--- /dev/null
+<?php
+
+/**
+ * @file
+ * Allows access to terms in a vocabulary to be limited by user or role.
+ */
+
+use Drupal\Core\Access\AccessResult;
+use Drupal\Core\Form\FormState;
+use Drupal\permissions_by_term\Controller\PermissionsByTermController;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\node\NodeInterface;
+use Drupal\Core\Session\AccountInterface;
+use Drupal\taxonomy\Entity\Term;
+use Drupal\Core\Routing\RouteMatchInterface;
+use Drupal\Core\Cache\Cache;
+
+/**
+ * Implements hook_help().
+ */
+function permissions_by_term_help($route_name, RouteMatchInterface $arg) {
+ switch ($route_name) {
+ case 'help.page.permissions_by_term':
+ $output = '';
+ $output .= '<h3>' . t('About') . '</h3>';
+ $output .= '<p>' . t('The "Permissions by Term" (PbT) module allows taxonomy administrators the
+ ability to restrict setting individual terms on nodes by user
+ or role. If a user is unable to set any terms for a required
+ vocabulary, they are blocked from adding or editing content with
+ that vocabulary. For more information, see the online documentation for <a href=":PbT-documentation" target="_blan" title="Online Documentation">Permissions by Term</a>.', [':PbT-documentation' => 'https://www.drupal.org/project/permissions_by_term']) . '</p>';
+ $output .= '<h3>' . t('Uses') . '</h3>';
+ $output .= '<dl>';
+ $output .= '<dt>' . t('General') . '</dt>';
+ $output .= '<dd>' . t('Use Permissions by Term to easily build access-restricted content areas on your websites.') . '</dd>';
+ $output .= '<dt>' . t('Lightweight Access Control') . '</dt>';
+ $output .= '<dd>' . t('Permissions by Term restricts user access to specified Drupal nodes based on taxonomy terms - a core part of Drupal’s functionality. PbT lets you restrict content access while relying on very little contributed code.') . '</dd>';
+ $output .= '<dt>' . t('Example use cases') . '</dt>';
+ $output .= '<dd>' . t('A club or service site with premium- or member-only content.') . '</dd>';
+ $output .= '<dd>' . t('School websites with content intended for teachers only and content aimed at individual classes within the school.') . '</dd>';
+ $output .= '<dd>' . t('Company intranets with sensitive or proprietary content alongside non-restricted content.') . '</dd>';
+ $output .= '</dl>';
+
+ return $output;
+ }
+}
+
+/**
+ * Validation handler for permissions_by_term_form_alter().
+ */
+function permissions_by_term_validate($form, FormState $oFormState) {
+ foreach ($form as $field) {
+ if (!is_object($field) && !empty($field['widget']['target_id']['#target_type']) && $field['widget']['target_id']['#target_type'] == 'taxonomy_term') {
+ $field_name = $field['widget']['#field_name'];
+ $terms = $oFormState->getValues()[$field_name]['target_id'];
+ $not_allowed_term_names = [];
+ if (!empty($terms)) {
+ foreach ($terms as $term) {
+ $term_id = $term['target_id'];
+ /* @var \Drupal\permissions_by_term\AccessCheck $access_check_service */
+ $access_check_service = \Drupal::service('permissions_by_term.access_check');
+ if (!$access_check_service->isAccessAllowedByDatabase($term_id)) {
+ $term = Term::load($term_id);
+ $not_allowed_term_names[] = $term->getName();
+ }
+ }
+ }
+ }
+ }
+ if (!empty($not_allowed_term_names)) {
+ if (count($not_allowed_term_names) > 1) {
+ $term_names = implode(', ', $not_allowed_term_names);
+ }
+ else {
+ $term_names = $not_allowed_term_names['0'];
+ }
+ $oFormState->setErrorByName('field_tags', t('You are not allowed to use specific taxonomy terms like the following: "term-names". Remove the restricted taxonomy terms from the form field and try again.',
+ ['term-names' => $term_names]));
+ }
+}
+
+/**
+ * Submit handler for permissions_by_term_form_alter().
