From 052e80a5c9f5c7da81fba150d41846f38abe300d Mon Sep 17 00:00:00 2001
From: Awilum <awilum@msn.com>
Date: Fri, 2 Nov 2012 18:39:39 +0200
Subject: [PATCH] Pages Plugin: add page "access" feature

---
 plugins/box/pages/languages/it.lang.php       |  3 +
 plugins/box/pages/languages/lt.lang.php       |  3 +
 plugins/box/pages/languages/pt-br.lang.php    |  3 +
 plugins/box/pages/languages/ru.lang.php       |  3 +
 plugins/box/pages/languages/uk.lang.php       |  3 +
 plugins/box/pages/pages.admin.php             | 40 +++++++++++---
 plugins/box/pages/pages.plugin.php            | 55 ++++++++++++++++---
 .../box/pages/views/backend/index.view.php    |  8 ++-
 8 files changed, 100 insertions(+), 18 deletions(-)

diff --git a/plugins/box/pages/languages/it.lang.php b/plugins/box/pages/languages/it.lang.php
index fc9f1c8..3741d4b 100644
--- a/plugins/box/pages/languages/it.lang.php
+++ b/plugins/box/pages/languages/it.lang.php
@@ -47,5 +47,8 @@
             'SEO' => 'SEO',
             'Settings' => 'Impostazioni',
             'Required field' => 'Campo obbligatorio',
+            'Access' => 'Accesso',
+            'Public' => 'Pubblico',
+            'Registered' => 'Registrato',
         ),
     );
\ No newline at end of file
diff --git a/plugins/box/pages/languages/lt.lang.php b/plugins/box/pages/languages/lt.lang.php
index e92a83e..13d934d 100644
--- a/plugins/box/pages/languages/lt.lang.php
+++ b/plugins/box/pages/languages/lt.lang.php
@@ -47,5 +47,8 @@
             'SEO' => 'SEO',
             'Settings' => 'Nustatymai',
             'Required field' => 'Privalomas laukas',
+            'Access' => 'Pieeja',
+            'Public' => 'Valsts',
+            'Registered' => 'Reģistrēta',
         )
     );
\ No newline at end of file
diff --git a/plugins/box/pages/languages/pt-br.lang.php b/plugins/box/pages/languages/pt-br.lang.php
index ee81dff..7bc0354 100644
--- a/plugins/box/pages/languages/pt-br.lang.php
+++ b/plugins/box/pages/languages/pt-br.lang.php
@@ -47,5 +47,8 @@
             'SEO' => 'SEO',
             'Settings' => 'Configurações',
             'Required field' => 'Campo requerido',
+            'Access' => 'Acesso',
+            'Public' => 'Público',
+            'Registered' => 'Registrado',
         )
     );
\ No newline at end of file
diff --git a/plugins/box/pages/languages/ru.lang.php b/plugins/box/pages/languages/ru.lang.php
index 427bd42..59e1965 100644
--- a/plugins/box/pages/languages/ru.lang.php
+++ b/plugins/box/pages/languages/ru.lang.php
@@ -47,5 +47,8 @@
             'SEO' => 'SEO',
             'Settings' => 'Настройки',
             'Required field' => 'Обязательное поле',
+            'Access' => 'Доступ',
+            'Public' => 'Публичный',
+            'Registered' => 'Зарегистрированным',
         ),
     );
\ No newline at end of file
diff --git a/plugins/box/pages/languages/uk.lang.php b/plugins/box/pages/languages/uk.lang.php
index 5e137d9..ffce1bf 100644
--- a/plugins/box/pages/languages/uk.lang.php
+++ b/plugins/box/pages/languages/uk.lang.php
@@ -47,5 +47,8 @@
             'SEO' => 'SEO',
             'Settings' => 'Налаштування',
             'Required field' => 'Обов’язкове поле',
+            'Access' => 'Доступ',
+            'Public' => 'Публічний',
+            'Registered' => 'Зареєстрованим',
         ),
     );
\ No newline at end of file
diff --git a/plugins/box/pages/pages.admin.php b/plugins/box/pages/pages.admin.php
index 7146ddf..ff7c5d2 100755
--- a/plugins/box/pages/pages.admin.php
+++ b/plugins/box/pages/pages.admin.php
@@ -21,9 +21,11 @@
          */
         public static function _pageExpandAjax() {
             if (Request::post('slug')) {
-                $pages = new Table('pages');
-                $pages->updateWhere('[slug="'.Request::post('slug').'"]', array('expand' => Request::post('expand')));
-                Request::shutdown();
+                if (Security::check(Request::post('token'))) {
+                    $pages = new Table('pages');
+                    $pages->updateWhere('[slug="'.Request::post('slug').'"]', array('expand' => Request::post('expand')));
+                    Request::shutdown();
+                } else { die('csrf detected!'); }
             }
         }
 
