db_rewrite for projects not respecting some perms

Hi Hunmonk,

I may be wrong, but I don't think the problem is the category module and I was hoping you'll take another look at this and see if you can help. I think the problem is in the access restrictions within the function project_db_rewrite_sql in project.module. Unfortunately, I don't have enough expertise in php to sort it out and I am hoping you can help me.

On my site, I have 2 groups of users with different access roles: 'lecturer' & 'student'. Both roles have 'access projects' & 'access issues' but only the 'lecturer' role has 'access issues' ('student' role users can only 'access own issues'). Users of both roles need to have access to project types regardless of who creates the content.

I found that if I set 'student' role users up to 'access issues' then they are able to view projects types created by users of 'lecturer' roles - but I need them to be able to 'access projects' but only 'access own issues'. I may be wrong, but here's the section of code that I think I need to modify

    if (module_exists('project_issue')) {
      $access_issues = user_access('access project issues');
      $access_own_issues = user_access('access own project issues');
      $types .= ", 'project_issue'";
    }
    else {
      $access_issues = TRUE;
      $access_own_issues = TRUE;
    }
    if ($admin_projects || ($access_projects && $access_issues)) {
      // User has full access, nothing to re-write.
      return;
    }
    else {
      // We have to make sure {node} is in the query and know the alias.
      if ($primary_table == 'n' || $primary_table == 'node') {
        // Great, it's the primary table and we already know the alias.
        $alias = $primary_table;
      }
      else {
        // Look for {node} in the query.
        if (!($alias = project_find_alias($query, 'node'))) {
          // Not already in the query, JOIN it.
          $return['join'] = "INNER JOIN {node} pn ON pn.nid = ". $primary_table .'.nid';
          $alias = 'pn';
        }
      }
    }
    // At this point, we know we have to restrict something, and we know what
    // the {node} table's alias is in the query.
    $where = array();

    // First, if the type is not one of the project* ones, we don't care.
    $where[] = "($alias.type NOT IN ($types))";

    // Now, see if the current user can access their own, and allow those.
    global $user;
    $uid = $user->uid;
    if (!$access_projects && user_access('access own projects')) {
      $where[] = "($alias.type = 'project_project' AND $alias.uid = $uid)";
    }
    if (!$access_issues && $access_own_issues) {
      $where[] = "($alias.type = 'project_issue' AND $alias.uid = $uid)";
    }

Thank you very much.

Meant to say the problem is NOT the category module - sorry, typo error :)

Thanks Hunmonk,

Once again I apologise - I am yet to get my head round how all of these works :) Please bear with me.

The modules installed and enabled are as follows: CCK, event, node profile, organic groups, actions, active select, automatic nodetitles, content templates, date api, panels, pathauto, subform element, token, user import, project and views. I've excluded the core - optional modules or the individual items within the groups (please let me know if you need to know the individual items & the core - optional ones enabled). Category is installed but currently disabled after I found out enabling it was the cause of the error:

Duplicate entry '1' for key 1 query: INSERT INTO vocabulary (vid, name, description, help, multiple, required, hierarchy, relations, tags, weight, module) VALUES (1, 'Project release API compatibility', '', '', 0, 0, 1, 0, 0, 0, 'project_release') in \includes\database.mysql.inc on line 172

I hope this is enough information. And by the way, I've found that I needed to allow 'student' role users to "maintain projects" and "administer projects" before they can 'add project release' or 'view projects'. And I am hoping I can write some code to hide the menu items in navigation from them if that's the only way to give them access to projects and project release - I'll give it a shot anyway.

Thanks.

Hi Hunmonk,

Did as you suggested - no change. I installed a new drupal site, enabled only the project modules (didn't even enable og project - since I wasn't enabling og) and after setting up roles / users, logged in as the lecturer role user and created the content as before. Users of 'lecturer' role have rights to "access own projects, access projects, maintain projects / access own project issues, access project issues, create project issues etc". Users of 'student' role have rights to "access own projects, access projects / access own project issues, create project issues etc." Only users of 'lecturer' role was able to create Project content (which is great and as it should be), but only users of this role was able to view the content - as before (the screenshots attached shows the view of project listing page for my 'student' & 'lecturer' role users).

However, even if it had worked, it wouldn't have been an ideal solution as I need project to be able to work with events & og modules at the very least.

dantina.

A list of permissions attached - and please accept my apologies (I forgot to attach the screenshot referred to in my last post).

Thanks a lot, Hunmonk for being so patient with me :)

dantina