+ */
+function permissions_by_term_submit($form, FormState $formState) {
+ $termId = $formState->getFormObject()->getEntity()->id();
+ /* @var \Drupal\permissions_by_term\AccessStorage $access_storage */
+ $access_storage = \Drupal::service('permissions_by_term.access_storage');
+ $access_storage->saveTermPermissions($formState, $termId);
+ /**
+ * @var \Drupal\permissions_by_term\NodeAccess $nodeAccess
+ */
+ $nodeAccess = \Drupal::service('permissions_by_term.node_access');
+ $nodeAccess->rebuildByTid($termId, $formState);
+ Cache::invalidateTags(['search_index:node_search']);
+}
+
+/**
+ * Implements hook_form_alter().
+ */
+function permissions_by_term_form_taxonomy_term_form_alter(&$form, FormStateInterface $oFormState, $form_id) {
+ if (\Drupal::currentUser()->hasPermission('show term permission form on term page')) {
+ $iTermId = $oFormState->getFormObject()->getEntity()->id();
+
+ /* @var \Drupal\permissions_by_term\AccessStorage $access_storage */
+ $access_storage = \Drupal::service('permissions_by_term.access_storage');
+
+ $form['access'] = [
+ '#type' => 'fieldset',
+ '#title' => t('Permissions'),
+ '#description' => t('To limit access to this term by user or roles,
+ add users or roles to the following lists. Leave empty to allow
+ node access by single node view, node listing in views and taxonomy
+ term selection by all users.'),
+ '#collapsible' => TRUE,
+ '#collapsed' => TRUE,
+ '#attributes' => ['id' => 'fieldset_term_access'],
+ '#weight' => -5,
+ '#tree' => TRUE,
+ ];
+
+ $aAllowedUsers = $access_storage->getAllowedUserIds($iTermId);
+ if (!empty($aAllowedUsers)) {
+ $aAllowedUsers = user_load_multiple($aAllowedUsers);
+ $sUserFormValue = $access_storage->getUserFormValue($aAllowedUsers);
+ }
+ else {
+ $sUserFormValue = NULL;
+ }
+
+ // Note that the autocomplete widget will only enable for users with the
+ // 'access profiles' permission. Other users will have to specify the name
+ // manually.
+ $form['access']['user'] = [
+ '#type' => 'entity_autocomplete',
+ '#target_type' => 'user',
+ '#title' => t('Allowed users'),
+ '#description' => t('Enter a comma-seperated list of user names to give') . ' ' .
+ t('them permission to use this term and access related nodes in single node view
+ and views listings.'),
+ '#value' => $sUserFormValue,
+ '#size' => 60,
+ '#autocomplete_route_name' => 'permissions_by_term.autocomplete_multiple',
+ '#weight' => -10,
+ ];
+
+ $aAllowedRoles = $access_storage->getExistingRoleTermPermissionsByTid($iTermId);
+
+ // Firstly fetch all translated allowed role names.
+ $aTranslatedAllowedRoleNames = [];
+ foreach ($aAllowedRoles as $role) {
+ $aTranslatedAllowedRoleNames[] = $role;
+ }
+
+ // Get all roles for the complete form and translate them.
+ $aTranslatedUserRoles = [];
+ $array_key_counter = 1;
+ foreach (user_roles() as $user_role_id => $user_role_name) {
+ $aTranslatedUserRoles[$user_role_id] = $user_role_name->label();
+ $array_key_counter++;
+ }
+
+ // Generate the default values for the form.
+ $aSetRoles = [];
+ if (!empty($aTranslatedAllowedRoleNames)) {
+ foreach ($aTranslatedAllowedRoleNames as $role_name) {
+ $aSetRoles[] = $role_name;
+ }
+ }
+
+ // Now, lets do the Roles table.
+ $form['access']['role'] = [
+ '#type' => 'checkboxes',
+ '#title' => t('Allowed roles'),
+ '#description' => t('Select a role to allow all members of this role to
+ use this term and access related nodes in single node view and views
+ listings.'),
+ '#default_value' => $aSetRoles,
+ '#options' => $aTranslatedUserRoles,
+ '#multiple' => FALSE,
+ '#weight' => 5,
+ ];
+
+ $form['#validate'][] = 'permissions_by_term_validate';
+ $form['actions']['submit']['#submit'][] = 'permissions_by_term_submit';
+ }
+}
+
+/**
+ * Implements hook_form_alter().
