", "parent", "weight"); + return array("moderate" => 1, "promote" => 0, "status" => 0, "log", "parent", "weight"); } } @@ -80,8 +103,7 @@ function book_view($node, $main = 0) { $indent .= "-"; } - $output .= " "; -// TODO: \n"; + $output .= " \n"; $output .= " "; $output .= " \n"; } diff --git a/modules/book/book.module b/modules/book/book.module index 39be32c6607..84c7d00dede 100644 --- a/modules/book/book.module +++ b/modules/book/book.module @@ -1,6 +1,35 @@ "book page"); + + return $info[$field]; +} + +function book_access($op, $node) { + global $user; + + if ($op == "view") { + return $node->nid && $node->status && !$node->moderate; + } + + if ($op == "create") { + return 1; + } + + if ($op == "update") { + return 1; + } + + if ($op == "delete") { + return user_access("adminster nodes"); + } + +} + function book_link($type) { if ($type == "page" && user_access("access content")) { $links[] = "". t("collaborative book") .""; @@ -36,17 +65,11 @@ function book_delete($node) { } function book_save($node) { - if ($node->nid) { - if (user_access("administer nodes")) { - return array("moderate" => 1, "promote" => 0, "status" => 0, "log", "parent", "weight"); - } - else { - // TODO: temporay disabled book page updates by regular users - return 0; - } + if ($node->nid && user_access("administer nodes")) { + return array("pid", "log", "parent", "weight"); } else { - return array("pid", "log", "parent", "weight"); + return array("moderate" => 1, "promote" => 0, "status" => 0, "log", "parent", "weight"); } } @@ -80,8 +103,7 @@ function book_view($node, $main = 0) { $indent .= "-"; } - $output .= " "; -// TODO: \n"; + $output .= " \n"; $output .= " "; $output .= " \n"; } diff --git a/modules/forum.module b/modules/forum.module index 5364b7e3484..f33ad51f5a2 100644 --- a/modules/forum.module +++ b/modules/forum.module @@ -1,6 +1,21 @@ "discussion forum"); + + return $info[$field]; +} + +function forum_access($op, $node) { + + if ($op == "view") { + return $node->nid && $node->status && !$node->moderate; + } + + return user_access("adminster nodes"); +} + function forum_link($type) { if ($type == "page" && user_access("access content")) { $links[] = "". t("forum") .""; @@ -24,18 +39,12 @@ function forum_form($node) { function forum_save() { - if (user_access("administer nodes")) { - if ($node->nid) { - return array(); - } - else { - return array("promote" => 0, "moderate" => 0, "status" => 1); - } + if ($node->nid) { + return array(); } else { - return 0; + return array("promote" => 0, "moderate" => 0, "status" => 1); } - } function forum_num_comments($nid) { diff --git a/modules/forum/forum.module b/modules/forum/forum.module index 5364b7e3484..f33ad51f5a2 100644 --- a/modules/forum/forum.module +++ b/modules/forum/forum.module @@ -1,6 +1,21 @@ "discussion forum"); + + return $info[$field]; +} + +function forum_access($op, $node) { + + if ($op == "view") { + return $node->nid && $node->status && !$node->moderate; + } + + return user_access("adminster nodes"); +} + function forum_link($type) { if ($type == "page" && user_access("access content")) { $links[] = "". t("forum") .""; @@ -24,18 +39,12 @@ function forum_form($node) { function forum_save() { - if (user_access("administer nodes")) { - if ($node->nid) { - return array(); - } - else { - return array("promote" => 0, "moderate" => 0, "status" => 1); - } + if ($node->nid) { + return array(); } else { - return 0; + return array("promote" => 0, "moderate" => 0, "status" => 1); } - } function forum_num_comments($nid) { diff --git a/modules/import.module b/modules/import.module index 51de2e52af6..0c3c16b1aa2 100644 --- a/modules/import.module +++ b/modules/import.module @@ -497,7 +497,7 @@ function import_page_last() { $output .= "
$location
". node_control($node) ."
$locationnid\">update
". check_output($node->title) ."". ($node->body ? "
Last updated by ". format_name($node) ." on ". format_date($node->created) ." " : "") ."
