I'm looking for a way to overwrite this:
if (user_access('edit own availability calendars')) {
$output .= ' '. l('edit', 'availability-calendars/'. $node->nid .'/'. date('Y/m', mktime(0, 0, 0, $month, 1, $year)) .'/edit',
array('query' => 'destination=node/'. $node->nid));
}
It doesn't work now and can't find support at the module page. Since every user has the same role they can all access and edit each others calendars so it gives a major security risk. I can't seem to find the right argument to replace "if (user_access('edit own availability calendars'))"
It should be that it checks if the node's author = the logged in user. If that's true, it may give the output, otherwise not.
Does anybody know what argument to put there ?
THANKS !
Comments
have you tried
have you tried this?
I can't seem to implement this in the module
Thanks for the reply but I can't seem to get this implemented in the module
this is the full function
but this has a security risk because this argument let's all users of the same role edit each others calendars and that's not good.
Can you tell me where and how I implement your code ?
Thanks !
"...but this has a security
"...but this has a security risk because this argument let's all users of the same role edit each others calendars and that's not good.."
why there's still security risk mentioned above if u are using the following code?
"if ($user->uid != $node->uid && $user->uid != 1) {"
...but..looks u have forgotten to add "global $user;" in your function.....
I"m trying to rewrite
I'm trying to rewrite the availbility calendar module because there is no maintenance for the moment and I need the module.
If you use the module now you can only assign roles to edit the calendars and since alle users on my site that can edit the calendars have the same roles, everyone can now edit each others calenders :(
I was hoping it would be easy to rewrite it so that only the calendars owner could edit it but i'm stuck.
Addin global $user; doesn't seem to do the trick :(
Thanks for the tip dough
Any other suggestions ?
I was thinking to solve the problem by creating a block to say "edit my calendar" that would only appear when an argument checks if the logged in user is also the nodes author but I can't seem the right code
I'm still learning php so it's often to tricky
can u tell what is missing
can u tell what is missing (or what is wrong) in the module?
that may help us to modify the module for u...
I think there is something wrong with the user access
I think there is something wrong with the user access of "edit own availability calendars"
When you grant a role user access "edit own availability calendars" they can not only edit their own calendars but every users calendar and I would like to change that. Users should only be permitted to edit calendars on nodes that they created.
the full code is this
If someone could fix this problem you'd be doing me a huge favour
thanks
*** I have no time to do a
*** I have no time to do a full test, so,....At Your Own Risk. ***
in availability_calendars.module, theme function ...
That's it !
That's it ! thanks mm167 !
When you now grant everyone permission edit calendars AND edit own calendars the logged in user can only edit his own calendar.
Thanks, you're a lifesaver !