@@ -33,12 +35,12 @@
          */
         public static function _themeHeaders() {
             echo ('<script>
-                    function pageExpand(slug, expand) {
+                    function pageExpand(slug, expand, token) {
                         $.ajax({
                             type:"post",
-                            data:"slug="+slug+"&expand="+expand,
+                            data:"slug="+slug+"&expand="+expand+"&token="+token,
                             url: "'.Option::get('siteurl').'admin/index.php?id=pages"
-                        }); 
+                        });
                     }
 
                     $(document).ready(function() {
@@ -46,11 +48,11 @@
                             if ($(this).html() == "-") {
                                 $(\'[rel="children_\' + $(this).attr(\'rel\')+\'"]\').hide();                                
                                 $(this).html("+");
-                                pageExpand($(this).attr("rel"), "1");
+                                pageExpand($(this).attr("rel"), "1", $(this).attr("token"));
                             } else {
                                 $(\'[rel="children_\' + $(this).attr(\'rel\')+\'"]\').show();
                                 $(this).html("-");
-                                pageExpand($(this).attr("rel"), "0");
+                                pageExpand($(this).attr("rel"), "0", $(this).attr("token"));
                             }
                         });
 
@@ -94,6 +96,11 @@
             $status_array = array('published' => __('Published', 'pages'),
                                   'draft'     => __('Draft', 'pages'));
 
+
+            // Access array
+            $access_array = array('public'      => __('Public', 'pages'),
+                                  'registered'  => __('Registered', 'pages'));
+
         
             // Check for get actions
             // ---------------------------------------------
@@ -123,6 +130,7 @@
                                                      'robots_index' => $orig_page['robots_index'],
                                                      'robots_follow'=> $orig_page['robots_follow'],
                                                      'status'       => $orig_page['status'],
+                                                     'access'       => $orig_page['access'],
                                                      'title'        => $rand_page_name,
                                                      'description'  => $orig_page['description'],
                                                      'keywords'     => $orig_page['keywords'],
@@ -192,6 +200,7 @@
                                                             'template'     => Request::post('templates'),
                                                             'parent'       => $parent_page,
                                                             'status'       => Request::post('status'),
+                                                            'access'       => Request::post('access'),
                                                             'robots_index' => $robots_index,
                                                             'robots_follow'=> $robots_follow,
                                                             'title'        => Request::post('page_title'),
@@ -245,6 +254,8 @@
                         if (Request::post('page_description')) $post_description = Request::post('page_description'); else $post_description = '';
                         if (Request::post('editor'))           $post_content     = Request::post('editor'); else $post_content = '';
                         if (Request::post('templates'))        $post_template    = Request::post('templates'); else $post_template = 'index';
+                        if (Request::post('status'))           $post_status      = Request::post('status'); else $post_status = 'published';
+                        if (Request::post('access'))           $post_access      = Request::post('access'); else $post_access = 'public';
                         if (Request::post('pages'))            $parent_page      = Request::post('pages'); else if(Request::get('parent_page')) $parent_page = Request::get('parent_page'); else $parent_page = '';
                         if (Request::post('robots_index'))     $post_robots_index = true; else $post_robots_index = false;
                         if (Request::post('robots_follow'))    $post_robots_follow = true; else $post_robots_follow = false;
@@ -267,7 +278,10 @@
                                 ->assign('parent_page', $parent_page)
                                 ->assign('templates_array', $templates_array)
                                 ->assign('post_template', $post_template)
+                                ->assign('post_status', $post_status)
+                                ->assign('post_access', $post_access)
                                 ->assign('status_array', $status_array)
+                                ->assign('access_array', $access_array)
                                 ->assign('date', $date)
                                 ->assign('post_robots_index', $post_robots_index)
                                 ->assign('post_robots_follow', $post_robots_follow)
@@ -308,6 +322,8 @@
                                 if (Request::post('page_description')) $post_description = Request::post('page_description'); else $post_description = '';
                                 if (Request::post('editor'))           $post_content     = Request::post('editor'); else $post_content = '';
                                 if (Request::post('templates'))        $post_template    = Request::post('templates'); else $post_template = 'index';
+                                if (Request::post('status'))           $post_status      = Request::post('status'); else $post_status = 'published';
+                                if (Request::post('access'))           $post_access      = Request::post('access'); else $post_access = 'public';
                                 if (Request::post('robots_index'))     $post_robots_index = true; else $post_robots_index = false;
                                 if (Request::post('robots_follow'))    $post_robots_follow = true; else $post_robots_follow = false;
                                 //--------------
@@ -339,6 +355,7 @@
                                                                   'robots_index' => $robots_index,
                                                                   'robots_follow'=> $robots_follow,
                                                                   'status'      => Request::post('status'),
+                                                                  'access'      => Request::post('ascess'),
                                                                   'date'        => $date,
                                                                   'author'      => $author))) {
 