$location
". node_control($node) ."
$locationnid\">update
". check_output($node->title) ."". ($node->body ? "
Last updated by ". format_name($node) ." on ". format_date($node->created) ." " : "") ."
"; while ($item = db_fetch_object($result)) { - $links[] = "iid\">". t("blog it") .""; + $links[] = "iid\">". t("blog it") .""; $links[] = "fid\">". t("feed") .""; if ($item->link) { @@ -530,7 +530,7 @@ function import_page_feed($fid) { $output .= "
"; while ($item = db_fetch_object($result)) { - $links[] = "iid\">". t("blog it") .""; + $links[] = "iid\">". t("blog it") .""; $links[] = "link\">". t("visit") .""; if ($item->link) { @@ -564,7 +564,7 @@ function import_page_bundle($bid) { $output .= "
"; while ($item = db_fetch_object($result)) { - $links[] = "iid\">". t("blog it") .""; + $links[] = "iid\">". t("blog it") .""; $links[] = "fid\">". t("feed") .""; $links[] = "link\">". t("visit") .""; diff --git a/modules/node.module b/modules/node.module index bf388d76abb..c239d9868b9 100644 --- a/modules/node.module +++ b/modules/node.module @@ -14,6 +14,30 @@ function node_help() { } } +function node_access($op, $node = 0) { + + /* + ** Convert the node to an object if necessary: + */ + + if (is_array($node)) { + $node = node_object($node); + } + + /* + ** Construct a function: + */ + + $function = $node->type ."_access"; + + if (function_exists($function)) { + return $function($op, $node); + } + else { + return 0; + } +} + function node_perm() { return array("administer nodes", "access content", "post content"); } @@ -375,7 +399,7 @@ function node_form($edit) { $output .= form_submit(t("Submit")); } - if ($edit->nid && user_access("administer nodes")) { + if ($edit->nid && node_access("delete", $edit)) { $output .= form_submit(t("Delete")); } @@ -407,15 +431,13 @@ function node_add($type) { } else { // TODO: make building a node list generic and find an easy way to associate post permissions with them - if (user_access("adminster nodes")) { - $nodes = array("book" => "book page", "blog" => "personal blog entry", "poll" => "online survey", "story" => "story", "page" => "static page", "forum" => "discussion forum"); - } - else { - $nodes = array("book" => "book page", "blog" => "personal blog entry", "poll" => "online survey", "story" => "story"); - } - foreach ($nodes as $type => $name) { - $links[] = "". t($name) .""; + $links = array(); + + foreach (module_list() as $name) { + if (($info = module_invoke($name, "node", "name")) && node_access("create", array("type" => $name))) { + $links[] = "". t($info) .""; + } } $output .= sprintf(t("Submit a %s."), implode(", ", $links)); @@ -430,7 +452,14 @@ function node_edit($id) { $node = node_load(array("nid" => $id)); // TODO: make this generic for all node types - temporary solution - return node_form($node); + if (node_access("update", $node)) { + $output = node_form($node); + } + else { + $output = message_access(); + } + + return $output; } function node_preview($edit) { @@ -465,7 +494,7 @@ function node_preview($edit) { return node_form($edit); } -function node_submit($edit) { +function node_submit($node) { global $user; @@ -473,51 +502,68 @@ function node_submit($edit) { ** Fixup the node when required: */ - node_fixup(&$edit); + node_fixup(&$node); + + if ($node->nid) { - if ($edit->nid) { /* - ** Compile a list of the node fields and their default values that users - ** and administrators are allowed to save when updating a node. + ** Check whether the current user has the proper access rights to + ** perform this operation: */ - if (user_access("administer nodes")) { - $fields = array("nid", "uid", "body", "comment", "promote", "moderate", "status", "teaser", "title", "created", "type" => $edit->type); + if (node_access("update", $node)) { + + /* + ** Compile a list of the node fields and their default values that users + ** and administrators are allowed to save when updating a node. + */ + + if (user_access("administer nodes")) { + $fields = array("nid", "uid", "body", "comment", "promote", "moderate", "status", "teaser", "title", "created", "type" => $node->type); + } + else { + $fields = array("nid", "uid" => $user->uid, "body", "teaser", "title", "type" => $node->type); + } + + node_save($node, array_merge($fields, module_invoke($node->type, "save", $node))); + + $output = t("The node has been updated."); } else { - $fields = array("nid", "uid" => $user->uid, "body", "teaser", "title", "type" => $edit->type); + watchdog("warning", "node: not authorized to update node"); + $output = t("You are not authorized to update this node."); } - $output = t("The node has been updated."); } else { + /* - ** Compile a list of the node fields and their default values that users - ** and administrators are allowed to save when inserting a new node. + ** Check whether the current user has the proper access rights to + ** perform this operation: */ - if (user_access("administer nodes")) { - $fields = array("uid", "body", "comment" => 1, "promote", "moderate", "status" => 1, "teaser", "title", "type" => $edit->type); + if (node_access("create", $node)) { + + /* + ** Compile a list of the node fields and their default values that users + ** and administrators are allowed to save when inserting a new node. + */ + + if (user_access("administer nodes")) { + $fields = array("uid", "body", "comment" => 1, "promote", "moderate", "status" => 1, "teaser", "title", "type" => $node->type); + } + else { + $fields = array("uid" => $user->uid, "body", "comment" => 1, "teaser", "title", "type" => $node->type); + } + + node_save($node, array_merge($fields, module_invoke($node->type, "save", $node))); + + $output = t("Thanks for your submission."); } else { - $fields = array("uid" => $user->uid, "body", "comment" => 1, "teaser", "title", "type" => $edit->type); + watchdog("warning", "node: not authorized to create node"); + $output = t("You are not authorized to create this node."); } - - $output = t("Thanks for your submission."); - } - - /* - ** Check whether we are allowed to save the node and if so, whether - ** there are more default values to add. - */ - - $defaults = module_invoke($edit->type, "save", $edit); - - if (is_array($defaults)) { - node_save($edit, array_merge($fields, $defaults)); - } - else { - $output = t("Could not save or process the specified submission."); } return $output; @@ -525,17 +571,25 @@ function node_submit($edit) { function node_remove($edit) { - if ($edit["confirm"]) { - node_delete(array(nid => $edit["nid"])); + $node = node_load(array("nid" => $edit["nid"])); - $output = node_admin_nodes(); + if (node_access("delete", $node)) { + if ($edit["confirm"]) { + node_delete($node); + + $output = t("The node has been deleted."); + } + else { + $output .= form_item(t("Confirm removal of"), check_output($node->title)); + $output .= form_hidden("nid", $node->nid); + $output .= form_hidden("confirm", 1); + $output .= form_submit(t("Delete")); + $output = form($output, "post", "admin.php?mod=node"); + } } else { - $output .= form_item(t("Confirm removal of"), check_output($edit["title"])); - $output .= form_hidden("nid", $edit["nid"]); - $output .= form_hidden("confirm", 1); - $output .= form_submit(t("Delete")); - $output = form($output, "post", "admin.php?mod=node"); + watchdog("warning", "node: not authorized to remove node"); + $output = t("You are not authorized to remove this node."); } return $output; @@ -564,6 +618,9 @@ function node_page() { case t("Submit"): $theme->box(t("Node"), node_submit($edit)); break; + case t("Delete"): + print node_remove($edit); + break; default: $result = db_query("SELECT nid, type FROM node WHERE ". ($meta ? "attributes LIKE '%". check_input($meta) ."