Changeset 25845 for extensions/AdminTools/include

Timestamp:

Dec 8, 2013, 2:53:40 PM (11 years ago)

Author:

mistic100

Message:

photo owner has access to quick edit and delete !

File:

• extensions/AdminTools/include/events.inc.php (modified) (8 diffs)

extensions/AdminTools/include/events.inc.php

@@ -8 +8 @@
 function admintools_add_public_controller()
 {
-  global $MultiView, $conf, $template, $page, $user;
-
-  if (!$MultiView->is_admin())
+  global $MultiView, $conf, $template, $page, $user, $picture;
+
+  $url_root = get_root_url();
+  $tpl_vars = array();
+
+  if ($MultiView->is_admin())
+  { // full options for admin
+    $tpl_vars['U_SITE_ADMIN'] =     $url_root . 'admin.php?page=';
+    $tpl_vars['MULTIVIEW'] =        $MultiView->get_data();
+    $tpl_vars['USER'] =             $MultiView->get_user();
+    $tpl_vars['CURRENT_USERNAME'] = $user['id']==$conf['guest_id'] ? l10n('guest') : $user['username'];
+    $tpl_vars['DELETE_CACHE'] =     isset($conf['multiview_invalidate_cache']);
+
+    include_once(PHPWG_ROOT_PATH . 'include/functions_mail.inc.php');
+    switch_lang_to(get_default_language());
+  }
+  else if (script_basename() == 'picture' and $picture['current']['added_by'] == $user['id'])
+  { // only "edit" button for photo owner
+  }
+  else
   {
     return;
   }
 
-  $url_root = get_root_url();
-
-  $tpl_vars = array(
-    'U_SITE_ADMIN' =>     $url_root . 'admin.php?page=',
-    'MULTIVIEW' =>        $MultiView->get_data(),
-    'U_SELF' =>           $MultiView->get_clean_url(true),
-    'USER' =>             $MultiView->get_user(),
-    'CURRENT_USERNAME' => $user['id']==$conf['guest_id'] ? l10n('guest') : $user['username'],
-    'PWG_TOKEN' =>        get_pwg_token(),
-    'DELETE_CACHE' =>     isset($conf['multiview_invalidate_cache']),
-    );
-
-  // switch_lang is in mail functions file
-  include_once(PHPWG_ROOT_PATH . 'include/functions_mail.inc.php');
-
-  switch_lang_to(get_default_language());
-
-  // TODO : param to allow owner modification
+  $tpl_vars['U_SELF'] = $MultiView->get_clean_url(true);
+
+  // photo page
   if (script_basename() == 'picture')
   {
-    global $picture;
-
-    include_once(PHPWG_ROOT_PATH . 'admin/include/functions.php');
-
     $url_self = duplicate_picture_url();
-
     $tpl_vars['IS_PICTURE'] = true;
 
