diff --git a/media_gallery.module b/media_gallery.module index 70f3932..2fe5043 100644 --- a/media_gallery.module +++ b/media_gallery.module @@ -61,8 +61,8 @@ function media_gallery_menu() { $items['media-gallery/detail/%node/%file'] = array( 'page callback' => 'media_gallery_detail_page', 'page arguments' => array(2, 3), - 'access callback' => 'node_access', - 'access arguments' => array('view', 2), + 'access callback' => 'media_gallery_view_item_access', + 'access arguments' => array(2, 3), 'file' => 'media_gallery.pages.inc', ); $items['media-gallery/detail/%node/%file/view'] = array( @@ -75,8 +75,8 @@ function media_gallery_menu() { 'title' => 'Edit', 'page callback' => 'media_gallery_media_page_edit', 'page arguments' => array(2, 3), - 'access callback' => 'media_access', - 'access arguments' => array('edit'), + 'access callback' => 'media_gallery_edit_item_access', + 'access arguments' => array(2, 3), 'weight' => 0, 'type' => MENU_LOCAL_TASK, 'context' => MENU_CONTEXT_PAGE | MENU_CONTEXT_INLINE, @@ -99,10 +99,10 @@ function media_gallery_menu() { $items['media-gallery/lightbox/%node/%file'] = array( 'page callback' => 'media_gallery_lightbox_page', 'page arguments' => array(2, 3), - 'access callback' => 'node_access', - 'access arguments' => array('view', 2), + 'access callback' => 'media_gallery_view_item_access', + 'access arguments' => array(2, 3), 'file' => 'media_gallery.pages.inc', - 'delivery callback' => 'media_gallery_lightbox_page_deliver', + 'delivery callback' => 'media_gallery_lightbox_delivery_callback', ); $items['media-gallery/add-images/%node/%'] = array( 'access callback' => 'media_gallery_edit_access_ajax', @@ -279,14 +279,19 @@ function media_gallery_view($node, $view_mode) { // time building the render structure for items that won't be shown. if ($view_mode == 'teaser') { if (!empty($node->media_gallery_media[LANGUAGE_NONE])) { - $first_item = array_shift($node->media_gallery_media[LANGUAGE_NONE]); - $node->media_gallery_media[LANGUAGE_NONE] = array($first_item); + if (media_access('view')) { + $first_item = array_shift($node->media_gallery_media[LANGUAGE_NONE]); + $node->media_gallery_media[LANGUAGE_NONE] = array($first_item); + } + else { + $node->media_gallery_media[LANGUAGE_NONE] = array(); + } } } // For the full display, implement pagination. elseif ($view_mode == 'full' || $view_mode == 'media_gallery_block') { $full = $view_mode == 'full' ? TRUE : FALSE; - if (!empty($node->media_gallery_media)) { + if (!empty($node->media_gallery_media) && media_access('view')) { $media = $full ? $node->media_gallery_media[LANGUAGE_NONE] : $node->media_gallery_media_original[LANGUAGE_NONE]; } else { @@ -549,7 +554,7 @@ function media_gallery_block_info() { function media_gallery_block_view($delta = '') { $node = node_load($delta); $block['subject'] = check_plain($node->title); - if (empty($node->media_gallery_media_original)) { + if (empty($node->media_gallery_media_original) || !media_access('view')) { // Bail out now if there won't be any media items to show. $block['content'] = t('No content available.'); } @@ -1347,6 +1352,19 @@ function media_gallery_get_default_gallery_collection() { } /** + * Access callback for viewing parts of a node that are only relevant for media + * galleries. + */ +function media_gallery_view_access($node) { + if (!node_access('view', $node)) { + return FALSE; + } + if ($node->type == 'media_gallery') { + return TRUE; + } +} + +/** * Access callback for editing parts of a node that are only relevant for media * galleries. */ @@ -1360,11 +1378,45 @@ function media_gallery_edit_access($node) { } /** + * Access callback for viewing a media item in a gallery. + * + * @param $node + * The gallery node object. + * @param $file + * The file to view. + * + * @return + * TRUE if access is granted; FALSE otherwise. + */ +function media_gallery_view_item_access($node, $file) { + // Only grant access if the user can view the gallery and the provided media + return media_gallery_view_access($node) && media_access('view') + && in_array($file->fid, media_gallery_get_file_ids($node)); +} + +/** + * Access callback for editing a media item in a gallery. + * + * @param $node + * The gallery node object. + * @param $file + * The file to view. + * + * @return + * TRUE if access is granted; FALSE otherwise. + */ +function media_gallery_edit_item_access($node, $file) { + // Only grant access if the user can view the gallery and edit the provided media + return media_gallery_view_access($node) && media_access('edit') + && in_array($file->fid, media_gallery_get_file_ids($node)); +} + +/** * Access callback for editing parts of a node that are only relevant for media * galleries. */ function media_gallery_multiedit_access($node) { - if (media_gallery_edit_access($node)) { + if (media_gallery_edit_access($node) && media_access('edit')) { $node = new FieldsRSIPreventor($node); if (count($node->getAllItems('media_gallery_media')) > 0 ) { return TRUE; @@ -1678,3 +1730,17 @@ function media_gallery_file_default_displays() { return $default_displays; } + +/** + * Menu page delivery callback. + * This is a delegate function. In case, the user has no access to the menu + * item, the menu system does not load the specified file and therefore can + * not use the custom deliver function. + */ +function media_gallery_lightbox_delivery_callback($page_content) { + if (!function_exists('media_gallery_lightbox_page_deliver')) { + module_load_include('inc', 'media_gallery', 'media_gallery.pages'); + } + media_gallery_lightbox_page_deliver($page_content); +} + diff --git a/media_gallery.pages.inc b/media_gallery.pages.inc index 2d84ab7..2d07015 100644 --- a/media_gallery.pages.inc +++ b/media_gallery.pages.inc @@ -107,7 +107,13 @@ function media_gallery_lightbox_page($gallery_node, $file) { function media_gallery_lightbox_page_deliver($page_content) { // Display an error message if something went wrong. if (!isset($page_content) || is_int($page_content)) { - $content = array('#markup' => t('An unexpected error occurred. Please try again later.')); + if (is_int($page_content) && $page_content == MENU_ACCESS_DENIED) { + watchdog('access denied', check_plain($_GET['q']), NULL, WATCHDOG_WARNING); + $content = array('#markup' => t('You are not authorized to access this page.')); + } + else { + $content = array('#markup' => t('An unexpected error occurred. Please try again later.')); + } } // This shouldn't happen, but just in case. elseif (is_string($page_content)) { @@ -117,7 +123,6 @@ function media_gallery_lightbox_page_deliver($page_content) { else { $content = $page_content; } - // Render the main page content, and nothing else. We don't want to call // drupal_render_page() because the results of this function are inserted // into a
on the parent page, so we can't print a full HTML document. diff --git a/media_gallery.theme.inc b/media_gallery.theme.inc index 7fd7942..3b1c45b 100644 --- a/media_gallery.theme.inc +++ b/media_gallery.theme.inc @@ -76,7 +76,12 @@ function theme_media_gallery_teaser($variables) { // Organize the file count by type. We only expect images and videos for // now, so we put those first and group the others together into a general // category at the end. - $type_count = media_gallery_get_media_type_count($node, 'media_gallery_media_original'); + if (media_access('view')) { + $type_count = media_gallery_get_media_type_count($node, 'media_gallery_media_original'); + } + else { + $type_count = array(); + } $description = array(); if (isset($type_count['image'])) { $count = $type_count['image'];