Making articles editable *only* by Author

[manuel]

I wanted to have articles edited only by the ones who create them (Author) and provide the Author a way to manually allow additional authors to edit the article.

As the goal of this article is to limit control over the News articles, it seems logical to create a group of editors that don't have permission to remove articles, not? To achieve this, just make sure the article editors don't have the "Delete News Articles" permission...

• 1. Create a new folder: /module_custom/News/templates
• 2. Copy the file "editarticle.tpl" from the /modules/News/templates folder in to the folder you just created

Change the top of the /module_custom/News/templates/editarticle.tpl file like this:

Code: Select all

{$startform}
{capture assign='adminname'}{$smarty.session.cms_admin_username}{/capture}
{if substr_count($extravalue, $adminname)}{assign var='editor' value='1'}{/if}
{if $adminname == "$inputauthor" || $adminname == '##REPLACE_WITH_YOUR_OWN##' || $inputauthor == '' || $editor == '1'}
{if $inputauthor}

This will allow the following scenarios where the article content can be edited:

• - The logged in user is the author
• The logged in user is the admin (probably you
• - No author has been set (allows creation of new articles)
• • - ps: As a consequence, if you remove a user login from the CMSMS installation, his or her articles become editable by everyone else...
• - The logged in user is an "additional editor" (entered manually by the original Author)

Change the bottom of the file like this:

Code: Select all

{else}<b style="color:red;">This article has been created by an other user ({$inputauthor}).<br>Cet article a &eacute;t&eacute; cr&eacute;&eacute; par un autre utilisateur ({$inputauthor}).<br>Dit artikel werd aangemaakt door een andere gebruiker ({$inputauthor}).</b>{/if}{$endform}

When editing or creating an article, the Author may enter user names of the "additional editors" in the Extra field separated by comma's (or not

To avoid users (easily) publishing and unpublishing each others articles, you can remove these buttons from the article list view.
Authors and "additional authors" will still have the possibility to publish/unpublish while editing the articles.

• 1. Copy the file "articlelist.tpl" from the /modules/News/templates folder in to the /module_custom/News/templates folder
• 2. Comment out (or remove) the following lines:
  • 1. <th class="pageicon">{$statustext}</th>
  • 2. <td>{if isset($entry->approve_link)}{$entry->approve_link}{/if}</td>

ps: if someone happens to know how to easily change the Author of an article, please let me know!
ps2: I've also posted this article on the i-do-this blog.
ps3: A shout if you like what you see is appreciated

Greetings,
Manuel

[Wishbone]

Fantastic idea!

One suggestion: Instead of copying the whole template, you can {include} the original template between your code blocks.. You won't have to re-implement when you upgrade if the News template changes.

[manuel]

Hi Wishbone,

Maintenance free sounds very interesting!

One remark though, the additional code needs to be inside the {$startform} and {$endform}tags (these are included in the default template)

Maybe we could capture the content of the template to a variable, remove these startform and endform tags from the captured template?
I'm not really sure on how to remove the startform and endform tags from the captured template though... Maybe cutt off the 1st 12 caracters and the last 10 from the variable? This seems like a very unstable solution though...

Something like this could be used to capture the template file contents *untested*

Code: Select all

{capture assign='capturedtemplate'}{include  file='/modules/News/templates/editarticle.tpl'}{/capture}

Or maybe we can just be naughty and have double startform and endform tags? I'll test this and update the thread.

Something like this: *untested*

Code: Select all

{$startform}
{capture assign='adminname'}{$smarty.session.cms_admin_username}{/capture}
{if substr_count($extravalue, $adminname)}{assign var='editor' value='1'}{/if}
{if $adminname == "$inputauthor" || $adminname == '##REPLACE_WITH_YOUR_OWN##' || $inputauthor == '' || $editor == '1'}
{include  file='/modules/News/templates/editarticle.tpl'}
{else}<b style="color:red;">This article has been created by an other user ({$inputauthor}).<br>Cet article a &eacute;t&eacute; cr&eacute;&eacute; par un autre utilisateur ({$inputauthor}).<br>Dit artikel werd aangemaakt door een andere gebruiker ({$inputauthor}).</b>{/if}{$endform}

ps: thanks for the {include} tip, i'm still very much learning the possibilities of smarty

Greetings,
Manuel

[manuel]

The code below works fine:

Code: Select all

{$startform}
{capture assign='adminname'}{$smarty.session.cms_admin_username}{/capture}
{if substr_count($extravalue, $adminname)}{assign var='editor' value='1'}{/if}
{if $adminname == "$inputauthor" || $adminname == '##REPLACE_WITH_YOUR_ADMIN_NAME##' || $inputauthor == '' || $editor == '1'}
{include file='##REPLACE_WITH_YOUR_ABSOLUTE_PATH##/modules/News/templates/editarticle.tpl'}
{else}<b style="font-weight:bold;color:red;">This article has been created by an other user ({$inputauthor}).<br>Cet article a &eacute;t&eacute; cr&eacute;&eacute; par un autre utilisateur ({$inputauthor}).<br>Dit artikel werd aangemaakt door een andere gebruiker ({$inputauthor}).</b>{/if}
{$endform}

Next step: Remove the codes from the articlelist.tpl

After a lot of failed attempts, I finally figured out how to replace strings containing brackets
I'll update the thread later with the correct regex_replace...

