function fillpdf_merge_pdf_access in FillPDF 7.2

Same name and namespace in other branches

1. 6 fillpdf.module \fillpdf_merge_pdf_access()
2. 7 fillpdf.module \fillpdf_merge_pdf_access()

1 call to fillpdf_merge_pdf_access()

fillpdf_merge_pdf in ./fillpdf.module

File

./fillpdf.module, line 727

Allows mappings of PDFs to site content

Code

function fillpdf_merge_pdf_access($nodes = array(), $webforms = array(), $uc_orders = array(), $uc_order_products = array()) {
  if (user_access('administer pdfs') || user_access('publish all pdfs')) {
    return TRUE;
  }
  if (!user_access('publish own pdfs')) {
    return FALSE;
  }
  global $user;
  $account = user_load($user->uid);
  if (empty($webforms)) {
    foreach ($nodes as $node) {

      // own node?
      if (!node_access('view', $node) || $node->uid != $user->uid) {
        return FALSE;
      }
    }
  }
  else {
    foreach ($webforms as $webform) {

      // In this case, we only care that they can view the Webform
      if (!node_access('view', node_load($webform['webform']->nid))) {
        return FALSE;
      }
    }
  }

  // Own webform submission?
  if (!empty($webforms)) {
    foreach ($webforms as $webform) {
      if (!webform_submission_access($webform['webform'], $webform['submission'], 'view')) {
        return FALSE;
      }
    }
  }

  // Access to order?
  if (!empty($uc_orders)) {
    foreach ($uc_orders as $uc_order) {
      $order_status = $uc_order->order_status;

      // KLUDGE: Ubercart 3 seems to check its own view all orders permission
      // incorrectly, so we check it manually as well. Not less secure.
      if ((!uc_order_order_entity_access('view', $uc_order, $account) || !user_access("publish {$order_status} order data")) && !user_access('view all orders')) {
        return FALSE;
      }
    }
  }

  // Access to order product?
  if (!empty($uc_order_products)) {
    foreach ($uc_order_products as $uc_order_product) {
      $order = uc_order_load($uc_order_product->order_id);
      $order_status = $order->order_status;

      // KLUDGE: Ubercart 3 seems to check its own view all orders permission
      // incorrectly, so we check it manually as well. Not less secure.
      if ((!uc_order_order_product_access('view', $uc_order_product, $account) || !user_access("publish {$order_status} order data")) && !user_access('view all orders')) {
        return FALSE;
      }
    }
  }
  return TRUE;
}