diff --git a/ad.module b/ad.module index eb0bad5..3186ac7 100644 --- a/ad.module +++ b/ad.module @@ -186,12 +186,7 @@ function ad($group = FALSE, $quantity = 1, $options = array()) { break; } - if (user_access('show advertisements')) { - return theme('ad_display', $group, $output, $options['ad_display']); - } - else { - return theme('ad_display', 'none', ""); - } + return theme('ad_display', $group, $output, $options['ad_display']); } /** @@ -543,7 +538,8 @@ function ad_perm() { 'edit any advertisement', 'delete own advertisements', 'delete any advertisement', - 'show advertisements'); + 'view own advertisements', + 'view any advertisement'); } /** @@ -566,17 +562,11 @@ function ad_access($op, $node, $account) { case 'create': return (user_access('create advertisements', $account) || user_access('administer advertisements')); case 'update': - return (user_access('edit any advertisement', $account) || (user_access('edit own advertisements', $account) && is_ad_owner($node->nid)) || user_access('administer advertisements', $account)); + return (user_access('edit any advertisement', $account) || (user_access('edit own advertisements', $account) && _ad_is_owner($node,$account)) || user_access('administer advertisements', $account)); case 'delete': - return (user_access('delete any advertisement', $account) || (user_access('delete own advertisements', $account) && is_ad_owner($node->nid)) || user_access('administer advertisements', $account)); + return (user_access('delete any advertisement', $account) || (user_access('delete own advertisements', $account) && _ad_is_owner($node,$account)) || user_access('administer advertisements', $account)); case 'view': - // Return false if user doesn't have basic permissions to view - // advertisements. Don't return true to let default Drupal - // domain/node access checks happen. - if (!user_access('show advertisements', $account) && - !user_access('administer advertisements', $account)) { - return false; - } + return (user_access('view any advertisement', $account) || (user_access('view own advertisements', $account) && _ad_is_owner($node,$account)) || user_access('administer advertisements', $account)); } } @@ -902,7 +892,7 @@ function ad_form_alter(&$form, &$form_state, $form_id) { * Implementation of hook_db_rewrite_sql(). */ function ad_db_rewrite_sql($query, $primary_table, $primary_field, $args) { - if (variable_get('ad_no_search', 1) && !user_access('administer advertisements') && !user_access('edit any advertisement') && $query == '' && $primary_table == 'n' && $primary_field = 'nid' && empty($args)) { + if (variable_get('ad_no_search', 1) && !user_access('administer advertisements') && !user_access('view any advertisement') && $query == '' && $primary_table == 'n' && $primary_field = 'nid' && empty($args)) { return array('where' => " n.type != 'ad'"); } } @@ -1200,10 +1190,11 @@ function ad_menu() { ); $items["ad/redirect/%"] = array( - 'access arguments' => array('show advertisements'), 'type' => MENU_CALLBACK, 'page callback' => 'ad_redirect', 'page arguments' => (array(2)), + 'access callback' => 'ad_permission', + 'access arguments' => array(1, 'access url redirect'), ); return $items; @@ -1302,6 +1293,12 @@ function ad_permission($aid, $string, $account = NULL) { return FALSE; } + /* Anyone can get a url redirect */ + if ($string == 'access url redirect') { + return TRUE; + } + + // by default, check permission for current user if (!isset($account)) { $account = $user; @@ -1500,11 +1497,6 @@ function _ad_check_installation() { variable_set('ad_group_vid_restore', ''); } - $rid = db_result(db_query_range("SELECT rid FROM {permission} WHERE perm LIKE '%%show advertisements%%'", 1)); - if (!$rid) { - drupal_set_message(t('Be sure to enable "!show" permissions for all roles that you wish to see advertisements.', array('!show' => l(t('show advertisements'), 'admin/user/permissions')))); - } - // Allow modules to define an action to take each time an ad is served. // When modules define 'adserve_select' or 'adserve_filter', they must set // the 'function' and 'path' parameters. The 'weight' parameter can @@ -1612,3 +1604,10 @@ function _ad_get_group($nid) { return $groups[$nid]; } +function _ad_is_owner($ad, $account) { + if (module_exists('ad_owners')) { + return is_owner($ad->nid); + } else { + return ($ad->uid == $account->uid); + } +} diff --git a/ad.pages.inc b/ad.pages.inc index 281642f..d766899 100644 --- a/ad.pages.inc +++ b/ad.pages.inc @@ -10,11 +10,11 @@ function theme_node_ad($node, $yield_form = TRUE) { $output = ''; - if (ad_permission($node, 'access statistics')) { + if (ad_permission($node->aid, 'access statistics')) { $output = theme('ad_status_display', $node); $output .= theme('ad_statistics_display', ad_statistics($node->nid)); } - if (ad_permission($node, 'access click history')) { + if (ad_permission($node->aid, 'access click history')) { $header = array( array('data' => t('Time'), 'field' => 'timestamp', 'sort' => 'desc'), array('data' => t('User'), 'field' => 'uid'), @@ -253,7 +253,7 @@ function ad_click_details($node, $cid) { function ad_activity_details($node) { $output = ''; drupal_set_breadcrumb(array(l(t('Home'), NULL), l(check_plain($node->title), 'node/'. $node->nid))); - if (ad_permission($node, 'access click history')) { + if (ad_permission($node-aid, 'access click history')) { $header = array( array('data' => t('Date'), 'field' => 'date', 'sort' => 'desc'), array('data' => t('Action'), 'field' => 'action')); diff --git a/adcache.inc b/adcache.inc index 7a707de..5ff69eb 100644 --- a/adcache.inc +++ b/adcache.inc @@ -233,15 +233,8 @@ function adserve_cache_id($type, $id) { $ids = array(); if (isset($result)) { - while ($ad = db_fetch_object($result)) { - // perform node access check - $node = node_load($ad->aid); - if (node_access('view', $node) !== FALSE) { - $ids[$ad->aid] = $ad->aid; - } - else { - _debug_echo("adserve_cache_id: Ad '$ad->aid' failed access check."); - } + while ($record = db_fetch_object($result)) { + $ids[] = $record->aid; } } return $ids; diff --git a/image/ad_image.module b/image/ad_image.module index a695b9d..5abcc5e 100644 --- a/image/ad_image.module +++ b/image/ad_image.module @@ -347,7 +347,9 @@ function ad_image_adapi($op, $node) { } if (empty($node)) { if (variable_get('file_downloads', FILE_DOWNLOADS_PUBLIC) == FILE_DOWNLOADS_PRIVATE) { - drupal_set_message(t('Your website is configured to use Drupal\'s private !method. You have to enable "!view" permissions in addition to the ad module\'s standard "!show" permissions for all roles that you wish to view image advertisements.', array('!method' => l(t('download method'), 'admin/settings/file-system'), '!view' => l(t('view uploaded files'), 'admin/user/access'), '!show' => l(t('show advertisements'), 'admin/user/access')))); + drupal_set_message(t('Your website is configured to use Drupal\'s private !method. You have to enable "!view" permissions for all roles that you wish to view image advertisements.', + array('!method' => l(t('download method'), 'admin/settings/file-system'), '!view' => l(t('view uploaded files'), 'admin/user/access'), + '!show' => l(t('show advertisements'), 'admin/user/access')))); } }