+ */
+function permissions_by_term_form_alter(&$form, FormStateInterface $oFormState, $form_id) {
+ $form['#validate'][] = 'permissions_by_term_validate';
+}
+
+/**
+ * Implements hook_node_access().
+ *
+ * Forwards user by drupal_access_denied(); to an access denied page, if a
+ * single restricted node is called.
+ *
+ * This hook is not fired if admin is logged in. Users with the
+ * "bypass node access" permission may always view and edit content
+ * through the administrative interface.
+ */
+function permissions_by_term_node_access(NodeInterface $node, $op, AccountInterface $account) {
+ if (method_exists($node, 'id') && $op == 'view') {
+ if (!$node->isPublished() && !$account->hasPermission('Bypass content access control', $account)) {
+ return AccessResult::forbidden();
+ }
+
+ /* @var \Drupal\permissions_by_term\AccessCheck $access_check_service */
+ $access_check_service = \Drupal::service('permissions_by_term.access_check');
+ $oPermissionsByTermController = new PermissionsByTermController($access_check_service);
+
+ return $oPermissionsByTermController->handleNode($node->id());
+ }
+}
+
+/**
+ * Implements hook_node_grants().
+ */
+function permissions_by_term_node_grants(\Drupal\Core\Session\AccountInterface $account, $op)
+{
+ if ($op == 'view') {
+ /**
+ * @var \Drupal\permissions_by_term\AccessStorage $accessStorage
+ */
+ $accessStorage = \Drupal::service('permissions_by_term.access_storage');
+ $grants = $accessStorage->getGidsByRealm('permissions_by_term__uid_' . \Drupal::currentUser()->id());
+
+ return $grants;
+ }
+}
+
+/**
+ * Implements hook_node_access_records().
+ *
+ * Permissions can be rebuild at /admin/reports/status/rebuild.
+ */
+function permissions_by_term_node_access_records(\Drupal\node\NodeInterface $node) {
+ /**
+ * @var \Drupal\permissions_by_term\NodeAccess $nodeAccess
+ */
+ $nodeAccess = \Drupal::service('permissions_by_term.node_access');
+ $grantsForThisNode = $nodeAccess->createGrants($node->id());
+
+ $grants = [];
+ if (!empty($grantsForThisNode)) {
+ foreach ($grantsForThisNode as $grantObject) {
+ $grants[] = [
+ 'realm' => $grantObject->realm,
+ 'gid' => $grantObject->gid,
+ 'grant_view' => $grantObject->grant_view,
+ 'grant_update' => $grantObject->grant_update,
+ 'grant_delete' => $grantObject->grant_delete,
+ 'langcode' => $grantObject->langcode,
+ 'fallback' => 1,
+ 'nid' => $node->id(),
+ ];
+ }
+ }
+
+ return $grants;
+}
+
+/**
+ * Implements hook_user_insert().
+ */
+function permissions_by_term_user_insert($user) {
+ /**
+ * @var \Drupal\permissions_by_term\NodeAccess $nodeAccess
+ */
+ $nodeAccess = \Drupal::service('permissions_by_term.node_access');
+ $nodeAccess->rebuildByUid($user->id(), TRUE);
+ Cache::invalidateTags(['search_index:node_search']);
+}
+
+/**
+ * Implements hook_user_update().
+ */
+function permissions_by_term_user_update($user) {
+ /**
+ * @var \Drupal\permissions_by_term\NodeAccess $nodeAccess
+ */
+ $nodeAccess = \Drupal::service('permissions_by_term.node_access');
+ $nodeAccess->rebuildByUid($user->id());
+ Cache::invalidateTags(['search_index:node_search']);
+}
+
+/**
+ * Implements hook_node_insert().
+ */
+function permissions_by_term_node_insert($node) {
+ /**
+ * @var \Drupal\permissions_by_term\NodeAccess $nodeAccess
+ */
+ $nodeAccess = \Drupal::service('permissions_by_term.node_access');
+ $nodeAccess->rebuildByNid($node->id());
+ Cache::invalidateTags(['search_index:node_search']);
+}
projects / yaffs-website / blobdiff