Heine

  • home
  • drupal
  • drupal core commits
  • about
Home › Drupal Core Commits

Commit 261948 by dries

- Patch #470840 by salvis, sinasquax, sun: fixed bug in node_access() if we specify an account. Extend filter_access() to take custom account.

--- modules/filter/filter.module        2009/09/11 15:39:48     1.288
+++ modules/filter/filter.module        2009/09/12 06:09:45     1.289
@@ -390,17 +390,31 @@
 
 /**
  * Retrieve a list of text formats.
+ *
+ * @param $format
+ *   (optional) The text format to retrieve; if omitted or NULL, retrieve an
+ *   array of accessible text formats.
+ * @param $account
+ *   (optional) The user account to retrieve accessible text formats for; if
+ *   omitted, the currently logged-in user is used.
+ *
+ * @return
+ *   Either one text format object or a list of text format objects, depending
+ *   on the $format parameter. FALSE if the user does not have access to the
+ *   given text $format.
  */
-function filter_formats($index = NULL) {
+function filter_formats($format = NULL, $account = NULL) {
   global $user;
-  static $formats;
+  $formats = &drupal_static(__FUNCTION__, array());
 
-  // Administrators can always use all text formats.
-  $all = user_access('administer filters');
+  if (!isset($account)) {
+    $account = $user;
+  }
 
-  if (!isset($formats)) {
-    $formats = array();
+  // Administrators can always use all text formats.
+  $all = user_access('administer filters', $account);
 
+  if (!isset($formats[$account->uid])) {
     $query = db_select('filter_format', 'f');
     $query->addField('f', 'format', 'format');
     $query->addField('f', 'name', 'name');
@@ -418,12 +432,12 @@
       $query->condition($or);
     }
 
-    $formats = $query->execute()->fetchAllAssoc('format');
+    $formats[$account->uid] = $query->execute()->fetchAllAssoc('format');
   }
-  if (isset($index)) {
-    return isset($formats[$index]) ? $formats[$index] : FALSE;
+  if (isset($format)) {
+    return isset($formats[$account->uid][$format]) ? $formats[$account->uid][$format] : FALSE;
   }
-  return $formats;
+  return $formats[$account->uid];
 }
 
 /**
@@ -651,16 +665,27 @@
 }
 
 /**
- * Returns TRUE if the user is allowed to access this format.
+ * Returns whether a user is allowed to access a given text format.
+ *
+ * @param $format
+ *   The format of a text to be filtered. Specify FILTER_FORMAT_DEFAULT for
+ *   the site's default text format.
+ * @param $account
+ *   (optional) The user account to check access for; if omitted, the currently
+ *   logged-in user is used.
+ *
+ * @return
+ *   Boolean TRUE if the user is allowed to access the given format.
+ *
+ * @see filter_formats()
  */
-function filter_access($format) {
+function filter_access($format, $account = NULL) {
   $format = filter_resolve_format($format);
-  if (user_access('administer filters') || ($format == variable_get('filter_default_format', 1))) {
+  if (user_access('administer filters', $account) || ($format == variable_get('filter_default_format', 1))) {
     return TRUE;
   }
   else {
-    $formats = filter_formats();
-    return isset($formats[$format]);
+    return (bool) filter_formats($format, $account);
   }
 }
 

--- modules/filter/filter.test  2009/09/11 15:39:48     1.40
+++ modules/filter/filter.test  2009/09/12 06:09:45     1.41
@@ -26,6 +26,10 @@
 
     list($filtered, $full) = $this->checkFilterFormats();
 
+    // Verify access permissions to Full HTML format.
+    $this->assertTrue(filter_access($full, $admin_user), t('Admin user may use Full HTML.'));
+    $this->assertFalse(filter_access($full, $web_user), t('Web user may not use Full HTML.'));
+
     // Change default filter.
     $edit = array();
     $edit['default'] = $full;

No votes yet
  • Drupal Core
  • Download patch

Recent posts

  • Bugfix woes for Drupal 6
  • Arbitrary PHP code execution in modx 1.0.0 via CSRF
  • The #drupal consultant
  • Varnish vs. page cache graph
  • FAPI - How to decrease/increase the text limit of textfields?
more

Tags

Captcha CSRF Drupal Let's hope it doesn't become popular modx Performance PHP Pitfalls Planet Drupal Security V-PowerServer Varnish
more tags
  • home
  • drupal
  • drupal core commits
  • about

Copyright © 2009 by Heine Deelstra. All rights reserved.