' . t('Permissions let you control what users can do on your site. Each user role (defined on the user roles page) has its own set of permissions. For example, you could give users classified as "Administrators" permission to "administer nodes" but deny this power to ordinary, "authenticated" users. You can use permissions to reveal new features to privileged users (those with subscriptions, for example). Permissions also allow trusted users to share the administrative burden of running a busy site.', array('@role' => url('admin/user/roles'))) . '
'; case 'admin/user/roles': - return t('Roles allow you to fine tune the security and administration of Drupal. A role defines a group of users that have certain privileges as defined in user permissions. Examples of roles include: anonymous user, authenticated user, moderator, administrator and so on. In this area you will define the role names of the various roles. To delete a role choose "edit".
By default, Drupal comes with two user roles:
-A role defines a group of users that share a common set of privileges as defined in user permissions. Examples of roles include: moderator, administrator and so on. Authenticated user and Anonymous user are two default roles that cannot be deleted.
', array('@permissions' => url('admin/user/permissions'))); case 'admin/user/search': return '' . t('Enter a simple pattern ("*" may be used as a wildcard match) to search for a username or e-mail address. For example, one may search for "br" and Drupal might return "brian", "brad", and "brenda@example.com".') . '
'; } @@ -2373,7 +2391,6 @@ function user_forms() { $forms['user_admin_access_add_form']['callback'] = 'user_admin_access_form'; $forms['user_admin_access_edit_form']['callback'] = 'user_admin_access_form'; - $forms['user_admin_new_role']['callback'] = 'user_admin_role'; return $forms; } @@ -2783,4 +2800,25 @@ return empty($groups) ? FALSE : $groups; } - +/** + * Determine what operation can happen to which roles + * @param $op + * The operation being performed on the role + * - "edit" + * - "delete" + * @param $rid + * The unique id of the role + * @return + * TRUE if the operation may be performed + */ +function user_role_access($op, $rid = NULL) { + $is_protected_role = ($rid == DRUPAL_ANONYMOUS_RID || $rid == DRUPAL_AUTHENTICATED_RID); + if( + !user_access('administer permissions') || //not allowed + !key_exists($rid, user_roles()) || //nonexistent role + ($op == 'delete' && $is_protected_role) //protected role + ){ + return false; + } + return true; +} Index: modules/user/user.admin.inc =================================================================== RCS file: /cvs/drupal/drupal/modules/user/user.admin.inc,v retrieving revision 1.37 diff -u -r1.37 user.admin.inc --- modules/user/user.admin.inc 3 Feb 2009 18:55:32 -0000 1.37 +++ modules/user/user.admin.inc 10 Mar 2009 21:42:06 -0000 @@ -656,97 +656,125 @@ } /** - * Menu callback: administer roles. + * Implementation of add and edit form for roles * * @ingroup forms * @see user_admin_role_validate() * @see user_admin_role_submit() - * @see theme_user_admin_new_role() */ -function user_admin_role() { - $rid = arg(4); +function user_admin_role($form_id, $rid = NULL) { if ($rid) { - if ($rid == DRUPAL_ANONYMOUS_RID || $rid == DRUPAL_AUTHENTICATED_RID) { - drupal_goto('admin/user/roles'); - } - // Display the edit role form. - $role = db_fetch_object(db_query('SELECT * FROM {role} WHERE rid = %d', $rid)); - $form['name'] = array( - '#type' => 'textfield', - '#title' => t('Role name'), - '#default_value' => $role->name, - '#size' => 30, - '#required' => TRUE, - '#maxlength' => 64, - '#description' => t('The name for this role. Example: "moderator", "editorial board", "site architect".'), - ); - $form['rid'] = array( - '#type' => 'value', - '#value' => $rid, - ); - $form['submit'] = array( - '#type' => 'submit', - '#value' => t('Save role'), - ); - $form['delete'] = array( - '#type' => 'submit', - '#value' => t('Delete role'), - ); + $role = db_fetch_object(db_query('SELECT rid, name, description FROM {role} WHERE rid = %d', $rid)); } - else { - $form['name'] = array( - '#type' => 'textfield', - '#size' => 32, - '#maxlength' => 64, - ); - $form['submit'] = array( - '#type' => 'submit', - '#value' => t('Add role'), - ); - $form['#submit'][] = 'user_admin_role_submit'; - $form['#validate'][] = 'user_admin_role_validate'; + $form['name'] = array( + '#type' => 'textfield', + '#title' => t('Role name'), + '#default_value' => isset($role->name) ? check_plain($role->name) : NULL, + '#size' => 30, + '#required' => TRUE, + '#maxlength' => 64, + '#description' => t('The name for this role. Example: "moderator", "editorial board", "site architect".'), + ); + if($rid == DRUPAL_ANONYMOUS_RID || $rid == DRUPAL_AUTHENTICATED_RID) { + $form['name']['#disabled'] = true; + $form['name']['#value'] = t($role->name); } + + $form['description'] = array( + '#type' => 'textarea', + '#title' => t('Description'), + '#default_value' => isset($role->description) ? filter_xss_admin($role->description) : NULL, + '#description' => t('A description of the role to explain what it is for. Example: "Can perform content administration tasks, but cannot ban users."'), + ); + $form['rid'] = array( + '#type' => 'value', + '#value' => $rid, + ); + $form['submit'] = array( + '#type' => 'submit', + '#value' => t('Save role'), + ); + $form['#submit'][] = 'user_admin_role_submit'; + $form['#validate'][] = 'user_admin_role_validate'; return $form; } +/** + * Validation handler