%' AND " : "") ." promote = '1' AND status = '1' AND created <= '". ($date > 0 ? check_input($date) : time()) ."' ORDER BY created DESC LIMIT ". ($user->nodes ? $user->nodes : variable_get(default_nodes_main, 10))); while ($node = db_fetch_object($result)) { diff --git a/modules/node/node.module b/modules/node/node.module index bf388d76abb..c239d9868b9 100644 --- a/modules/node/node.module +++ b/modules/node/node.module @@ -14,6 +14,30 @@ function node_help() { } } +function node_access($op, $node = 0) { + + /* + ** Convert the node to an object if necessary: + */ + + if (is_array($node)) { + $node = node_object($node); + } + + /* + ** Construct a function: + */ + + $function = $node->type ."_access"; + + if (function_exists($function)) { + return $function($op, $node); + } + else { + return 0; + } +} + function node_perm() { return array("administer nodes", "access content", "post content"); } @@ -375,7 +399,7 @@ function node_form($edit) { $output .= form_submit(t("Submit")); } - if ($edit->nid && user_access("administer nodes")) { + if ($edit->nid && node_access("delete", $edit)) { $output .= form_submit(t("Delete")); } @@ -407,15 +431,13 @@ function node_add($type) { } else { // TODO: make building a node list generic and find an easy way to associate post permissions with them - if (user_access("adminster nodes")) { - $nodes = array("book" => "book page", "blog" => "personal blog entry", "poll" => "online survey", "story" => "story", "page" => "static page", "forum" => "discussion forum"); - } - else { - $nodes = array("book" => "book page", "blog" => "personal blog entry", "poll" => "online survey", "story" => "story"); - } - foreach ($nodes as $type => $name) { - $links[] = "". t($name) .""; + $links = array(); + + foreach (module_list() as $name) { + if (($info = module_invoke($name, "node", "name")) && node_access("create", array("type" => $name))) { + $links[] = "". t($info) .""; + } } $output .= sprintf(t("Submit a %s."), implode(", ", $links)); @@ -430,7 +452,14 @@ function node_edit($id) { $node = node_load(array("nid" => $id)); // TODO: make this generic for all node types - temporary solution - return node_form($node); + if (node_access("update", $node)) { + $output = node_form($node); + } + else { + $output = message_access(); + } + + return $output; } function node_preview($edit) { @@ -465,7 +494,7 @@ function node_preview($edit) { return node_form($edit); } -function node_submit($edit) { +function node_submit($node) { global $user; @@ -473,51 +502,68 @@ function node_submit($edit) { ** Fixup the node when required: */ - node_fixup(&$edit); + node_fixup(&$node); + + if ($node->nid) { - if ($edit->nid) { /* - ** Compile a list of the node fields and their default values that users - ** and administrators are allowed to save when updating a node. + ** Check whether the current user has the proper access rights to + ** perform this operation: */ - if (user_access("administer nodes")) { - $fields = array("nid", "uid", "body", "comment", "promote", "moderate", "status", "teaser", "title", "created", "type" => $edit->type); + if (node_access("update", $node)) { + + /* + ** Compile a list of the node fields and their default values that users + ** and administrators are allowed to save when updating a node. + */ + + if (user_access("administer nodes")) { + $fields = array("nid", "uid", "body", "comment", "promote", "moderate", "status", "teaser", "title", "created", "type" => $node->type); + } + else { + $fields = array("nid", "uid" => $user->uid, "body", "teaser", "title", "type" => $node->type); + } + + node_save($node, array_merge($fields, module_invoke($node->type, "save", $node))); + + $output = t("The node has been updated."); } else { - $fields = array("nid", "uid" => $user->uid, "body", "teaser", "title", "type" => $edit->type); + watchdog("warning", "node: not authorized to update node"); + $output = t("You are not authorized to update this node."); } - $output = t("The node has been updated."); } else { + /* - ** Compile a list of the node fields and their default values that users - ** and administrators are