I'm pretty new to drupal and I hope to get the solution here. Goes like this: I have a content type named "property" and a calendar attached to each node of this content type. In the permissions section the calendar has "Access bookable item's calendar" which controls who has access to the calendar pages. One of the roles "propertyadmin" has this permission set. Now comes the problem - All users having that role has the same permission and can edit all other calendar pages. I think the problem is here in the calendar module because it doesn't have any conditional logic to check whether the user accessing the calendar is the owner of the referenced node.
Can anyone help? Here is the code:
` function property_calendar_menu() {
$items = array();
$items['admin/property/items/%property_item/calendar'] = array(
'title' => t('Calendar'),
'page callback' => 'drupal_get_form',
'page arguments' => array('property_calendar_admin_form', 3, 5, 6),
'access arguments' => array('access property_item calendar'),
'type' => MENU_LOCAL_TASK,
'context' => MENU_CONTEXT_PAGE | MENU_CONTEXT_INLINE,
'file' => 'includes/property_calendar.admin.inc',
);
$items['node/%node/calendar'] = array(
'title' => t('Calendar'),
'page callback' => 'property_calendar_overview',
'page arguments' => array(1, 3, 4),
'access callback' => 'property_calendar_overview_access',
'access arguments' => array(1),
'type' => MENU_LOCAL_TASK,
'weight' => 4,
'context' => MENU_CONTEXT_PAGE | MENU_CONTEXT_INLINE,
'file' => 'includes/property_calendar.admin.inc',
);
$items['custom_calendar/ajax'] = array(
'title' => 'AHAH callback',
'page callback' => 'custom_calendar_status_ajax',
'page arguments' => array(2, 3, 4),
'delivery callback' => 'ajax_deliver',
'access callback' => TRUE,
'theme callback' => 'ajax_base_page_theme',
'type' => MENU_CALLBACK,
);
return $items;
}
/**
* Access callback for overview form.
*/
function custom_calendar_overview_access($node) {
// Foreach field.
foreach (field_info_fields() as $field) {
// If field is entityreference, targets a property_item
// and it belongs to a node.
if ($field['type'] == 'entityreference' and $field['settings']['target_type'] == 'property_item' and isset($field['bundles']['node'])) {
// If current node's type has this field.
if (in_array($node->type, $field['bundles']['node'])) {
return user_access('access property_item calendar');
}
}
}
return FALSE;
}
`
