ding_permissions.module

<?php
/**
 * @file
 * Module file for secure permissions in code.
 */

include_once 'ding_permissions.features.inc';

/**
 * Implements hook_menu_alter().
 *
 * Alters the user edit menu path to ensure that only the right roles can edit
 * the other users. E.g the local administrator role should not be able to
 * change the profile of an administrator, but do to Drupal only have one
 * permission "administer users" we are not able to control this.
 */
function ding_permissions_menu_alter(&$items) {
  $items['user/%user/edit']['access callback'] = 'ding_permissions_user_access_level';
  $items['user/%user/roles']['access callback'] = 'ding_permission_check_roles_access';
  $items['user/%user/roles']['access arguments'] = array(1);
}

/**
 * Implements hook_permission().
 *
 * Defines the new user edit permission based on user role id's.
 *
 * @see ding_permissions_menu_alter()
 */
function ding_permissions_permission() {
  $permissions = array();

  // Get all roles.
  $roles = user_roles(TRUE);

  // Add edit permission for each role.
  foreach ($roles as $rid => $role) {
    // Create a new permission for each user role.
    $permissions['administer user role ' . $rid] = array(
      'title' => t('Administer user with role: %role', array('%role' => $role)),
      'description' => t('Edit user with this role.'),
    );
  }

  return $permissions;
}

/**
 * Access callback that checks user has access to edit profile.
 *
 * Next calls to check that the user is allowed to edit roles and thereby
 * having the roles tab shown.
 *
 * @param Object $account
 *   The user being edited.
 *
 * @see ding_permissions_menu_alter()
 *
 * @return bool
 *   If the user is allowed to edit the account TRUE is returned else FALSE.
 */
function ding_permissions_user_access_level($account) {
  // We don't allow anonymous to edit users.
  if ($account->uid) {
    // Allow users to edit own profile.
    if ($GLOBALS['user']->uid == $account->uid) {
      return TRUE;
    }
    else {
      return ding_permission_check_roles_access($account);
    }
  }

  return FALSE;
}

/**
 * Access callback that checks user role edit permissions.
 *
 * @param Object $account
 *   The user being edited.
 *
 * @see ding_permissions_menu_alter()
 *
 * @return bool
 *   If the user is allowed to edit the account TRUE is returned else FALSE.
 */
function ding_permission_check_roles_access($account) {
  // Check that the user have "administer users" permission.
  if (user_access('administer users')) {
    // Get the roles of the account we are trying to edit.
    $rids = array_keys($account->roles);
    foreach ($rids as $rid) {
      // Check if the user logged in has permission to edit the accounts
      // role. If we are allowed to edit just one of the roles access is
      // granted.
      if (user_access('administer user role ' . $rid)) {
        return TRUE;
      }
    }
  }

  return FALSE;
}

/**
 * Define site roles in code.
 *
 * Create a secure_permissions_data module directory and place this function
 * in secure_permissions_data.module.
 *
 * @return array
 *   An array defining all the roles for the site.
 */
function ding_permissions_secure_permissions_roles() {
  return array(
    'anonymous user',
    'authenticated user',
    'editor',
    'guest blogger',
    'local administrator',
    'local editor',
    'provider',
    'staff',
    'administrators',
  );
}

