Fixes #2974 using canWriteToContainer() to control access to creating group content

git-svn-id: http://code.elgg.org/elgg/trunk@8795 36083f99-b078-4883-b0ff-0f9b5a30f544

diff --git a/engine/classes/ElggObject.php b/engine/classes/ElggObject.php
index f718011441a52bc6142b82744f7ff0e7a1870584..caccfb0386a4671fb034de1a4dbfbb335648e9fa 100644 (file)
--- a/engine/classes/ElggObject.php
+++ b/engine/classes/ElggObject.php
@@ -211,7 +211,7 @@ class ElggObject extends ElggEntity {
 
                // must be member of group
                if (elgg_instanceof($this->getContainerEntity(), 'group')) {
-                       if (!$this->getContainerEntity()->isMember(get_user($user_guid))) {
+                       if (!$this->getContainerEntity()->canWriteToContainer(get_user($user_guid))) {
                                return false;
                        }
                }

diff --git a/mod/blog/lib/blog.php b/mod/blog/lib/blog.php
index df307d70e4edda84c5c070900e0edb354d7d4eee..83e6c84ee404b0e103ec06f23f251d32fffaa968 100644 (file)
--- a/mod/blog/lib/blog.php
+++ b/mod/blog/lib/blog.php
@@ -87,7 +87,7 @@ function blog_get_page_content_list($container_guid = NULL) {
 
                if (elgg_instanceof($container, 'group')) {
                        $return['filter'] = '';
-                       if ($container->isMember(elgg_get_logged_in_user_entity())) {
+                       if ($container->canWriteToContainer()) {
                                $url = "blog/add/$container->guid";
                                $params = array(
                                        'href' => $url,

diff --git a/mod/groups/actions/discussion/reply/save.php b/mod/groups/actions/discussion/reply/save.php
index e535856dac994ffc727e7e5ef63e6761aa2d47a0..109938dbb91817e6b0e81735bf142fc9831827c8 100644 (file)
--- a/mod/groups/actions/discussion/reply/save.php
+++ b/mod/groups/actions/discussion/reply/save.php
@@ -25,7 +25,7 @@ if (!$topic) {
 $user = get_loggedin_user();
 
 $group = $topic->getContainerEntity();
-if (!$group->isMember($user)) {
+if (!$group->canWriteToContainer($user)) {
        register_error(elgg_echo('groups:notmember'));
        forward(REFERER);
 }

diff --git a/mod/groups/actions/discussion/save.php b/mod/groups/actions/discussion/save.php
index 0b5d3b51c30416819a9c9b099f1602b090cb885e..a51775cd6d5ae2d13a0356ca117ac92dda7a7b23 100644 (file)
--- a/mod/groups/actions/discussion/save.php
+++ b/mod/groups/actions/discussion/save.php
@@ -21,7 +21,7 @@ if (!$title || !$desc) {
 }
 
 $container = get_entity($container_guid);
-if (!$container || (!$container->isMember() && !$container->canEdit())) {
+if (!$container || !$container->canWriteToContainer()) {
        register_error(elgg_echo('discussion:error:permissions'));
        forward(REFERER);
 }

diff --git a/mod/groups/languages/en.php b/mod/groups/languages/en.php
index dbdc0a128fd233ceddccd86d946da788363e4efc..50baeb8c75997a668066338f60785ddaaee9b3ca 100644 (file)
--- a/mod/groups/languages/en.php
+++ b/mod/groups/languages/en.php
@@ -38,6 +38,7 @@ $english = array(
        'groups:widget:membership' => 'Group membership',
        'groups:widgets:description' => 'Display the groups you are a member of on your profile',
        'groups:noaccess' => 'No access to group',
+       'groups:permissions:error' => 'You do not have the permissions for this',
        'groups:ingroup' => 'in the group',
        'groups:cantedit' => 'You can not edit this group',
        'groups:saved' => 'Group saved',

diff --git a/mod/groups/lib/discussion.php b/mod/groups/lib/discussion.php
index fb70d6c00125040fc6fb306c760e903e5f3d5454..1813c87aa0c7979d0d2583ea9d7d68661caea557 100644 (file)
--- a/mod/groups/lib/discussion.php
+++ b/mod/groups/lib/discussion.php
@@ -67,7 +67,7 @@ function discussion_handle_list_page($guid) {
                'filter' => '',
        );
 