for the role administration form + * + * Prevents new and edited roles from being named over existing role names + * + * @ingroup forms + * @see user_admin_role() + * @see user_admin_role_submit() + */ function user_admin_role_validate($form, &$form_state) { - if ($form_state['values']['name']) { - if ($form_state['values']['op'] == t('Save role')) { - if (db_result(db_query("SELECT COUNT(*) FROM {role} WHERE name = '%s' AND rid != %d", $form_state['values']['name'], $form_state['values']['rid']))) { - form_set_error('name', t('The role name %name already exists. Please choose another role name.', array('%name' => $form_state['values']['name']))); - } - } - elseif ($form_state['values']['op'] == t('Add role')) { - if (db_result(db_query("SELECT COUNT(*) FROM {role} WHERE name = '%s'", $form_state['values']['name']))) { - form_set_error('name', t('The role name %name already exists. Please choose another role name.', array('%name' => $form_state['values']['name']))); - } - } - } - else { - form_set_error('name', t('You must specify a valid role name.')); + $role_exists = db_result(db_query("SELECT rid FROM {role} WHERE name = '%s' AND rid != %d", $form_state['values']['name'], $form_state['values']['rid'])); + if ($role_exists) { + form_set_error('name', t('The role name %name already exists. Please choose another role name.', array('%name' => $form_state['values']['name']))); } } - +/** + * Submit handler for the role administration form + * + * Determines if new or existing role by 'rid' then saves or inserts accordingly + * + * @ingroup forms + * @see user_admin_role() + * @see user_admin_role_validate() + */ function user_admin_role_submit($form, &$form_state) { - if ($form_state['values']['op'] == t('Save role')) { - db_query("UPDATE {role} SET name = '%s' WHERE rid = %d", $form_state['values']['name'], $form_state['values']['rid']); - drupal_set_message(t('The role has been renamed.')); - } - elseif ($form_state['values']['op'] == t('Delete role')) { - db_query('DELETE FROM {role} WHERE rid = %d', $form_state['values']['rid']); - db_query('DELETE FROM {role_permission} WHERE rid = %d', $form_state['values']['rid']); - // Update the users who have this role set: - db_query('DELETE FROM {users_roles} WHERE rid = %d', $form_state['values']['rid']); - - drupal_set_message(t('The role has been deleted.')); + if ($form_state['values']['rid']) { + db_query("UPDATE {role} SET name = '%s', description = '%s' WHERE rid = %d", $form_state['values']['name'], $form_state['values']['description'], $form_state['values']['rid']); + drupal_set_message(t('The role has been edited.')); } - elseif ($form_state['values']['op'] == t('Add role')) { - db_query("INSERT INTO {role} (name) VALUES ('%s')", $form_state['values']['name']); + else { + db_query("INSERT INTO {role} (name, description) VALUES ('%s', '%s')", array($form_state['values']['name'], $form_state['values']['description'])); drupal_set_message(t('The role has been added.')); } $form_state['redirect'] = 'admin/user/roles'; return; } +/** + * Implementation of confirmation form for role deletion + * + * @ingroup forms + * @see user_admin_role_delete_submit() + */ +function user_admin_role_delete($form_id, $rid) { + if ($rid == DRUPAL_ANONYMOUS_RID || $rid == DRUPAL_AUTHENTICATED_RID) { + drupal_goto('admin/user/roles'); + } + $form = array(); + $role = db_fetch_object(db_query('SELECT * FROM {role} WHERE rid = %d', $rid)); + $form['rid'] = array( + '#type' => 'value', + '#value' => $rid, + ); + $form = confirm_form($form, + t('Are you sure you want to delete the %title role?', array('%title' => $role->name)), + isset($_GET['destination']) ? $_GET['destination'] : 'admin/user/roles', + t('This action cannot be undone.'), + t('Delete role'), + t('Cancel') + ); + return $form; +} + +/** + * Submit handler for role deletion + * + * @ingroup forms + * @see user_admin_role_delete() + */ +function user_admin_role_delete_submit($form, &$form_state) { + db_query('DELETE FROM {role} WHERE rid = %d', $form_state['values']['rid']); + db_query('DELETE FROM {role_permission} WHERE rid = %d', $form_state['values']['rid']); + // Update the users who have this role set: + db_query('DELETE FROM {users_roles} WHERE rid = %d', $form_state['values']['rid']); + drupal_set_message(t('The role has been deleted.')); + $form_state['redirect'] = 'admin/user/roles'; +} /** * Theme user administration overview. @@ -792,29 +820,34 @@ return $output; } - /** - * Theme the new-role form. + * Displays the role admin overview page. * - * @ingroup themeable */ -function theme_user_admin_new_role($form) { - $header = array(t('Name'), array('data' => t('Operations'), 'colspan' => 2)); - foreach (user_roles() as $rid => $name) { - $edit_permissions = l(t('edit permissions'), 'admin/user/permissions/' . $rid); - if (!in_array($rid, array(DRUPAL_ANONYMOUS_RID, DRUPAL_AUTHENTICATED_RID))) { - $rows[] = array($name, l(t('edit role'), 'admin/user/roles/edit/' . $rid), $edit_permissions); +function user_admin_role_list() { + $header = array(t('Name'), array('data' => t('Operations'), 'colspan' => 3)); + $result = db_query("SELECT r.rid, r.name, r.description FROM {role} r"); + while ($role = db_fetch_object($result)) { + if (!in_array($role->rid, array(DRUPAL_ANONYMOUS_RID, DRUPAL_AUTHENTICATED_RID))) { + $delete = l(t('delete'), 'admin/user/roles/delete/' . $role->rid); } else { - $rows[] = array($name, t('locked'), $edit_permissions); + $delete = t('required'); } + $rows[] = array( + check_plain($role->name) . '