/**
 * Define site permissions in code.
 *
 * Create a secure_permissions_data module directory and place this function
 * in secure_permissions_data.module.
 *
 * @param string $role
 *   The role for which the permissions are being requested.
 *
 * @return array
 *   An array defining all the permissions for the site.
 */
function ding_permissions_secure_permissions($role) {
  $permissions = array(
    // Permissions to disable that aren't assigned to any roles.
      0 => array(
    ),
    'anonymous user' => array(
      'access comments',
      'access content',
      'access site-wide contact form',
      'access user profiles',
      'display EU Cookie Compliance popup',
      'perform reservation',
      'search content',
      'view any ding_staff_profile profile',
      'view files',
    ),
    'authenticated user' => array(
      'access comments',
      'access content',
      'access site-wide contact form',
      'access user profiles',
      'display EU Cookie Compliance popup',
      'edit own comments',
      'post comments',
      'search content',
      'skip comment approval',
      'view any ding_staff_profile profile',
      'view files',
      'view own ding_staff_profile profile',
      'view own files',
      'view own private files',
    ),
    'administrators' => array(
      'access administration pages',
      'access all views',
      'access all webform results',
      'access campaign rules',
      'access comments',
      'access content',
      'access content overview',
      'access contextual links',
      'access overlay',
      'access own webform results',
      'access own webform submissions',
      'access relations',
      'access rules debug',
      'access site in maintenance mode',
      'access site reports',
      'access site-wide contact form',
      'access the block administration page',
      'access toolbar',
      'access user contact forms',
      'access user profiles',
      'access workbench',
      'add media from remote sources',
      'administer actions',
      'administer advanced pane settings',
      'administer autologout',
      'administer block access settings',
      'administer blocks',
      'administer bpi',
      'administer comments',
      'administer contact forms',
      'administer content types',
      'administer custom content',
      'administer dibs settings',
      'administer dibs transactions',
      'administer ding provider',
      'administer EU Cookie Compliance popup',
      'administer features',
      'administer fieldgroups',
      'administer file types',
      'administer files',
      'administer filters',
      'administer flags',
      'administer frontpage settings',
      'administer group',
      'administer image styles',
      'administer languages',
      'administer media browser',
      'administer menu',
      'administer menu positions',
      'administer module filter',
      'administer modules',
      'administer nodequeue',
      'administer nodes',
      'administer og menu',
      'administer og menu configuration',
      'administer opening hours configuration',
      'administer page manager',
      'administer pane access',
      'administer panel-nodes',
      'administer panels layouts',
      'administer panels styles',
      'administer pathauto',
      'administer permissions',
      'administer place2book settings',
      'administer profile types',
      'administer profiles',
      'administer realname',
      'administer redirects',
      'administer relation types',
      'administer relations',
      'administer rules',
      'administer scheduler',
      'administer search',
      'administer shortcuts',
      'administer site configuration',
      'administer software updates',
      'administer taxonomy',
      'administer themes',
      'administer ting settings',
      'administer tipsy',
      'administer url aliases',
      'administer user role 1',
      'administer user role 2',
      'administer user role 3',
      'administer user role 4',
      'administer user role 5',
      'administer user role 6',
      'administer user role 7',
      'administer user role 8',
      'administer user role 9',
      'administer users',
      'administer uuid',
      'administer varnish',
      'administer views',
      'administer workbench',
      'administer workflow',
      'assign administrators role',
      'assign all roles',
      'assign anonymous user role',
      'assign editor role',
      'assign guest blogger role',
      'assign local administrator role',
      'assign local editor role',
      'assign provider role',
      'assign staff role',
      'block IP addresses',
      'bpi push content',
      'bpi syndicate content',
      'bypass file access',
      'bypass node access',
      'bypass rules access',
      'cancel account',
      'change layouts in place editing',
      'change own logout threshold',
      'change own username',
      'clone node',
      'clone own nodes',
      'create ding_campaign content',
      'configure all block body fields',
