LPCalendar - Add learning_calendar.author_id see BT#14608

plugin/lp_calendar/LpCalendarPlugin.php

@@ -189,7 +189,12 @@ class LpCalendarPlugin extends Plugin
             $direction = 'DESC';
         }
 
-        $sql = 'select * FROM learning_calendar';
+        if (api_is_platform_admin()) {
+            $sql = 'SELECT * FROM learning_calendar';
+        } else {
+            $userId = api_get_user_id();
+            $sql = "SELECT * FROM learning_calendar WHERE author_id = $userId";
+        }
 
         $sql .= " LIMIT $from, $numberOfItems ";
 
@@ -315,7 +320,12 @@ class LpCalendarPlugin extends Plugin
      */
     public function getCalendarCount()
     {
-        $sql = 'select count(*) as count FROM learning_calendar';
+        if (api_is_platform_admin()) {
+            $sql = 'select count(*) as count FROM learning_calendar';
+        } else {
+            $userId = api_get_user_id();
+            $sql = "select count(*) as count FROM learning_calendar WHERE author_id = $userId";
+        }
         $result = Database::query($sql);
         $result = Database::fetch_array($result);
 
@@ -751,6 +761,7 @@ class LpCalendarPlugin extends Plugin
     public function copyCalendar($calendarId)
     {
         $item = $this->getCalendar($calendarId);
+        $this->protectCalendar($item);
         $item['author_id'] = api_get_user_id();
 
         if (empty($item)) {
@@ -786,6 +797,7 @@ class LpCalendarPlugin extends Plugin
     public function deleteCalendar($calendarId)
     {
         $item = $this->getCalendar($calendarId);
+        $this->protectCalendar($item);
 
         if (empty($item)) {
             return false;
@@ -877,12 +889,23 @@ class LpCalendarPlugin extends Plugin
         return $list;
     }
 
-    public function protectCalendar($calendarId = 0)
+    /**
+     * @param array $calendarInfo
+     */
+    public function protectCalendar($calendarInfo = [])
     {
         $allow = api_is_platform_admin() || api_is_teacher();
 
         if (!$allow) {
             api_not_allowed(true);
         }
+
+        if (!empty($calendarInfo)) {
+            if (!api_is_platform_admin() && api_is_teacher()) {
+                if ($calendarInfo['author_id'] != api_get_user_id()) {
+                    api_not_allowed(true);
+                }
+            }
+        }
     }
 }

plugin/lp_calendar/ajax.php

@@ -7,7 +7,8 @@ $action = isset($_REQUEST['a']) ? $_REQUEST['a'] : '';
 $calendarId = isset($_REQUEST['id']) ? $_REQUEST['id'] : 0;
 
 $plugin = LpCalendarPlugin::create();
-$plugin->protectCalendar($calendarId);
+$item = $plugin->getCalendar($calendarId);
+$plugin->protectCalendar($item);
 
 switch ($action) {
     case 'toggle_day':

plugin/lp_calendar/calendar.php

@@ -5,12 +5,8 @@ require_once __DIR__.'/../../main/inc/global.inc.php';
 
 $calendarId = isset($_REQUEST['id']) ? (int) $_REQUEST['id'] : 0;
 $plugin = LpCalendarPlugin::create();
-$plugin->protectCalendar($calendarId);
 $item = $plugin->getCalendar($calendarId);
-
-if (empty($item)) {
-    api_not_allowed(true);
-}
+$plugin->protectCalendar($item);
 
 $isoCode = api_get_language_isocode();
 $htmlHeadXtra[] = api_get_asset('bootstrap-year-calendar/js/bootstrap-year-calendar.js');
@@ -44,7 +40,6 @@ $actions = Display::toolbarAction('toolbar-forum', [$actionLeft]);
 
 $eventList = $plugin->getEventTypeList();
 $template->assign('events', $eventList);
-
 $template->assign('calendar_language', $calendarLanguage);
 $template->assign('ajax_url', api_get_path(WEB_PLUGIN_PATH).'lp_calendar/ajax.php?id='.$calendarId);
 $template->assign('header', $item['title']);

plugin/lp_calendar/start.php

@@ -41,6 +41,7 @@ switch ($action) {
         $plugin->getForm($form);
         $form->addButtonSave(get_lang('Update'));
         $item = $plugin->getCalendar($calendarId);
+        $plugin->protectCalendar($item);
 
         if (empty($item)) {
             api_not_allowed(true);