allowed to save when inserting a new node. + ** Check whether the current user has the proper access rights to + ** perform this operation: */ - if (user_access("administer nodes")) { - $fields = array("uid", "body", "comment" => 1, "promote", "moderate", "status" => 1, "teaser", "title", "type" => $edit->type); + if (node_access("create", $node)) { + + /* + ** Compile a list of the node fields and their default values that users + ** and administrators are allowed to save when inserting a new node. + */ + + if (user_access("administer nodes")) { + $fields = array("uid", "body", "comment" => 1, "promote", "moderate", "status" => 1, "teaser", "title", "type" => $node->type); + } + else { + $fields = array("uid" => $user->uid, "body", "comment" => 1, "teaser", "title", "type" => $node->type); + } + + node_save($node, array_merge($fields, module_invoke($node->type, "save", $node))); + + $output = t("Thanks for your submission."); } else { - $fields = array("uid" => $user->uid, "body", "comment" => 1, "teaser", "title", "type" => $edit->type); + watchdog("warning", "node: not authorized to create node"); + $output = t("You are not authorized to create this node."); } - - $output = t("Thanks for your submission."); - } - - /* - ** Check whether we are allowed to save the node and if so, whether - ** there are more default values to add. - */ - - $defaults = module_invoke($edit->type, "save", $edit); - - if (is_array($defaults)) { - node_save($edit, array_merge($fields, $defaults)); - } - else { - $output = t("Could not save or process the specified submission."); } return $output; @@ -525,17 +571,25 @@ function node_submit($edit) { function node_remove($edit) { - if ($edit["confirm"]) { - node_delete(array(nid => $edit["nid"])); + $node = node_load(array("nid" => $edit["nid"])); - $output = node_admin_nodes(); + if (node_access("delete", $node)) { + if ($edit["confirm"]) { + node_delete($node); + + $output = t("The node has been deleted."); + } + else { + $output .= form_item(t("Confirm removal of"), check_output($node->title)); + $output .= form_hidden("nid", $node->nid); + $output .= form_hidden("confirm", 1); + $output .= form_submit(t("Delete")); + $output = form($output, "post", "admin.php?mod=node"); + } } else { - $output .= form_item(t("Confirm removal of"), check_output($edit["title"])); - $output .= form_hidden("nid", $edit["nid"]); - $output .= form_hidden("confirm", 1); - $output .= form_submit(t("Delete")); - $output = form($output, "post", "admin.php?mod=node"); + watchdog("warning", "node: not authorized to remove node"); + $output = t("You are not authorized to remove this node."); } return $output; @@ -564,6 +618,9 @@ function node_page() { case t("Submit"): $theme->box(t("Node"), node_submit($edit)); break; + case t("Delete"): + print node_remove($edit); + break; default: $result = db_query("SELECT nid, type FROM node WHERE ". ($meta ? "attributes LIKE '%". check_input($meta) ."%' AND " : "") ." promote = '1' AND status = '1' AND created <= '". ($date > 0 ? check_input($date) : time()) ."' ORDER BY created DESC LIMIT ". ($user->nodes ? $user->nodes : variable_get(default_nodes_main, 10))); while ($node = db_fetch_object($result)) { diff --git a/modules/page.module b/modules/page.module index 84488f29636..bb1affd3545 100644 --- a/modules/page.module +++ b/modules/page.module @@ -3,6 +3,33 @@ $GLOBALS["format"] = array(0 => "HTML", 1 => "PHP", 2 => "text"); +function page_node($field) { + $info = array("name" => "static page"); + + return $info[$field]; +} + +function page_access($op, $node) { + + if ($op == "view") { + return $node->nid && $node->status && !