project_project_access() in project.inc can restrict project creation for users that don't have a CVS account. This is configured in cvs.module, but needs to be in here because node_access() doesn't provide the necessary hooks for cvs.module to accomplish this by itself.

Of course, versioncontrol_project also needs to have this check (we don't want any regressions, right?) so I added the same option there. As it doesn't depend on Project*, it can't rely on this check being done, so for the general case a validation failure prevents new projects being created for users without accounts. But that's not a nice solution really, so in addition to this check I'd like to have a snippet like the attached one in modules that provide project node types which are likely to be used with the Version Control API. First and foremost, this includes project.inc.

Also, I removed the check for $uid == 1, because as you can see in node_access(), hook_access() is never called for people with user_access('administer nodes').

Please review and, if applicable, apply.

Comments

agentrickard’s picture

I think we need a more elegant solution here than a module-specific check.

dww’s picture

Status: Needs review » Closed (won't fix)

This whole approach is changing and this module-specific hack is no longer needed for vc_project.

dww’s picture

Title: Restrict node access by versioncontrol_project too » Cleanup node access hacks from versioncontrol_project
Version: 5.x-1.x-dev » 6.x-1.x-dev
Category: feature » task
Status: Closed (won't fix) » Postponed

Heh, we ended up having to commit a very similar patch over at #1028396: Restrict project creation to users that can use version control. So, I'm turning this issue back into the cleanup task for after #834252: [meta] Port Project to Drupal 7 is done when there's an alter hook for this.