0

I'm pretty new to drupal and I hope to get the solution here. Goes like this: I have a content type named "property" and a calendar attached to each node of this content type. In the permissions section the calendar has "Access bookable item's calendar" which controls who has access to the calendar pages. One of the roles "propertyadmin" has this permission set. Now comes the problem - All users having that role has the same permission and can edit all other calendar pages. I think the problem is here in the calendar module because it doesn't have any conditional logic to check whether the user accessing the calendar is the owner of the referenced node.

Can anyone help? Here is the code:

` function property_calendar_menu() {
$items = array();

$items['admin/property/items/%property_item/calendar'] = array(
'title' => t('Calendar'),
'page callback' => 'drupal_get_form',
'page arguments' => array('property_calendar_admin_form', 3, 5, 6),
'access arguments' => array('access property_item calendar'),
'type' => MENU_LOCAL_TASK,
'context' => MENU_CONTEXT_PAGE | MENU_CONTEXT_INLINE,
'file' => 'includes/property_calendar.admin.inc',
);

$items['node/%node/calendar'] = array(
'title' => t('Calendar'),
'page callback' => 'property_calendar_overview',
'page arguments' => array(1, 3, 4),
'access callback' => 'property_calendar_overview_access',
'access arguments' => array(1),
'type' => MENU_LOCAL_TASK,
'weight' => 4,
'context' => MENU_CONTEXT_PAGE | MENU_CONTEXT_INLINE,
'file' => 'includes/property_calendar.admin.inc',
);

$items['custom_calendar/ajax'] = array(
'title' => 'AHAH callback',
'page callback' => 'custom_calendar_status_ajax',
'page arguments' => array(2, 3, 4),
'delivery callback' => 'ajax_deliver',
'access callback' => TRUE,
'theme callback' => 'ajax_base_page_theme',
'type' => MENU_CALLBACK,
);

return $items;
}

/** * Access callback for overview form. */
function custom_calendar_overview_access($node) {
// Foreach field.
foreach (field_info_fields() as $field) {
// If field is entityreference, targets a property_item
// and it belongs to a node.
if ($field['type'] == 'entityreference' and $field['settings']['target_type'] == 'property_item' and isset($field['bundles']['node'])) {
// If current node's type has this field.
if (in_array($node->type, $field['bundles']['node'])) {
return user_access('access property_item calendar');
}
}
}

return FALSE;
}
`

0

$items['node/%node/calendar'] = array( ...

'access callback' => 'node_access',
'access arguments' => array('update', 1),

I manage to solve this part. I still need help for the first URL

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.