#24 - Check availability of Comment/Vote/Share actions.

cmts.php

@@ -14,9 +14,9 @@ bx_import('BxDolLanguages');
 
 check_logged();
 
-$sSys = isset($_REQUEST['sys']) ? $_REQUEST['sys'] : '';
-$iObjectId = (int)$_REQUEST['id'];
-$sAction = isset($_REQUEST['action']) && preg_match ('/^[A-Za-z_-]+$/', $_REQUEST['action']) ? $_REQUEST['action'] : '';
+$sSys = isset($_REQUEST['sys']) ? bx_process_input($_REQUEST['sys']) : '';
+$iObjectId = isset($_REQUEST['id']) ? bx_process_input($_REQUEST['id'], BX_DATA_INT) : 0;
+$sAction = isset($_REQUEST['action']) && preg_match ('/^[A-Za-z_-]+$/', $_REQUEST['action']) ? bx_process_input($_REQUEST['action']) : '';
 
 bx_import('BxDolCmts');
 $oCmts = BxDolCmts::getObjectInstance($sSys, $iObjectId, true);

inc/classes/BxDolCmts.php

@@ -183,12 +183,11 @@ class BxDolCmts extends BxDol
         parent::BxDol();
 
         $this->_aSystems = $this->getSystems();
+		if(!isset($this->_aSystems[$sSystem]))
+			return;
 
         $this->_sSystem = $sSystem;
-        if(isset($this->_aSystems[$sSystem]))
-            $this->_aSystem = $this->_aSystems[$sSystem];
-        else
-            return;
+        $this->_aSystem = $this->_aSystems[$sSystem];
 
 		$this->_aSystem['table_images'] = 'sys_cmts_images';
 		$this->_aSystem['table_images2entries'] = 'sys_cmts_images2entries';

modules/boonex/timeline/classes/BxTimelineMenuItem.php

@@ -93,6 +93,18 @@ class BxTimelineMenuItem extends BxTemplMenu {
 
 			case 'item-comment':
                 $sCheckFuncName = 'isAllowedComment';
+                if(!empty($this->_aEvent))
+                	$aCheckFuncParams = array($this->_aEvent);
+                break;
+
+			case 'item-vote':
+                $sCheckFuncName = 'isAllowedVote';
+                if(!empty($this->_aEvent))
+                	$aCheckFuncParams = array($this->_aEvent);
+                break;
+
+			case 'item-share':
+                $sCheckFuncName = 'isAllowedShare';
                 if(!empty($this->_aEvent))
                 	$aCheckFuncParams = array($this->_aEvent);
                 break;

modules/boonex/timeline/classes/BxTimelineModule.php

@@ -621,12 +621,42 @@ class BxTimelineModule extends BxDolModule
 		$oCmts = $this->getCmtsObject($sSystem, $iObjectId);
     	$oCmts->addCssJs();
 
+    	$iUserId = (int)$this->getUserId();
+    	if($iUserId == 0)
+    		return false;
+
 		if(isAdmin())
 			return true;
 
         return $oCmts->isPostReplyAllowed($bPerform);
     }
 
+	public function isAllowedVote($aEvent, $bPerform = false)
+    {
+    	$iUserId = (int)$this->getUserId();
+    	if($iUserId == 0)
+    		return false;
+
+    	if(isAdmin())
+			return true;
+
+		$aCheckResult = checkActionModule($iUserId, 'vote', $this->getName(), $bPerform);
+        return $aCheckResult[CHECK_ACTION_RESULT] == CHECK_ACTION_RESULT_ALLOWED;
+    }
+
+    public function isAllowedShare($aEvent, $bPerform = false)
+    {
+    	$iUserId = (int)$this->getUserId();
+    	if($iUserId == 0)
+    		return false;
+
+    	if(isAdmin())
+			return true;
+
+		$aCheckResult = checkActionModule($iUserId, 'share', $this->getName(), $bPerform);
+        return $aCheckResult[CHECK_ACTION_RESULT] == CHECK_ACTION_RESULT_ALLOWED;
+    }
+
 	public function onPost($iId)
     {
     	$aEvent = $this->_oDb->getEvents(array('browse' => 'id', 'value' => $iId));

modules/boonex/timeline/install/langs/en.xml

@@ -50,7 +50,8 @@
 
 	<string name="_bx_timeline_acl_action_post"><![CDATA[Post]]></string>
 	<string name="_bx_timeline_acl_action_delete"><![CDATA[Delete]]></string>
-	<string name="_bx_timeline_acl_action_comment"><![CDATA[Comment]]></string>
+	<string name="_bx_timeline_acl_action_vote"><![CDATA[Vote]]></string>
+	<string name="_bx_timeline_acl_action_share"><![CDATA[Share]]></string>
 
 	<string name="_bx_timeline_page_title_sys_view"><![CDATA[Timeline]]></string>
 	<string name="_bx_timeline_page_title_view"><![CDATA[Timeline]]></string>

modules/boonex/timeline/install/sql/enable.sql

@@ -106,6 +106,14 @@ INSERT INTO `sys_acl_actions` (`Module`, `Name`, `AdditionalParamName`, `Title`,
 ('bx_timeline', 'delete', NULL, '_bx_timeline_acl_action_delete', '', 1, 1);
 SET @iIdActionDelete = LAST_INSERT_ID();
 
+INSERT INTO `sys_acl_actions` (`Module`, `Name`, `AdditionalParamName`, `Title`, `Desc`, `Countable`, `DisabledForLevels`) VALUES
+('bx_timeline', 'vote', NULL, '_bx_timeline_acl_action_vote', '', 1, 1);
+SET @iIdActionVote = LAST_INSERT_ID();
+
+INSERT INTO `sys_acl_actions` (`Module`, `Name`, `AdditionalParamName`, `Title`, `Desc`, `Countable`, `DisabledForLevels`) VALUES
+('bx_timeline', 'share', NULL, '_bx_timeline_acl_action_share', '', 1, 1);
+SET @iIdActionShare = LAST_INSERT_ID();
+
 SET @iUnauthenticated = 1;
 SET @iStandard = 2;
 SET @iUnconfirmed = 3;
@@ -125,7 +133,19 @@ INSERT INTO `sys_acl_matrix` (`IDLevel`, `IDAction`) VALUES
 
 -- delete
 (@iModerator, @iIdActionDelete),
-(@iAdministrator, @iIdActionDelete);
+(@iAdministrator, @iIdActionDelete),
+
+-- vote
+(@iStandard, @iIdActionVote),
+(@iModerator, @iIdActionVote),
+(@iAdministrator, @iIdActionVote),
+(@iPremium, @iIdActionVote),
+
+-- share
+(@iStandard, @iIdActionShare),
+(@iModerator, @iIdActionShare),
+(@iAdministrator, @iIdActionShare),
+(@iPremium, @iIdActionShare);
 
 
 -- ALERTS