Changed access::user_can to force the owner of an item to have

view permission on the parent. Added a whitelist of allowable
owner permissions.

If the requested permission is view and the user requesting access
is the owner, check that they have view permission to the parent.

1 files changed, 14 insertions, 3 deletions

diff --git a/modules/gallery/helpers/access.php b/modules/gallery/helpers/access.php
index 2faa922b..4f737c7f 100644
--- a/modules/gallery/helpers/access.php
+++ b/modules/gallery/helpers/access.php
@@ -95,13 +95,24 @@ class access_Core {
       return false;
     }
 
-    if ($user->admin && $item->owner_id == $user->id) {
+    if ($user->admin) {
       return true;
     }
 
-    $resource = $perm_name == "view" ?
-      $item : model_cache::get("access_cache", $item->id, "item_id");
+    print "Before owner id check\n";
+    if ($item->owner_id == $user->id  &&
+        in_array($perm_name, array("view_full", "edit", "add"))) {
+      return true;
+    }
+
+    if ($perm_name == "view") {
+      $resource = $item->owner_id == $user->id ? $item->parent() : $item;
+    } else {
+      $resource = model_cache::get("access_cache", $item->id, "item_id");
+    }
+    print Kohana::debug($resource->as_array()) . "\n";
     foreach ($user->groups as $group) {
+      print "$group->name\n";
       if ($resource->__get("{$perm_name}_{$group->id}") === self::ALLOW) {
         return true;
       }