      'configure all block descriptions',
      'configure all block titles',
      'configure all blocks',
      'configure all content type visibility settings',
      'configure all language settings',
      'configure all page visibility settings',
      'configure all region settings',
      'configure all role visibility settings',
      'configure all user visibility settings',
      'configure all visibility settings',
      'configure carousel',
      'create blocks',
      'create ding_event content',
      'create ding_group content',
      'create ding_library content',
      'create ding_news content',
      'create ding_page content',
      'create ding_rolltab content',
      'create files',
      'create new_materials content',
      'create panel content',
      'create panel-nodes',
      'create relations',
      'create url aliases',
      'customize shortcut links',
      'delete all blocks',
      'delete all webform submissions',
      'delete any audio files',
      'delete any ding_campaign content',
      'delete any ding_event content',
      'delete any ding_group content',
      'delete any ding_library content',
      'delete any ding_news content',
      'delete any ding_page content',
      'delete any ding_rolltab content',
      'delete any document files',
      'delete any image files',
      'delete any new_materials content',
      'delete any panel content',
      'delete any panel-nodes',
      'delete any video files',
      'delete bpi content',
      'delete own audio files',
      'delete own ding_campaign content',
      'delete own ding_event content',
      'delete own ding_group content',
      'delete own ding_library content',
      'delete own ding_news content',
      'delete own ding_page content',
      'delete own ding_rolltab content',
      'delete own document files',
      'delete own image files',
      'delete own new_materials content',
      'delete own panel content',
      'delete own panel-nodes',
      'delete own video files',
      'delete own webform submissions',
      'delete relations',
      'delete revisions',
      'delete terms in 1',
      'delete terms in 2',
      'delete terms in 3',
      'delete terms in 4',
      'delete terms in 5',
      'delete terms in 6',
      'delete terms in 7',
      'disable all blocks',
      'download any audio files',
      'download any document files',
      'download any image files',
      'download any video files',
      'download own audio files',
      'download own document files',
      'download own image files',
      'download own video files',
      'dynamic background configure default',
      'dynamic background upload default',
      'dynamic backgrounds css callback',
      'dynamic backgrounds set default',
      'dynamic backgrounds weight',
      'edit all webform submissions',
      'edit any audio files',
      'edit any ding_campaign content',
      'edit any ding_event content',
      'edit any ding_group content',
      'edit any ding_library content',
      'edit any ding_news content',
      'edit any ding_page content',
      'edit any ding_rolltab content',
      'edit any ding_staff_profile profile',
      'edit any document files',
      'edit any image files',
      'edit any new_materials content',
      'edit any panel content',
      'edit any panel-nodes',
      'edit any provider_alma profile',
      'edit any video files',
      'edit opening hours for content',
      'edit own audio files',
      'edit own comments',
      'edit own ding_campaign content',
      'edit own ding_event content',
      'edit own ding_group content',
      'edit own ding_library content',
      'edit own ding_news content',
      'edit own ding_page content',
      'edit own ding_rolltab content',
      'edit own document files',
      'edit own image files',
      'edit own new_materials content',
      'edit own panel content',
      'edit own panel-nodes',
      'edit own video files',
      'edit own webform submissions',
      'edit relations',
      'edit terms in 1',
      'edit terms in 2',
      'edit terms in 3',
      'edit terms in 4',
      'edit terms in 5',
      'edit terms in 6',
      'edit terms in 7',
      'edit webform components',
      'edit workflow comment',
      'export nodes',
      'export own nodes',
      'enable all blocks',
      'export relation types',
      'export secure permissions',
      'generate features',
      'geocoder_service_all_handlers',
      'geocoder_service_handler_exif',
      'geocoder_service_handler_google',
      'geocoder_service_handler_gpx',
      'geocoder_service_handler_json',
      'geocoder_service_handler_kml',
      'geocoder_service_handler_latlon',
      'geocoder_service_handler_mapquest_nominatim',
      'geocoder_service_handler_wkt',
      'geocoder_service_handler_yahoo',
      'geocoder_service_handler_yandex',
      'manage features',
      'manipulate all queues',
      'manipulate queues',
      'move all blocks',
      'notify of path changes',
      'participate in workflow',
