Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
80 commits
Select commit Hold shift + click to select a range
68d8c28
Prevent infinite loop, when dealing with OG context
anvmn Oct 26, 2016
beb0647
Add functions that resolve Group/Project content types
anvmn Oct 26, 2016
8e5e678
Remove function that is not required.
anvmn Oct 26, 2016
91f165a
Merge branch 'develop' into feature/CFM-861-adjust-permissions
soniCaH Oct 26, 2016
3db9935
If possible, avoid calling menu_get_item(), as it activates node_acce…
anvmn Oct 26, 2016
9367b5d
Do not allow anyone but site admin, to invite users/visitors to grou…
anvmn Oct 26, 2016
85e75fc
WIP: GO/GA/SA should see pending groups
anvmn Oct 26, 2016
e4cb19a
Merge branch 'develop' into feature/CFM-861-adjust-permissions
anvmn Oct 27, 2016
f8aa3c1
Allow site admin to change private group state from pending to publis…
anvmn Oct 27, 2016
309e20d
Allow access to group, based on group state and user role within the …
anvmn Oct 27, 2016
beb87f5
Deny access for unallowed usecases - view/add/edit group content, vie…
anvmn Oct 30, 2016
c797285
Merge branch 'develop' into feature/CFM-861-adjust-permissions
ordavidil Oct 30, 2016
70cb370
Add pluggable node access logic for user accessing restricted group.
anvmn Oct 30, 2016
03783fc
Assign permissions for 'user invite' & 'visitor invite'. [ci skip]
anvmn Oct 30, 2016
2e6c655
Code review.
anvmn Oct 30, 2016
1be8487
Code review fix.
anvmn Oct 30, 2016
06dfbf6
Fix
anvmn Oct 30, 2016
d5f8a24
Merge branch 'develop' into feature/CFM-861-adjust-permissions
anvmn Oct 31, 2016
469b456
Merge branch 'develop' into feature/CFM-861-adjust-permissions
anvmn Nov 2, 2016
74900a1
Changes from # 1462
anvmn Nov 3, 2016
0f26ecf
Updated logic, both for group and group content.
anvmn Nov 3, 2016
77ca3d4
FIx
anvmn Nov 3, 2016
7e8870c
Removing permisions 'workarounds'
anvmn Nov 3, 2016
6ef52f4
Removing logic that is anyway covered by default setting
anvmn Nov 3, 2016
4c619ce
Revert "Removing permisions 'workarounds'"
anvmn Nov 3, 2016
bbcc5d8
Docs
anvmn Nov 3, 2016
780e907
Improve code
anvmn Nov 3, 2016
7a1ac26
Reducing and organizing code
anvmn Nov 3, 2016
92b24d9
Coder
anvmn Nov 3, 2016
b740924
Fixes and Doscs
anvmn Nov 6, 2016
3f881c8
'My groups' top bar - present only groups that user can view.
anvmn Nov 6, 2016
074afec
Applying filters on Groups/Project search api views
anvmn Nov 6, 2016
a9e51fb
Applying filters on Groups/Project search api views - no filter / fil…
anvmn Nov 6, 2016
733ead7
Fix showAll filter
anvmn Nov 6, 2016
763e57c
Remove module_implements_alter
anvmn Nov 6, 2016
46ec027
Docs and Coder
anvmn Nov 6, 2016
a50649c
Docs
anvmn Nov 6, 2016
c9c01fe
Fix typo
anvmn Nov 6, 2016
3d70304
Handle 'interests' filter
anvmn Nov 6, 2016
253ca38
Docs [ci skip]
anvmn Nov 6, 2016
ca8921b
Add logic for access to 'create content' form
anvmn Nov 6, 2016
e865136
Archived group is read only for all users but site admin
anvmn Nov 6, 2016
5bf1947
Remove 'REJECTED' status that was canceled
anvmn Nov 7, 2016
be1a87c
Replace the filter.
anvmn Nov 7, 2016
c8876fd
Docs [ci skip]
anvmn Nov 7, 2016
46e0acb
Archived group is read only
anvmn Nov 7, 2016
fd30850
Remove unnecessary params
anvmn Nov 7, 2016
0475977
Coder
anvmn Nov 7, 2016
a49313e
Merge pull request #1484 from capacity4dev/feature/CFM-861-finilize-a…
ordavidil Nov 7, 2016
a28593a
Fix 'edit wiki page by user' use case
anvmn Nov 7, 2016
74f18f0
Test functionality if canceling c4m_og_node_access
anvmn Nov 7, 2016
d26cb27
Restore permissions verification at create content form access
anvmn Nov 8, 2016
4ebd7b8
Rebstructure c4m_og_node_access
anvmn Nov 8, 2016
fb4857b
Fixes
anvmn Nov 8, 2016
c6dc112
Fixing $account usage
anvmn Nov 8, 2016
07a9d91
Adding Docs for 4 new functions [ci skip]
anvmn Nov 8, 2016
df1ea73
Reducing code at delete function
anvmn Nov 8, 2016
d497034
Remove unnecessary param [ci skip]
anvmn Nov 8, 2016
7324c5a
Code review updates
anvmn Nov 8, 2016
40bd401
Fix for editable wiki page
anvmn Nov 8, 2016
4475337
Fix, when adding content by site admin
anvmn Nov 8, 2016
cd2edeb
Code review updates
anvmn Nov 8, 2016
77c4f7b
Code review changes
anvmn Nov 8, 2016
ca12d42
Docs [ci skip]
anvmn Nov 8, 2016
3678e3b
Code review updates
anvmn Nov 8, 2016
f04f213
Coder [ci skip]
anvmn Nov 8, 2016
54901da
Coder
anvmn Nov 8, 2016
d79ed05
Testing fix for selector problem
anvmn Nov 8, 2016
87294ad
Aligning selector to follow permissions logic.
anvmn Nov 9, 2016
102aba5
Logic changes and Docs.
anvmn Nov 9, 2016
3be03f7
Merge branch 'develop' into feature/CFM-861-adjust-permissions
anvmn Nov 9, 2016
0969333
Manual merge of #1482
anvmn Nov 9, 2016
745a150
Fix regex
anvmn Nov 9, 2016
546378e
Do not allow member to create wiki page at form access
anvmn Nov 9, 2016
9de53da
Site admin may not create content at pending group
anvmn Nov 9, 2016
40afc3f
Restore the condition on selector.
anvmn Nov 9, 2016
297a2e4
Reformat form access function [ci skip]
anvmn Nov 10, 2016
fe54442
Prevent site admin from adding content to deleted group
anvmn Nov 10, 2016
d6336fe
Rename constants
anvmn Nov 13, 2016
dc263fc
Manual merge of:
anvmn Nov 13, 2016
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -56,12 +56,6 @@ Feature: Group Status
And the "#edit-c4m-og-status-und" element should not contain "pending"
And the "#edit-c4m-og-status-und" element should not contain "draft"