-       if (!$group->isMember() && !$group->canEdit()) {
+       if (!$group->canWriteToContainer()) {
                $params['buttons'] = '';
        }
 
@@ -91,7 +91,12 @@ function discussion_handle_edit_page($type, $guid) {
                        register_error(elgg_echo('group:notfound'));
                        forward();
                }
-               group_gatekeeper();
+
+               // make sure user has permissions to write to container
+               if (!$group->canWriteToContainer()) {
+                       register_error(elgg_echo('groups:permissions:error'));
+                       forward($group->getURL());
+               }
 
                $title = elgg_echo('groups:addtopic');
 
@@ -169,7 +174,7 @@ function discussion_handle_view_page($guid) {
                        'show_add_form' => false,
                ));
                $content .= elgg_view('discussion/closed');
-       } elseif ($group->isMember() || elgg_is_admin_logged_in()) {
+       } elseif ($group->canWriteToContainer() || elgg_is_admin_logged_in()) {
                $content .= elgg_view('discussion/replies', array(
                        'entity' => $topic,
                        'show_add_form' => true,

diff --git a/mod/groups/start.php b/mod/groups/start.php
index 18fb9abd5820d35b6a41893fcb4f8c90dc44715f..e04485bb2f596998c594d77e34fb4f3e6760ad82 100644 (file)
--- a/mod/groups/start.php
+++ b/mod/groups/start.php
@@ -392,13 +392,15 @@ function groups_read_acl_plugin_hook($hook, $entity_type, $returnvalue, $params)
  */
 function groups_write_acl_plugin_hook($hook, $entity_type, $returnvalue, $params) {
        $page_owner = elgg_get_page_owner_entity();
-       if (!$loggedin = elgg_get_logged_in_user_entity()) {
+       $user_guid = $params['user_id'];
+       $user = get_entity($user_guid);
+       if (!$user) {
                return $returnvalue;
        }
 
        // only insert group access for current group
-       if ($page_owner instanceof ElggGroup && $loggedin) {
-               if ($page_owner->isMember($loggedin)) {
+       if ($page_owner instanceof ElggGroup) {
+               if ($page_owner->canWriteToContainer($user_guid)) {
                        $returnvalue[$page_owner->group_acl] = elgg_echo('groups:group') . ': ' . $page_owner->name;
 
                        unset($returnvalue[ACCESS_FRIENDS]);
@@ -408,7 +410,7 @@ function groups_write_acl_plugin_hook($hook, $entity_type, $returnvalue, $params
                // this won't be a problem once the group itself owns the acl.
                $groups = elgg_get_entities_from_relationship(array(
                                        'relationship' => 'member',
-                                       'relationship_guid' => $loggedin->getGUID(),
+                                       'relationship_guid' => $user_guid,
                                        'inverse_relationship' => FALSE,
                                        'limit' => 999
                                ));
@@ -707,7 +709,7 @@ function discussion_add_to_river_menu($hook, $type, $return, $params) {
                if (elgg_instanceof($object, 'object', 'groupforumtopic')) {
                        if ($item->annotation_id == 0) {
                                $group = $object->getContainerEntity();
-                               if ($group->isMember() || elgg_is_admin_logged_in()) {
+                               if ($group->canWriteToContainer() || elgg_is_admin_logged_in()) {
                                        $options = array(
                                                'name' => 'reply',
                                                'href' => "#groups-reply-$object->guid",

diff --git a/mod/groups/views/default/river/object/groupforumtopic/create.php b/mod/groups/views/default/river/object/groupforumtopic/create.php
index 2c914c3f8755a7c4223033b4a1910dce04c41e7b..ca47473380f7a02c16946a6e9d290f47eca49c17 100644 (file)
--- a/mod/groups/views/default/river/object/groupforumtopic/create.php
+++ b/mod/groups/views/default/river/object/groupforumtopic/create.php
@@ -34,7 +34,7 @@ if ($excerpt) {
        echo '</div>';
 }
 
-if (elgg_is_logged_in() && $container->isMember(elgg_get_logged_in_user_entity())) {
+if (elgg_is_logged_in() && $container->canWriteToContainer()) {
        // inline comment form
        echo elgg_view_form('discussion/reply/save', array(
                'id' => "groups-reply-{$object->getGUID()}",