@@ -361,6 +378,7 @@
                                                                   'robots_index' => $robots_index,
                                                                   'robots_follow'=> $robots_follow,
                                                                   'status'      => Request::post('status'),
+                                                                  'access'      => Request::post('access'),
                                                                   'date'        => $date,
                                                                   'author'      => $author))) {
 
@@ -440,6 +458,7 @@
                             }
                             if (Request::post('templates')) $template = Request::post('templates'); else $template = $page['template']; 
                             if (Request::post('status'))    $status   = Request::post('status');    else $status   = $page['status']; 
+                            if (Request::post('access'))    $access   = Request::post('access');    else $access   = $page['access']; 
 
                             // Generate date
                             $date = Request::post('date') ? Request::post('date') : Date::format($page['date'], 'Y-m-d H:i:s');
@@ -459,7 +478,9 @@
                                     ->assign('templates_array', $templates_array)
                                     ->assign('template', $template)
                                     ->assign('status_array', $status_array)
+                                    ->assign('access_array', $access_array)
                                     ->assign('status', $status)
+                                    ->assign('access', $access)
                                     ->assign('date', $date)        
                                     ->assign('post_robots_index', $post_robots_index)
                                     ->assign('post_robots_follow', $post_robots_follow)                            
@@ -518,7 +539,7 @@
                 $count = 0;
                 
                 // Get pages
-                $pages_list = $pages->select(null, 'all', null, array('slug', 'title', 'status', 'date', 'author', 'expand', 'parent'));
+                $pages_list = $pages->select(null, 'all', null, array('slug', 'title', 'status', 'date', 'author', 'expand', 'access', 'parent'));
 
                 // Loop
                 foreach ($pages_list as $page) {
@@ -526,6 +547,7 @@
                     $pages_array[$count]['title']   = $page['title'];
                     $pages_array[$count]['parent']  = $page['parent'];
                     $pages_array[$count]['status']  = $status_array[$page['status']];
+                    $pages_array[$count]['access']  = isset($access_array[$page['access']]) ? $access_array[$page['access']] : $access_array['public']; // hack for old Monstra Versions
                     $pages_array[$count]['date']    = $page['date'];
                     $pages_array[$count]['author']  = $page['author'];
                     $pages_array[$count]['expand']  = $page['expand'];
diff --git a/plugins/box/pages/pages.plugin.php b/plugins/box/pages/pages.plugin.php
index 3bc43b7..6a50d18 100644
--- a/plugins/box/pages/pages.plugin.php
+++ b/plugins/box/pages/pages.plugin.php
@@ -114,13 +114,30 @@
                   
                     // Check is child_parent -> request parent
                     if ($c_p == $data[0]) {                    
-                        // Checking only for the parent and one child, the remaining issue 404
-                        if (count($data) < 3) {
-                            $id = $data[1]; // Get real request page
+                        
+                        if (count($data) < 3) { // Checking only for the parent and one child, the remaining issue 404
+                            
+                            if ((($child_page['status'] == 'published') or 
+                                (Session::exists('user_role') && in_array(Session::get('user_role'), array('admin', 'editor')))) and
+                                ($child_page['access'] == 'public')) {
+
+                                $id = $data[1];       
+
+                            } elseif (($child_page['access'] == 'registered') and
+                                     (Session::exists('user_id')) and
+                                     ($child_page['status'] == 'published')) {
+                                
+                                $id = $data[1];                                
+
+                            } else {
+                                $id = 'error404';
+                                Response::status(404);      
+                            }
                         } else {
                             $id = 'error404';                            
                             Response::status(404);
                         }
+
                     } else {
                         $id = 'error404';
                         Response::status(404);
@@ -129,6 +146,7 @@
                     $id = 'error404';
                     Response::status(404);
                 }
+
             } else { // Only parent page come
                 if(empty($data[0])) {        
                     