$node->moderate; + } + + return user_access("administer nodes"); +} + +function page_insert($node) { + db_query("INSERT INTO page (nid, format, link) VALUES ('$node->nid', '$node->format', '$node->link')"); +} + +function page_update($node) { + db_query("UPDATE page SET format = '$node->format', link = '$node->link' WHERE nid = '$node->nid'"); +} + +function page_delete($node) { + db_query("DELETE FROM page WHERE nid = '$node->nid'"); +} + function page_link($type) { if ($type == "page") { $result = db_query("SELECT nid,link FROM page WHERE link != '' ORDER BY link"); @@ -42,7 +69,8 @@ function page_form($node) { $node->body = addslashes($node->body); } - $output .= form_textarea("Body", "body", $node->body, 60, 30); + $output .= form_textarea("Body", "body", $node->body, 60, 20); + $output .= form_textfield("Link", "link", $node->link, 60, 64); $output .= form_select("Type", "format", $node->format, $format); return $output; @@ -50,16 +78,11 @@ function page_form($node) { function page_save() { - if (user_access("administer nodes")) { - if ($node->nid) { - return array(); - } - else { - return array("promote" => 0, "moderate" => 0, "status" => 1); - } + if ($node->nid) { + return array("format", "link"); } else { - return 0; + return array("format", "link", "promote" => 0, "moderate" => 0, "status" => 1); } } diff --git a/modules/page/page.module b/modules/page/page.module index 84488f29636..bb1affd3545 100644 --- a/modules/page/page.module +++ b/modules/page/page.module @@ -3,6 +3,33 @@ $GLOBALS["format"] = array(0 => "HTML", 1 => "PHP", 2 => "text"); +function page_node($field) { + $info = array("name" => "static page"); + + return $info[$field]; +} + +function page_access($op, $node) { + + if ($op == "view") { + return $node->nid && $node->status && !$node->moderate; + } + + return user_access("administer nodes"); +} + +function page_insert($node) { + db_query("INSERT INTO page (nid, format, link) VALUES ('$node->nid', '$node->format', '$node->link')"); +} + +function page_update($node) { + db_query("UPDATE page SET format = '$node->format', link = '$node->link' WHERE nid = '$node->nid'"); +} + +function page_delete($node) { + db_query("DELETE FROM page WHERE nid = '$node->nid'"); +} + function page_link($type) { if ($type == "page") { $result = db_query("SELECT nid,link FROM page WHERE link != '' ORDER BY link"); @@ -42,7 +69,8 @@ function page_form($node) { $node->body = addslashes($node->body); } - $output .= form_textarea("Body", "body", $node->body, 60, 30); + $output .= form_textarea("Body", "body", $node->body, 60, 20); + $output .= form_textfield("Link", "link", $node->link, 60, 64); $output .= form_select("Type", "format", $node->format, $format); return $output; @@ -50,16 +78,11 @@ function page_form($node) { function page_save() { - if (user_access("administer nodes")) { - if ($node->nid) { - return array(); - } - else { - return array("promote" => 0, "moderate" => 0, "status" => 1); - } + if ($node->nid) { + return array("format", "link"); } else { - return 0; + return array("format", "link", "promote" => 0, "moderate" => 0, "status" => 1); } } diff --git a/modules/queue.module b/modules/queue.module index cbb1c57989e..8dd4d2a5a2c 100644 --- a/modules/queue.module +++ b/modules/queue.module @@ -79,7 +79,7 @@ function queue_overview() { $theme->footer(); } -function queue_node($id) { +function queue_view($id) { global $theme, $user; $node = node_load(array(nid => $id)); @@ -130,7 +130,7 @@ function queue_page() { queue_vote(check_input($id), check_input($vote)); // fall through: case "view": - queue_node(check_input($id)); + queue_view(check_input($id)); break; default: queue_overview(); diff --git a/modules/story.module b/modules/story.module index 91bb9ef817a..66870c076f7 100644 --- a/modules/story.module +++ b/modules/story.module @@ -1,11 +1,41 @@ "story"); + + return $info[$field]; +} + +function story_access($op, $node) { + + if ($op == "view") { + return $node->nid && $node->status && !$node->moderate; + } + + if ($op == "create") { + return 1; + } + + if ($op == "update") { + return user_access("administer nodes"); + } + + if ($op == "delete") { + return user_access("adminster nodes"); + } + +} + function story_help() { ?> -