@api
Scenario: Check archived group as group owner
Given I am logged in as user "alfrednobel"
When I start editing group "Archived group"
Then I should not see an "#edit-c4m-og-status-und" element

@api
Scenario: Check deleted group as admin
Given I am logged in as user "mariecurie"
Expand Down Expand Up @@ -100,7 +94,7 @@ Feature: Group Status
Then I should have access to the page
And I visit "Archived group" node of type "group"
And I should not see "Access denied"
And I should be allowed to edit a group "Archived group"
And I should not be allowed to edit a group "Archived group"

@api
Scenario: Check Deleted group dashboard access by group owner
Expand Down Expand Up @@ -133,7 +127,7 @@ Feature: Group Status
Given I am logged in as user "turing"
When I visit "Archived group" node of type "group"
Then I should not see "Access denied"
And I should be allowed to edit a group "Archived group"
And I should not be allowed to edit a group "Archived group"

@api
Scenario: Check Deleted group access by group admin
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -1087,31 +1087,73 @@ function _c4m_content_taxonomy_extract_root_item(&$items) {
/**
* Manages access to 'create group content' form.
*
* For OG type 'group', allows access for group members and power users.
* Allows access for group power users. Members allowed access, when creating
* all content types, besides wiki page.
*/
function c4m_content_create_group_content_access() {
$item = menu_get_item();

$regex = '/node\/add\/(discussion|document|event|news|photo|photoalbum|wiki-page)/';

// Making sure the current request is for the node/add form.
preg_match('/node\/add\/(discussion|document|event|news|photo(album)?|wiki-page)/', $item['path'], $matches);
preg_match($regex, $item['path'], $matches);
if (empty($matches[0])) {
return;
}

// If not under og context, return early.
// If not under og context, deny access.
if (!$context = og_context()) {
drupal_access_denied();
drupal_exit();
c4m_content_deny_access();
}

// Resolve OG group type.
$group_type = c4m_og_get_group_type($context);
// We allow access only for draft / published groups.
$group = node_load($context['gid']);
$group_state = c4m_og_get_group_status($group);

// Site admin may not add content to pending/deleted group.
// No other restrictions.
if (c4m_user_is_site_admin()) {

if ($group_state == 'pending' || $group_state == 'deleted') {
c4m_content_deny_access();
}
else {
return;
}
}

// For type 'group' allow access only to it's members and site admin.
if ($group_type == 'group' && !og_is_member('node', $context['gid']) && !c4m_user_is_site_admin()) {
drupal_access_denied();
drupal_exit();
$allowed_states = array('draft', 'published');
// Deny access, if group state is not allowed.
if (!in_array($group_state, $allowed_states)) {
c4m_content_deny_access();
}
else {
$user_type = _c4m_features_og_members_get_user_type();

$allowed_user_types = array(
C4M_USER_TYPE_GA,
C4M_USER_TYPE_GO,
);

// If content is not wiki page, allow it's creation by group member.
$bundle = explode('/', $item['path']);
if ($bundle[2] != 'wiki-page') {
$allowed_user_types[] = C4M_USER_TYPE_GM;
}

// We allow access to power users, and members, when creating content.
if (!in_array($user_type, $allowed_user_types)) {
c4m_content_deny_access();
}
}
}