      'pay using dibs',
      'post comments',
      'revert revisions',
      'schedule (un)publishing of nodes',
      'schedule workflow transitions',
      'search content',
      'select account cancellation method',
      'show workflow state form',
      'skip comment approval',
      'switch shortcut sets',
      'translate admin strings',
      'translate content',
      'translate interface',
      'translate user-defined strings',
      'use advanced search',
      'use flag import',
      'use ipe with page manager',
      'use page manager',
      'use panels caching features',
      'use panels dashboard',
      'use panels in place editing',
      'use panels locks',
      'use PHP to import nodes',
      'use text format ding_wysiwyg',
      'view all blocks',
      'view any ding_staff_profile profile',
      'view any provider_alma profile',
      'view any unpublished content',
      'view any provider_openruth profile',
      'view any unpublished ding_event content',
      'view any unpublished ding_group content',
      'view any unpublished ding_library content',
      'view any unpublished ding_news content',
      'view any unpublished ding_page content',
      'view any unpublished ding_rolltab content',
      'view any unpublished panel content',
      'view bpi statistics',
      'view files',
      'view own ding_staff_profile profile',
      'view own files',
      'view own private files',
      'view own unpublished content',
      'view pane admin links',
      'view private files',
      'view revisions',
      'view the administration theme',
    ),
    'editor' => array(
      'access all webform results',
      'access campaign rules',
      'access content overview',
      'access contextual links',
      'access site-wide contact form',
      'access overlay',
      'access own webform results',
      'access own webform submissions',
      'access toolbar',
      'access workbench',
      'add media from remote sources',
      'administer bpi',
      'administer contact forms',
      'administer menu',
      'administer opening hours configuration',
      'administer place2book settings',
      'administer shortcuts',
      'administer url aliases',
      'administer user role 4',
      'administer user role 5',
      'administer user role 7',
      'assign editor role',
      'assign guest blogger role',
      'assign local editor role',
      'assign staff role',
      'bpi push content',
      'bpi syndicate content',
      'clone node',
      'clone own nodes',
      'configure carousel',
      'create ding_campaign content',
      'create ding_event content',
      'create ding_group content',
      'create ding_library content',
      'create ding_news content',
      'create ding_page content',
      'create ding_rolltab content',
      'create files',
      'create new_materials content',
      'create url aliases',
      'customize shortcut links',
      'delete any audio files',
      'delete any ding_campaign content',
      'delete any ding_event content',
      'delete any ding_group content',
      'delete any ding_library content',
      'delete any ding_news content',
      'delete any ding_page content',
      'delete any ding_rolltab content',
      'delete any document files',
      'delete any image files',
      'delete any new_materials content',
      'delete any video files',
      'delete bpi content',
      'delete own audio files',
      'delete own ding_campaign content',
      'delete own ding_event content',
      'delete own ding_group content',
      'delete own ding_library content',
      'delete own ding_news content',
      'delete own ding_page content',
      'delete own ding_rolltab content',
      'delete own document files',
      'delete own image files',
      'delete own new_materials content',
      'delete own video files',
      'delete revisions',
      'delete terms in 1',
      'delete terms in 2',
      'delete terms in 3',
      'delete terms in 4',
      'delete terms in 5',
      'delete terms in 6',
      'delete terms in 7',
      'download any audio files',
      'download any document files',
      'download any image files',
      'download any video files',
      'download own audio files',
      'download own document files',
      'download own image files',
      'download own video files',
      'dynamic background upload default',
      'dynamic backgrounds css callback',
      'dynamic backgrounds set default',
      'dynamic backgrounds weight',
      'edit any audio files',
      'edit any ding_campaign content',
      'edit any ding_event content',
      'edit any ding_group content',
      'edit any ding_library content',
      'edit any ding_news content',
      'edit any ding_page content',
      'edit any ding_rolltab content',
      'edit any document files',
      'edit any image files',
      'edit any new_materials content',
      'edit any video files',
      'edit opening hours for content',
      'edit own audio files',
      'edit own ding_campaign content',
