Fixes #1830. Removed access and write access inputs for non-owners and non-admins.

diff --git a/mod/pages/actions/pages/edit.php b/mod/pages/actions/pages/edit.php
index 6950d4b2fe3246c4087faf57c0dbd16edb166ae5..a32e4a4ba4847cf5c00d9f69e34d2db32ec4bea8 100644 (file)
--- a/mod/pages/actions/pages/edit.php
+++ b/mod/pages/actions/pages/edit.php
@@ -47,7 +47,19 @@ if ($page_guid) {
 }
 
 if (sizeof($input) > 0) {
+       // don't change access if not an owner/admin
+       $user = elgg_get_logged_in_user_entity();
+       $can_change_access = true;
+
+       if ($user && $page) {
+               $can_change_access = $user->isAdmin() || $user->getGUID() == $page->owner_guid;
+       }
+       
        foreach ($input as $name => $value) {
+               if (($name == 'access_id' || $name == 'write_access_id') && !$can_change_access) {
+                       continue;
+               }
+
                $page->$name = $value;
        }
 }
@@ -74,6 +86,6 @@ if ($page->save()) {
 
        forward($page->getURL());
 } else {
-       register_error(elgg_echo('pages:error:no_save'));
+       register_error(elgg_echo('pages:error:notsaved'));
        forward(REFERER);
 }

diff --git a/mod/pages/lib/pages.php b/mod/pages/lib/pages.php
index 5c5323d6fc22c0434c712f9db9342a0cefdcfd25..dbf7b8917af1d2ddcec63abd8a8849367218d2e4 100644 (file)
--- a/mod/pages/lib/pages.php
+++ b/mod/pages/lib/pages.php
@@ -111,4 +111,4 @@ function pages_register_navigation_tree($container) {
                        }
                }
        }
-}
+}
\ No newline at end of file

diff --git a/mod/pages/views/default/forms/pages/edit.php b/mod/pages/views/default/forms/pages/edit.php
index 20737a121c2e0b3a221601da30f34416bcaa6a52..9469f5eb9cc87f794fdb3b25e10dfd4346199fd1 100644 (file)
--- a/mod/pages/views/default/forms/pages/edit.php
+++ b/mod/pages/views/default/forms/pages/edit.php
@@ -6,7 +6,18 @@
  */
 
 $variables = elgg_get_config('pages');
+$user = elgg_get_logged_in_user_entity();
+$entity = elgg_extract('entity', $vars);
+$can_change_access = true;
+if ($user && $entity) {
+       $can_change_access = ($user->isAdmin() || $user->getGUID() == $entity->owner_guid);
+}
+
 foreach ($variables as $name => $type) {
+       // don't show read / write access inputs for non-owners or admin when editing
+       if (($type == 'access' || $type == 'write_access') && !$can_change_access) {
+               continue;
+       }
 ?>
 <div>
        <label><?php echo elgg_echo("pages:$name") ?></label>
@@ -14,8 +25,8 @@ foreach ($variables as $name => $type) {
                if ($type != 'longtext') {
                        echo '<br />';
                }
-       ?>
-       <?php echo elgg_view("input/$type", array(
+
+               echo elgg_view("input/$type", array(
                        'name' => $name,
                        'value' => $vars[$name],
                ));