function hosting_task_cancel_access in Hostmaster (Aegir) 6

1 string reference to 'hosting_task_cancel_access'

hosting_task_menu in modules/hosting/task/hosting_task.module

Implementation of hook_menu().

File

modules/hosting/task/hosting_task.module, line 99

Web server node type is defined here.

Code

function hosting_task_cancel_access($node) {

  // bring $user into scope, so we can test task ownership
  global $user;

  // To prevent CSRF attacks, a unique token based upon user is used. Deny
  // access if the token is missing or invalid.
  if (!isset($_GET['token']) || !drupal_valid_token($_GET['token'], $user->uid)) {
    return FALSE;
  }

  // 'administer tasks' allows cancelling any and all tasks on the system
  if (user_access('administer tasks')) {
    return TRUE;
  }

  // 'cancel own tasks' allows cancelling any task the user *could have* created, on nodes she can view
  if (user_access('cancel own tasks') && user_access('create ' . $node->task_type . ' task') && node_access('view', $node)) {
    return TRUE;
  }
}