I was just looking at the sql that builds the array of events in event_calendar_data() and it does not look like this sql statement is checking for non-moderated nodes. If this is handled somewhere else, please excuse the bug report. I just noticed this and thought I would ask about it before it becomes an issue for someone. Here is line 933 in the current 4.7 version of the module (v1.183.2.2 signed on 2006/03/28):

    $result = db_query(db_rewrite_sql('SELECT n.nid, e.event_start FROM {node} n INNER JOIN {event} e ON n.nid = e.nid WHERE n.status = 1 AND ((e.event_start > %d AND e.event_start < %d) OR (e.event_end > %d AND e.event_end < %d) OR (e.event_start < %d AND e.event_end > %d)) ORDER BY event_start '), $first, $last, $first, $last, $first, $last);

Note that n.status = 1 is checked for, but n.moderate = 0 is not being checked for.

I tried creating an event and then checking "In moderation cue" and the node still shows up in the calendar.

CommentFileSizeAuthor
#2 event_moderate_patch_0.txt3.47 KBpwolanin

Comments

pwolanin’s picture

pwolanin commented

Yes, I just noticed this as well. The check for moderation is done is building the list for the block, but not the calendar or feeds:

// $Id: event.module,v 1.183.2.6 2006/05/22 13:54:07 killes Exp $ 

function event_block_upcoming($limit = 6) {
  global $user;
  // For two hours, we display "NOW"
  $time = time() - (2 * 60 * 60);
  $result = db_query(db_rewrite_sql('SELECT n.nid, n.title, n.type, n.status, n.moderate, n.changed, e.event_start FROM {node} n INNER JOIN {event} e ON n.nid = e.nid WHERE n.status = 1 AND n.moderate = 0 AND e.event_start >= %d ORDER BY event_start'), $time);
...

I'll try to make a patch for this, since we want to let all members submit events, but to moderate them before they show.

pwolanin’s picture

pwolanin commented
Title: moderation check? » moderation check missing
Status: Active » Needs review
StatusFileSize
new event_moderate_patch_0.txt3.47 KB

patch attached- only changes 3 SQL queries to require that "n.moderate = 0" for calendar display, RSS, or ical.

Tested with drupal 4.7.2, MySQL 4.1, PHP 4.4.

pwolanin’s picture

pwolanin commented

I've been using this patch on a live site with no problems- it solves the problem for us of how to allow more users to add to the (public) calendar while insuring that the evetns are relevant to the organization. Please review, since I think it's RTBC.

killes@www.drop.org’s picture

killes@www.drop.org commented
Status: Needs review » Fixed

applied to 4.7.

pwolanin’s picture

pwolanin commented

Thanks- obviously there is no need to port it forward to 5.x.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)