      'edit own ding_event content',
      'edit own ding_group content',
      'edit own ding_library content',
      'edit own ding_news content',
      'edit own ding_page content',
      'edit own ding_rolltab content',
      'edit own document files',
      'edit own image files',
      'edit own new_materials content',
      'edit own video files',
      'edit terms in 1',
      'edit terms in 2',
      'edit terms in 3',
      'edit terms in 4',
      'edit terms in 5',
      'edit terms in 6',
      'edit terms in 7',
      'edit webform components',
      'manipulate all queues',
      'manipulate queues',
      'notify of path changes',
      'participate in workflow',
      'revert revisions',
      'schedule (un)publishing of nodes',
      'show workflow state form',
      'switch shortcut sets',
      'translate admin strings',
      'translate content',
      'translate interface',
      'translate user-defined strings',
      'use text format ding_wysiwyg',
      'view any unpublished content',
      'view bpi statistics',
      'view own unpublished content',
      'view revisions',
      'view the administration theme',
    ),
    'guest blogger' => array(
      'access overlay',
      'access site-wide contact form',
      'access toolbar',
      'access workbench',
      'administer user role 5',
      'bpi push content',
      'bpi syndicate content',
      'clone node',
      'clone own nodes',
      'create ding_news content',
      'create files',
      'delete bpi content',
      'download own audio files',
      'download own document files',
      'download own image files',
      'download own video files',
      'edit own audio files',
      'edit own ding_news content',
      'edit own document files',
      'edit own image files',
      'edit own video files',
      'schedule (un)publishing of nodes',
      'show workflow state form',
      'use text format ding_wysiwyg',
      'view own private files',
      'view own unpublished content',
      'view the administration theme',
    ),
    'local administrator' => array(
      'access administration pages',
      'access all webform results',
      'access campaign rules',
      'access content overview',
      'access site-wide contact form',
      'access contextual links',
      'access overlay',
      'access own webform results',
      'access own webform submissions',
      'access site in maintenance mode',
      'access toolbar',
      'access workbench',
      'add media from remote sources',
      'administer autologout',
      'administer bpi',
      'administer comments',
      'administer contact forms',
      'administer dibs settings',
      'administer dibs transactions',
      'administer ding provider',
      'administer EU Cookie Compliance popup',
      'administer files',
      'administer frontpage settings',
      'administer menu',
      'administer nodes',
      'administer opening hours configuration',
      'administer redirects',
      'administer place2book settings',
      'administer search',
      'administer shortcuts',
      'administer site configuration',
      'administer taxonomy',
      'administer themes',
      'administer ting settings',
      'administer url aliases',
      'administer user role 4',
      'administer user role 5',
      'administer user role 6',
      'administer user role 7',
      'administer user role 9',
      'administer users',
      'assign editor role',
      'assign guest blogger role',
      'assign local administrator role',
      'assign local editor role',
      'assign staff role',
      'bpi push content',
      'bpi syndicate content',
      'cancel account',
      'change own username',
      'configure carousel',
      'clone node',
      'clone own nodes',
      'create ding_campaign content',
      'create ding_event content',
      'create ding_group content',
      'create ding_library content',
      'create ding_news content',
      'create ding_page content',
      'create ding_rolltab content',
      'create files',
      'create new_materials content',
      'create url aliases',
      'customize shortcut links',
      'delete any audio files',
      'delete any ding_campaign content',
      'delete any ding_event content',
      'delete any ding_group content',
      'delete any ding_library content',
      'delete any ding_news content',
      'delete any ding_page content',
      'delete any ding_rolltab content',
      'delete any document files',
      'delete any image files',
      'delete any new_materials content',
      'delete any video files',
      'delete bpi content',
      'delete own audio files',
      'delete own ding_campaign content',
      'delete own ding_event content',
      'delete own ding_group content',
      'delete own ding_library content',
      'delete own ding_news content',
      'delete own ding_page content',
      'delete own ding_rolltab content',
      'delete own document files',
      'delete own image files',
      'delete own new_materials content',
      'delete own video files',
