Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

ince this issue only exists in the dev version, it is not covered by the
security team process. The commit can happen as an other bug fix.

97487619

 introduced an XSS
vulnerability, allowed_values are used unfiltered.

Signed-off-by: Neil Drumm <drumm@3064.no-reply.drupal.org>
Acked-by: Jakob Perry <japerry@45640.no-reply.drupal.org>
Acked-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Right now, the links are being rendered directly within the content array,
and are hard to organize in a drupal-sort of way. Wouldn't it make sense
to use the links system to render them (like flag and other modules do)?

This patch introduces that. It also cleans up the link function and allows
eventually an alter to be added to the fasttoggle_user_link function so
people could inject other links here. (its still somewhat hardcoded but at
least a start).

Signed-off-by: Jakob Perry <japerry@45640.no-reply.drupal.org>
Acked-by: Neil Drumm <drumm@3064.no-reply.drupal.org>
Acked-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Fasttoggle currently hardcodes the uid in the view handler. This should
be referencing $this->aliases to get the current alias of the uid and
user status values.

Signed-off-by: Jakob Perry <japerry@45640.no-reply.drupal.org>
Acked-by: Neil Drumm <drumm@3064.no-reply.drupal.org>
Acked-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Add initial support for a fasttoggle block. It's currently usable, but
there's more work to do.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Prior to this commit, spaces caused a redirect on our Ajax POSTs,
turning them into GETs. This confused the callback, making it think
the call was non-ajax. This patch adds support for checking whether a
path will be rewritten by spaces. If so, we seek to rewrite the callback
to the 'correct' version so the POST can continue.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Fix the fallback to the normal view if no fasttoggle access - the
extraction of the value from the default handler's output was broken.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

This patch removes the assumption that field value keys are numeric.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Address an issue which caused fields not to be rendered fasttogglable
any more - properly invoke the field_access function.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Fix the contextual links hook, and remove the huge nesting of if
statements while we're at it.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

According to drumm, Drupal 7 hasn't fully moved away from
using user_save()'s $edit parameter. Switch to the 'old'
way of saving changes to the user object, so that modules
such as Bakery don't break.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Apply patch from issue 2328203. Thanks to Drumm.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

It should depend on fasttoggle_node, not itself.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Use a temporary variable to avoid the dependency on a PHP 5.4
feature.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Update the name of the variable (not denied => undecided) and
remove a couple of words that were wrongly left in a previous edit.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Make comment and modr8 support depend on fasttoggle_node. They
could theoretically be separated, but it would require some
duplication of code. The user can always just not enable node
options they don't want.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

This patch adds support for a link having a set of allowed values
that is a subset of the possible values for the setting. This is
needed for toggling comments between disabled, read only and read
write. If comments for a node are disabled and Fasttoggle is set
up to not allow you to disable comments, an error was displayed
on the page. That's now fixed.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Make the code easier to understand by adding further comments
in the header for the function and renaming a variable from
sitewide to objectwide.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

The views code wasn't checking all the permissions it should. Rely
instead on fasttoggle_get_allowed_links having done the correct checks.
(It won't return the element if it's not allowed).

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Remove some unneeded lines and rely on fasttoggle_get_allowed_links
to do all the access checking and only provide the info we need.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Make the node type settings in fasttoggle forms distinguishable again.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Update the access checks for the modified API.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Add more commenting and ensure that if no function explicitly
allows access to a setting, we deny it. This was the other part
of the problem with the user status issue.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Remove the global variable by passing results back down the call
chain.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Rename fasttoggle_check_access_have_outcome to
fasttoggle_check_access in preparation for getting rid of the
global variable and passing the result back.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Make the meaning of the "We haven't decided yet" value clearer.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Correct the omission of code applying the per-node type settings
for access to links.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Simplify the inclusion of files within the project. The previous version
should be safe, but this is better.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>

Make the moderate toggle default to being disabled, like other
toggles.

Signed-off-by: Nigel Cunningham <nigel@nigelcunningham.com.au>