/**
* Redirects to page 'Access denied'.
*/
function c4m_content_deny_access() {
drupal_access_denied();
drupal_exit();
}

/**
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -11,13 +11,11 @@ define('C4M_CONTENT_GROUP_STATUS_VIEW_PENDING', 0);
define('C4M_CONTENT_GROUP_STATUS_VIEW_DRAFT', 1);
define('C4M_CONTENT_GROUP_STATUS_VIEW_PUBLISHED', 2);
define('C4M_CONTENT_GROUP_STATUS_VIEW_ARCHIVED', 3);
define('C4M_CONTENT_GROUP_STATUS_VIEW_REJECTED', 4);
define('C4M_CONTENT_GROUP_STATUS_VIEW_DELETED', 5);
define('C4M_CONTENT_GROUP_STATUS_UPDATE_PENDING', 6);
define('C4M_CONTENT_GROUP_STATUS_UPDATE_DRAFT', 7);
define('C4M_CONTENT_GROUP_STATUS_UPDATE_PUBLISHED', 8);
define('C4M_CONTENT_GROUP_STATUS_UPDATE_ARCHIVED', 9);
define('C4M_CONTENT_GROUP_STATUS_UPDATE_REJECTED', 10);
define('C4M_CONTENT_GROUP_STATUS_UPDATE_DELETED', 11);

include_once 'c4m_content_group.features.inc';
Expand Down Expand Up @@ -207,13 +205,11 @@ function c4m_content_group_node_grants($account = NULL, $op = 'view') {
C4M_CONTENT_GROUP_STATUS_VIEW_DRAFT,
C4M_CONTENT_GROUP_STATUS_VIEW_PUBLISHED,
C4M_CONTENT_GROUP_STATUS_VIEW_ARCHIVED,
C4M_CONTENT_GROUP_STATUS_VIEW_REJECTED,
C4M_CONTENT_GROUP_STATUS_VIEW_DELETED,
C4M_CONTENT_GROUP_STATUS_UPDATE_PENDING,
C4M_CONTENT_GROUP_STATUS_UPDATE_DRAFT,
C4M_CONTENT_GROUP_STATUS_UPDATE_PUBLISHED,
C4M_CONTENT_GROUP_STATUS_UPDATE_ARCHIVED,
C4M_CONTENT_GROUP_STATUS_UPDATE_REJECTED,
C4M_CONTENT_GROUP_STATUS_UPDATE_DELETED,
);
return $grants;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -459,6 +459,64 @@ function _c4m_features_og_members_is_power_user($group = NULL, $user = NULL) {
og_get_user_roles('node', $group->nid, $user->uid));
}

/**
* Returns the type of user, globally, or within a group.
*
* Possible types:
* - C4M_USER_TYPE_SA -> site administrator.
* - C4M_USER_TYPE_GO -> group owner.
* - C4M_USER_TYPE_GA -> group administrator.
* - C4M_USER_TYPE_GM -> group member.
* - C4M_USER_TYPE_NON_MEMBER -> authenticated, not a group member.
* - C4M_USER_TYPE_VISITOR -> anonymous user.
*
* @param object $group
* The group for which we want to check the user.
* @param object $user
* The user object.
*
* @return string|false
* Type of user, globally, or within the group.
* FALSE, if type could not be resolve.
*/
function _c4m_features_og_members_get_user_type($group = NULL, $user = NULL) {
if (!isset($user)) {
global $user;
}

if (user_is_anonymous()) {
return C4M_USER_TYPE_VISITOR;
}

// The user has the site wide role 'administrator'.
if (in_array('administrator', $user->roles)) {
return C4M_USER_TYPE_SA;
}

if (!isset($group)) {
$group = c4m_og_current_group();
}

// Currently we're not in a group context, and at that point the user is not
// an administrator.
if (!$group) {
return FALSE;
}

// The user is the group owner.
// What is a group owner? see https://www.drupal.org/node/1114858.
if ($group->uid === $user->uid) {
return C4M_USER_TYPE_GO;
}

// The user has the group role 'administrator member'.
if (in_array('administrator member', og_get_user_roles('node', $group->nid, $user->uid))) {
return C4M_USER_TYPE_GA;
}

return og_is_member('node', $group->nid) ? C4M_USER_TYPE_GM : C4M_USER_TYPE_NON_MEMBER;
}

/**
* Implements hook_entity_property_info_alter().
*/
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -157,7 +157,6 @@ function _c4m_field_og_set_status_flow(&$form, $form_state, $type) {
$unallowed_values = array(
'pending' => array(
'archived',
'published',
),
'draft' => array(
'pending',
Expand All @@ -175,8 +174,14 @@ function _c4m_field_og_set_status_flow(&$form, $form_state, $type) {
),
);

if ($type == 'group' && $wrapper->{OG_ACCESS_FIELD}->value()) {
unset($unallowed_values['pending']['published']);
// For private groups, allow admin user to change group state from pending
// to published.
if ($type == 'group') {
$group_access = c4m_og_get_access_type($entity);

if ($group_access['type'] != 'private') {
$unallowed_values['pending'][] = 'published';
}
}

if (!empty($unallowed_values[$value])) {
Expand Down
Loading