      'delete revisions',
      'delete terms in 1',
      'delete terms in 2',
      'delete terms in 3',
      'delete terms in 4',
      'delete terms in 5',
      'delete terms in 6',
      'delete terms in 7',
      'download any audio files',
      'download any document files',
      'download any image files',
      'download any video files',
      'download own audio files',
      'download own document files',
      'download own image files',
      'download own video files',
      'dynamic background upload default',
      'dynamic backgrounds css callback',
      'dynamic backgrounds set default',
      'dynamic backgrounds weight',
      'edit any audio files',
      'edit any ding_campaign content',
      'edit any ding_event content',
      'edit any ding_group content',
      'edit any ding_library content',
      'edit any ding_news content',
      'edit any ding_page content',
      'edit any ding_rolltab content',
      'edit any ding_staff_profile profile',
      'edit any document files',
      'edit any image files',
      'edit any new_materials content',
      'edit any video files',
      'edit opening hours for content',
      'edit own audio files',
      'edit own ding_campaign content',
      'edit own ding_event content',
      'edit own ding_group content',
      'edit own ding_library content',
      'edit own ding_news content',
      'edit own ding_page content',
      'edit own ding_rolltab content',
      'edit own document files',
      'edit own image files',
      'edit own new_materials content',
      'edit own video files',
      'edit terms in 1',
      'edit terms in 2',
      'edit terms in 3',
      'edit terms in 4',
      'edit terms in 5',
      'edit terms in 6',
      'edit terms in 7',
      'edit webform components',
      'edit workflow comment',
      'manipulate all queues',
      'manipulate queues',
      'notify of path changes',
      'participate in workflow',
      'revert revisions',
      'schedule (un)publishing of nodes',
      'show workflow state form',
      'switch shortcut sets',
      'translate admin strings',
      'translate content',
      'translate interface',
      'translate user-defined strings',
      'use advanced search',
      'use panels in place editing',
      'use text format ding_wysiwyg',
      'view any provider_alma profile',
      'view any provider_openruth profile',
      'view any unpublished content',
      'view bpi statistics',
      'view own unpublished content',
      'view pane admin links',
      'view private files',
      'view revisions',
      'view the administration theme',
    ),
    'local editor' => array(
      'access campaign rules',
      'access content overview',
      'access contextual links',
      'access site-wide contact form',
      'access overlay',
      'access toolbar',
      'access workbench',
      'add media from remote sources',
      'administer contact forms',
      'administer menu',
      'administer shortcuts',
      'administer user role 4',
      'administer user role 5',
      'administer user role 7',
      'bpi push content',
      'bpi syndicate content',
      'clone node',
      'clone own nodes',
      'configure carousel',
      'create ding_event content',
      'create ding_news content',
      'create ding_page content',
      'create files',
      'customize shortcut links',
      'delete any ding_event content',
      'delete bpi content',
      'delete own ding_event content',
      'delete own ding_news content',
      'delete own ding_page content',
      'delete terms in 2',
      'download own audio files',
      'download own document files',
      'download own image files',
      'download own video files',
      'edit any ding_event content',
      'edit any ding_library content',
      'edit any ding_news content',
      'edit any ding_page content',
      'edit own audio files',
      'edit own ding_event content',
      'edit own ding_library content',
      'edit own ding_news content',
      'edit own ding_page content',
      'edit own document files',
      'edit own image files',
      'edit own video files',
      'edit terms in 2',
      'participate in workflow',
      'schedule (un)publishing of nodes',
      'show workflow state form',
      'translate admin strings',
      'translate content',
      'translate user-defined strings',
      'use text format ding_wysiwyg',
      'view any unpublished content',
      'view bpi statistics',
      'view own unpublished content',
      'view revisions',
      'view the administration theme',
    ),
    'provider' => array(
      'create files',
      'edit own provider_alma profile',
      'edit own provider_openruth profile',
      'pay using dibs',
      'perform bookmark',
      'perform reservation',
      'view own private files',
      'view own provider_alma profile',
      'view own provider_openruth profile',
    ),
    'staff' => array(
      'edit own ding_staff_profile profile',
    ),
  );
  if (isset($permissions[$role])) {
    return $permissions[$role];
  }
}