Hopefully this will be easy to implement but anyone can see the job track tickets, if they know the URL.

e.g. http://www.numediaadvantage.co.uk/ticket/6/93

Thanks,

David

P.S. Thanks for the module - so far it looks great!

Comments

dubs’s picture

dubs commented

I have some code here which fixes this problem - I don't know if this fits into your module well, but here it is: -

/**
 * Implementation of hook_load().
 */
function jobtrack_load($node) {
	if ($node->type == 'jobtrack_ticket') {
		// check the user can access this client's tickets
		global $user;
		$client = jobtrack_client_load($node->client);
		if (!jobtrack_access_clients($client, $user)) {
			drupal_goto("user");
		}
	}
}
jeremy’s picture

jeremy commented
Status: Active » Fixed

Thanks, you were on the right track but I think this is best implemented in jobtrack_access(). Fix committed.

liliplanet’s picture

liliplanet commented

Hi,

Thank you for this wonderful module. I applied the fix, but still 'View recent tickets' appears on the profile page for all users (when it should only be for moderators). The permissions are correct.

What I've done as a temporary fix added :

<? unset($profile[t('summary')]);
foreach ($profile AS $k => $v) {
  print $v;
}?>

to user-profile.tpl.php

Is there perhaps something I can add to template.php to remove tickets from the user pages please. (using content_profile)

Look forward to any reply.
Lilian

jeremy’s picture

jeremy commented

Giving this a little thought, I agree that a user's tickets should not be visible on their profile page unless you have "adminsiter jobtrack" permission. Otherwise a client could see all of an admin's tickets, which is clearly not a good thing.

Fix committed

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.