@@ -151,14 +169,26 @@
 
                     // Check if this page has parent
                     if ($c_p !== '') {
+
                         if ($c_p == $data[0]) {
-                            if (count(Pages::$pages->select('[slug="'.$data[0].'"]', null)) != 0) {                            
-                                if (($current_page['status'] == 'published') or (Session::exists('user_role') && in_array(Session::get('user_role'), array('admin', 'editor')))) {
+                            if (count(Pages::$pages->select('[slug="'.$data[0].'"]', null)) != 0) {                               
+
+                                if ((($current_page['status'] == 'published') or 
+                                    (Session::exists('user_role') && in_array(Session::get('user_role'), array('admin', 'editor')))) and
+                                    ($current_page['access'] == 'public')) {
+
                                     $id = $data[0];       
+
+                                } elseif (($current_page['access'] == 'registered') and
+                                         (Session::exists('user_id')) and
+                                         ($current_page['status'] == 'published')) {
+                                    
+                                    $id = $data[0];                                
+
                                 } else {
                                     $id = 'error404';
                                     Response::status(404);      
-                                }                         
+                                }
                             } else {
                                 $id = 'error404';
                                 Response::status(404);
@@ -168,9 +198,20 @@
                             Response::status(404);
                         }
                     } else {
+
                         if (count(Pages::$pages->select('[slug="'.$data[0].'"]', null)) != 0) {
-                            if (($current_page['status'] == 'published') or (Session::exists('user_role') && in_array(Session::get('user_role'), array('admin', 'editor')))) {
+                            if ((($current_page['status'] == 'published') or 
+                                (Session::exists('user_role') && in_array(Session::get('user_role'), array('admin', 'editor')))) and
+                                ($current_page['access'] == 'public')) {
+
                                 $id = $data[0];       
+
+                            } elseif (($current_page['access'] == 'registered') and
+                                     (Session::exists('user_id')) and
+                                     ($current_page['status'] == 'published')) {
+
+                                $id = $data[0];                                
+
                             } else {
                                 $id = 'error404';
                                 Response::status(404);      
diff --git a/plugins/box/pages/views/backend/index.view.php b/plugins/box/pages/views/backend/index.view.php
index e99609f..d0ab2f9 100755
--- a/plugins/box/pages/views/backend/index.view.php
+++ b/plugins/box/pages/views/backend/index.view.php
@@ -22,6 +22,7 @@
                     <td><?php echo __('Name', 'pages'); ?></td>
                     <td><?php echo __('Author', 'pages'); ?></td>
                     <td><?php echo __('Status', 'pages'); ?></td>
+                    <td><?php echo __('Access', 'pages'); ?></td>
                     <td><?php echo __('Date', 'pages'); ?></td>
                     <td width="40%"><?php echo __('Actions', 'pages'); ?></td>
                 </tr>
@@ -42,9 +43,9 @@
                 <?php                    
                     if (count(PagesAdmin::$pages->select('[parent="'.(string)$page['slug'].'"]', 'all')) > 0) {
                         if (isset($page['expand']) && $page['expand'] == '1') {
-                            echo '<a href="javascript:;" class="btn-expand parent" rel="'.$page['slug'].'">+</a>';
+                            echo '<a href="javascript:;" class="btn-expand parent" token="'.Security::token().'" rel="'.$page['slug'].'">+</a>';
                         } else {
-                            echo '<a href="javascript:;" class="btn-expand parent" rel="'.$page['slug'].'">-</a>';
+                            echo '<a href="javascript:;" class="btn-expand parent" token="'.Security::token().'" rel="'.$page['slug'].'">-</a>';
                         }
                     }
                 ?>    
@@ -63,6 +64,9 @@
                 <td>
                     <?php echo $page['status']; ?>
                 </td>
+                <td>
+                    <?php echo $page['access']; ?>
+                </td>
                 <td>
                     <?php echo Date::format($page['date'], "j.n.Y"); ?>
                 </td>