Queued stories: user-contributed stories are automatically whisked away to a submission queue for moderators (i.e. registered user) to frown at. Moderators vote whether or not a story should be posted to the front page for discussion.

-

Posted stories: published stories accessible to all visitors.

-

Dumped stories: rejected stories that are no longer available to visitors.

+/* + // TODO: update documentation, outdated + +

Queued stories: user-contributed stories are automatically whisked away to a submission queue for moderators (i.e. registered user) to frown at. Moderators vote whether or not a story should be posted to the front page for discussion.

+

Posted stories: published stories accessible to all visitors.

+

Dumped stories: rejected stories that are no longer available to visitors.

+*/ nid) { - if (user_access("administer nodes")) { - return array(); - } - else { - return 0; - } + return array(); } else { - /* - ** By default, stories get promoted to the front page and they are - ** subject to moderation. - */ return array("promote" => 1, "moderate" => 1); } + } ?> diff --git a/modules/story/story.module b/modules/story/story.module index 91bb9ef817a..66870c076f7 100644 --- a/modules/story/story.module +++ b/modules/story/story.module @@ -1,11 +1,41 @@ "story"); + + return $info[$field]; +} + +function story_access($op, $node) { + + if ($op == "view") { + return $node->nid && $node->status && !$node->moderate; + } + + if ($op == "create") { + return 1; + } + + if ($op == "update") { + return user_access("administer nodes"); + } + + if ($op == "delete") { + return user_access("adminster nodes"); + } + +} + function story_help() { ?> -

Queued stories: user-contributed stories are automatically whisked away to a submission queue for moderators (i.e. registered user) to frown at. Moderators vote whether or not a story should be posted to the front page for discussion.

-

Posted stories: published stories accessible to all visitors.

-

Dumped stories: rejected stories that are no longer available to visitors.

+/* + // TODO: update documentation, outdated + +

Queued stories: user-contributed stories are automatically whisked away to a submission queue for moderators (i.e. registered user) to frown at. Moderators vote whether or not a story should be posted to the front page for discussion.

+

Posted stories: published stories accessible to all visitors.

+

Dumped stories: rejected stories that are no longer available to visitors.

+*/ nid) { - if (user_access("administer nodes")) { - return array(); - } - else { - return 0; - } + return array(); } else { - /* - ** By default, stories get promoted to the front page and they are - ** subject to moderation. - */ return array("promote" => 1, "moderate" => 1); } + } ?> diff --git a/node.php b/node.php index 161d7465b8a..12b05238157 100644 --- a/node.php +++ b/node.php @@ -71,7 +71,7 @@ function node_render($node) { function node_failure() { global $theme; $theme->header(); - $theme->box(t("Not found"), t("The node you are looking for does not exist yet or is no longer accessible.") ."\n"); + $theme->box(t("Not found"), t("The node you are looking for does no longer exist or is not accessible without the proper access rights.") ."\n"); $theme->footer(); } @@ -82,7 +82,7 @@ if ($number > 1) { $result = db_query("SELECT n.*, u.name, u.uid FROM node n LEFT JOIN users u ON n.uid = u.uid WHERE n.title = '$title' AND n.status = 1 ORDER BY created DESC"); while ($node = db_fetch_object($result)) { - if (node_access($node)) { + if (node_access("view", $node)) { $output .= "

nid\">". check_output($node->title) ."
$node->type - ". format_name($node) ." - ". format_date($node->ccreated, "small") ."

"; } } @@ -93,7 +93,7 @@ if ($number > 1) { } elseif ($number) { $node = ($title ? node_load(array("title" => $title, "status" => 1)) : node_load(array("nid" => ($edit[id] ? $edit[id] : $id)))); - if ($node && node_access($node)) { + if (node_access("view", $node)) { node_render($node); } else {