Ticket #1602 - Disable popup preview and view item page for images from Photos module in Timeline when View Photo ACL action isn't allowed.

modules/base/general/classes/BxBaseModGeneralModule.php

@@ -981,6 +981,7 @@ class BxBaseModGeneralModule extends BxDolModule
             'sample_action' => isset($CNF['T']['txt_sample_action']) ? $CNF['T']['txt_sample_action'] : '',
             'url' => BX_DOL_URL_ROOT . BxDolPermalinks::getInstance()->permalink('page.php?i=' . $CNF['URI_VIEW_ENTRY'] . '&id=' . $aContentInfo[$CNF['FIELD_ID']]),
             'content' => $this->_getContentForTimelinePost($aEvent, $aContentInfo, $aBrowseParams), //a string to display or array to parse default template before displaying.
+            'allowed_view' => method_exists($this, 'checkAllowedView') ? $this->checkAllowedView($aContentInfo) : CHECK_ACTION_RESULT_ALLOWED,
             'date' => $aContentInfo[$CNF['FIELD_ADDED']],
             'views' => $aViews,
             'votes' => $aVotes,

modules/boonex/photos/classes/BxPhotosModule.php

@@ -133,6 +133,18 @@ class BxPhotosModule extends BxBaseModTextModule
     {
         return $iContentId > 0 ? CHECK_ACTION_RESULT_ALLOWED : CHECK_ACTION_RESULT_NOT_ALLOWED;
     }
+    
+    protected function _getImagesForTimelinePost($aEvent, $aContentInfo, $sUrl, $aBrowseParams = array())
+    {
+        $aImages = parent::_getImagesForTimelinePost($aEvent, $aContentInfo, $sUrl, $aBrowseParams);
+
+        $bView = $this->checkAllowedView($aContentInfo) === CHECK_ACTION_RESULT_ALLOWED;
+        foreach($aImages as $iKey => $aImage)
+            if(!$bView)
+                unset($aImages[$iKey]['src_orig']);
+
+        return $aImages;
+    }
 }
 
 /** @} */

modules/boonex/timeline/classes/BxTimelineTemplate.php

@@ -170,11 +170,15 @@ class BxTimelineTemplate extends BxBaseModNotificationsTemplate
         }
 
         $aParams = array(
-        	'view' => BX_TIMELINE_VIEW_ITEM, 
-        	'type' => BX_TIMELINE_TYPE_ITEM
+            'view' => BX_TIMELINE_VIEW_ITEM, 
+            'type' => BX_TIMELINE_TYPE_ITEM
         );
         $sContent = $this->getPost($aEvent, $aParams);
 
+        $sKey = 'allowed_view';
+        if(isset($aEvent[$sKey]) && $aEvent[$sKey] !== CHECK_ACTION_RESULT_ALLOWED) 
+            return array('content' => MsgBox($aEvent[$sKey]), 'designbox_id' => 13);
+
         $oModule = $this->getModule();
         if($oModule->isAllowedViewCounter($aEvent) !== true)
             return array('content' => MsgBox(_t('_Access denied')), 'designbox_id' => 13);
@@ -311,6 +315,7 @@ class BxTimelineTemplate extends BxBaseModNotificationsTemplate
         $aEvent['sample'] = !empty($aResult['sample']) ? $aResult['sample'] : '_bx_timeline_txt_sample';
         $aEvent['sample_action'] = !empty($aResult['sample_action']) ? $aResult['sample_action'] : '_bx_timeline_txt_added_sample';
         $aEvent['content'] = $aResult['content'];
+        $aEvent['allowed_view'] = isset($aResult['allowed_view']) ? $aResult['allowed_view'] : CHECK_ACTION_RESULT_ALLOWED;
         $aEvent['views'] = $aResult['views'];
         $aEvent['votes'] = $aResult['votes'];
         $aEvent['scores'] = $aResult['scores'];