Textpattern CMS support forum
You are not logged in. Register | Login | Help
- Topics: Active | Unanswered
#1 2007-07-29 17:59:33
- ellen
- Member
- From: Switzerland
- Registered: 2006-04-18
- Posts: 41
Restrict author permissons
Hello,
How can I prevent that a user with author permissions changes an image that another user uploaded? It works with articles that you can’t change another author’s entries but there is no such option for images in the permissions file…
Any suggestions?
Last edited by ellen (2007-07-29 18:00:03)
Offline
#2 2007-07-30 04:25:26
- Mary
- Sock Enthusiast
- Registered: 2004-06-27
- Posts: 6,236
Re: Restrict author permissons
At present you can’t, not without making modifications to a few files.
Offline
#3 2007-07-31 10:59:43
- ellen
- Member
- From: Switzerland
- Registered: 2006-04-18
- Posts: 41
Re: Restrict author permissons
Mary,
Could you please give me a hint what modifications I had to make? I would be sufficient if I could hide the ‘save’ button from another user’s eyes… (Not from the one who published the image).
Offline
Re: Restrict author permissons
The easiest ways is probably to disable the edit link in the image list, otherwise you not only have to hide the save button, but also the two upload buttons (replacing images) and the thumbnail create button.
In /textpattern/include/txp_image.php, you’d have to add $txp_user to the list of global variables at the beginning of the ‘image_list’ function and replace this line:
n.t.'<li>'.href(gTxt('edit'), $edit_url).'</li>'.with
($txp_user == $name ? n.t.'<li>'.href(gTxt('edit'), $edit_url).'</li>' : '').To make it more resistant agains nosy users, you could do something similar in the image_edit function, adding $txp_user to the list of global variables and just below the extract($rs); line add this line:
if ($txp_user != $name) return image_list('naughty user!');Offline
#5 2007-08-22 20:29:16
- ellen
- Member
- From: Switzerland
- Registered: 2006-04-18
- Posts: 41
Re: Restrict author permissons
Thank you, works fine! Is there also a possibility to disable the image delete button in the image list?
Offline
Re: Restrict author permissons
sure.
Replace this line:
dLink('image', 'image_delete', 'id', $id, '', '', '', false, array($page, $sort, $dir, $crit, $search_method))with:
($txp_user == $name ? dLink('image', 'image_delete', 'id', $id, '', '', '', false, array($page, $sort, $dir, $crit, $search_method)) : '')And add that ‘naughty user’ line also to the ‘image_delete’ function, similar to what I explained for the ‘image_save’ function.
Offline
#7 2007-08-22 21:02:02
- ellen
- Member
- From: Switzerland
- Registered: 2006-04-18
- Posts: 41
Re: Restrict author permissons
Sorry to be a nuisance – can the following line be modified in the way that the user who uploaded the image can save a new version of it and any other user can’t?
if ($txp_user != $name) return image_list(‘naughty user!’);
Offline
Re: Restrict author permissons
That line should already do that.
Offline
#9 2007-08-22 21:26:19
- ellen
- Member
- From: Switzerland
- Registered: 2006-04-18
- Posts: 41
Re: Restrict author permissons
Unfortunately it doesn’t. With the edit link enabled I can still replace and save another users image while the ‘naughty user’ message is displayed.
Offline
Re: Restrict author permissons
Where did you add the naughty user line?
Offline
#11 2007-08-23 11:34:30
- ellen
- Member
- From: Switzerland
- Registered: 2006-04-18
- Posts: 41
Re: Restrict author permissons
To the image_save and image_delete function:
function image_save()
{
extract(doSlash(gpsa(array('id','name','category','caption','alt'))));
if ($txp_user != $name) return image_list('naughty user!');
$id = assert_int($id);function image_delete()
{
global $txpcfg;
extract($txpcfg);
if ($txp_user != $name) return image_list('naughty user!');Offline
Re: Restrict author permissons
You need global $txpuser; at the top of both functions. And in the image_delete function, move the ‘naughty user’ line to below the line extract($rs);
Last edited by ruud (2007-08-23 12:29:53)
Offline