-    $template->clear_assign(array(
-      'U_SET_AS_REPRESENTATIVE',
-      'U_PHOTO_ADMIN',
-      'U_CADDIE',
-      ));
-
-    $template->set_prefilter('picture', 'admintools_remove_privacy');
-
-    $query = '
+    // admin can add to caddie and set representattive
+    if ($MultiView->is_admin())
+    {
+      $template->clear_assign(array(
+        'U_SET_AS_REPRESENTATIVE',
+        'U_PHOTO_ADMIN',
+        'U_CADDIE',
+        ));
+
+      $template->set_prefilter('picture', 'admintools_remove_privacy');
+
+      $tpl_vars['U_CADDIE'] = add_url_params(
+        $url_self,
+        array('action'=>'add_to_caddie')
+        );
+
+      $query = '
 SELECT element_id FROM ' . CADDIE_TABLE . '
   WHERE element_id = ' . $page['image_id'] .'
 ;';
-    $tpl_vars['IS_IN_CADDIE'] = pwg_db_num_rows(pwg_query($query)) > 0;
-
-    if (isset($page['category']))
-    {
-      $tpl_vars['CATEGORY_ID'] = $page['category']['id'];
-
-      $tpl_vars['U_SET_REPRESENTATIVE'] = add_url_params(
-        $url_self,
-        array('action'=>'set_as_representative')
-        );
-
-      $query = '
+      $tpl_vars['IS_IN_CADDIE'] = pwg_db_num_rows(pwg_query($query)) > 0;
+
+      if (isset($page['category']))
+      {
+        $tpl_vars['CATEGORY_ID'] = $page['category']['id'];
+
+        $tpl_vars['U_SET_REPRESENTATIVE'] = add_url_params(
+          $url_self,
+          array('action'=>'set_as_representative')
+          );
+
+        $query = '
 SELECT id FROM ' . CATEGORIES_TABLE.'
   WHERE id = ' . $page['category']['id'] .'
     AND representative_picture_id = ' . $page['image_id'] .'
 ;';
-      $tpl_vars['IS_REPRESENTATIVE'] = pwg_db_num_rows(pwg_query($query)) > 0;
-    }
-
-    $tpl_vars['U_EDIT'] = $url_root . 'admin.php?page=photo-' . $page['image_id']
-      .(isset($page['category']) ? '&cat_id=' . $page['category']['id'] : '');
-
-    $tpl_vars['U_CADDIE'] = add_url_params(
-      $url_self,
-      array('action'=>'add_to_caddie')
+        $tpl_vars['IS_REPRESENTATIVE'] = pwg_db_num_rows(pwg_query($query)) > 0;
+      }
+
+      $tpl_vars['U_ADMIN_EDIT'] = $url_root . 'admin.php?page=photo-' . $page['image_id']
+        .(isset($page['category']) ? '&cat_id=' . $page['category']['id'] : '');
+    }
+
+    $tpl_vars['U_DELETE'] = add_url_params(
+      $url_self, array(
+        'delete'=>'',
+        'pwg_token'=>get_pwg_token()
+        )
       );
 
     // gets tags (full available list is loaded in ajax)
+    include_once(PHPWG_ROOT_PATH . 'admin/include/functions.php');
+
     $query = '
 SELECT id, name
@@ -102 +112 @@
       );
   }
-  else if (@$page['section'] == 'categories' and isset($page['category']))
+  // album page (admin only)
+  else if ($MultiView->is_admin() and @$page['section'] == 'categories' and isset($page['category']))
   {
     $url_self = duplicate_index_url();
@@ -114 +125 @@
       ));
 
-    $tpl_vars['U_EDIT'] = $url_root . 'admin.php?page=album-' . $page['category']['id'];
+    $tpl_vars['U_ADMIN_EDIT'] = $url_root . 'admin.php?page=album-' . $page['category']['id'];
 
     if (!empty($page['items']))
@@ -151 +162 @@
   $template->parse('ato_public_controller');
 
-  switch_lang_back();
+  if ($MultiView->is_admin())
+  {
+    switch_lang_back();
+  }
 }
 
@@ -170 +184 @@
 function admintools_save_picture()
 {
-  global $page, $conf, $MultiView;
-
-  if (!$MultiView->is_admin())
+  global $page, $conf, $MultiView, $user, $picture;
+
+  $query = 'SELECT added_by FROM '. IMAGES_TABLE .' WHERE id = '. $page['image_id'] .';';
+  list($added_by) = pwg_db_fetch_row(pwg_query($query));
+
+  if (!$MultiView->is_admin() && $user['id'] != $added_by)
   {
     return;
@@ -205 +222 @@
       'name' =>   $_POST['name'],
       'author' => $_POST['author'],
-      'level' =>  $_POST['level'],
-      );
+      );
+
+    if ($MultiView->is_admin())
+    {
+      $data['level'] = $_POST['level'];
+    }
 
     if ($conf['allow_html_descriptions'])
@@ -249 +270 @@
     return;
   }
-  
+
   if (@$_POST['action'] == 'quick_edit')
   {
@@ -270 +291 @@
       array('id' => $page['category']['id'])
       );
-      
+
     redirect(duplicate_index_url());
   }