Code:

Code: Select all

{capture assign='testingg'}{literal}q{$startform}q{$endform}q{/literal}{/capture}
{capture assign='toreplace1'}{literal}(\{\$startform\}){/literal}{/capture}
{capture assign='toreplace2'}{literal}(\{\$endform\}){/literal}{/capture}
{$testingg|regex_replace:"$toreplace1":""|regex_replace:"$toreplace2":""}

Result:

Code: Select all

qqq

Greetings,
Manuel

[Wishbone]

You can clear {$startform} and {$endform} before including the News template... When the original template calls them, they'll do nothing. You'll have to capture the original values of the variables so you can still use them.

Code: Select all

{assign var='newstartform' value=$startform}
{assign var='newendform' value=$endform}
{assign var='startform' value=''}
{assign var='endform' value=''}

{$startform}

{* Insert top code block here *}

{include file='/path/to/editarticle.tpl'}

{* Insert bottom code block here *}

{$new_endform}

If I'm doing any complicated logic, I like to first call a UDT which will read all the template variables in question, modify them, then hand control back to the original logic. Complicated logic is much easier to read in PHP instead of Smarty

[manuel]

Nice

Code: Select all

{assign var='new_startform' value=$startform}
{assign var='new_endform' value=$endform}
{assign var='startform' value=''}
{assign var='endform' value=''}

{$new_startform}

{capture assign='adminname'}{$smarty.session.cms_admin_username}{/capture}
{if substr_count($extravalue, $adminname)}{assign var='editor' value='1'}{/if}
{if $adminname == "$inputauthor" || $adminname == '##REPLACE_WITH_YOUR_ADMIN_USERNAME##' || $inputauthor == '' || $editor == '1'}
{include file='##REPLACE_WITH_YOUR_ABSOLUTE_PATH##/modules/News/templates/editarticle.tpl'}
{else}<b style="font-weight:bold;color:red;">This article has been created by an other user ({$inputauthor}).<br>Cet article a &eacute;t&eacute; cr&eacute;&eacute; par un autre utilisateur ({$inputauthor}).<br>Dit artikel werd aangemaakt door een andere gebruiker ({$inputauthor}).</b>{/if}

{$new_endform}

I'm trying to remove the unwanted lines of code from the articlelist but regex_replace but nothing is changing... (and no error messages appear)

Code: Select all

{capture assign='capturedtemplate'}{include file='##ABSOLUTE_PATH_HERE##/modules/News/templates/articlelist.tpl'}{/capture}
{capture assign='toreplace1'}{literal}(<th class=\"pageicon\">\{\$statustext\}<\/th>){/literal}{/capture}
{capture assign='toreplace2'}{literal}(<td>\{if isset\(\$entry->approve_link\)\}\{\$entry->approve_link\}\{\/if\}<\/td>){/literal}{/capture}
{$capturedtemplate|regex_replace:"$toreplace1":""|regex_replace:"$toreplace2":""}

[manuel]

When the articlelist.tpl is captured, the {$statustext} has already been replaced with the word "Status".

[manuel]

damn, i learned a lot about regex today

Final update (i hope) for a maintenance free setup:
Contents of module_custom/News/templates/articlelist.tpl

Code: Select all

{assign var='statustext' value='REPLACED'}
{include file='file:##REPLACE_WITH_YOUR_ABSOLUTE_PATH##/modules/News/templates/articlelist.tpl' assign='capturedtemplate'}
{$capturedtemplate|regex_replace:"/(<th class=\"pageicon\">REPLACED<\/th>)/":""|regex_replace:"/(<td)(.)*?(icons\/system\/true.gif|icons\/system\/false.gif)(.)*?(<\/a><\/td>)/":""}

I replace the value of the statustext to avoid users with a different language setting to cirumvent the regex_replace...

Contents of module_custom/News/templates/editarticle.tpl

Code: Select all

{assign var='new_startform' value=$startform}
{assign var='new_endform' value=$endform}
{assign var='startform' value=''}
{assign var='endform' value=''}

{$new_startform}

{capture assign='adminname'}{$smarty.session.cms_admin_username}{/capture}
{if substr_count($extravalue, $adminname)}{assign var='editor' value='1'}{/if}
{if $adminname == "$inputauthor" || $adminname == '##REPLACE_WITH_YOUR_ADMIN_USERNAME##' || $inputauthor == '' || $editor == '1'}
{include file='##REPLACE_WITH_YOUR_ABSOLUTE_PATH##/modules/News/templates/editarticle.tpl'}
{else}<b style="font-weight:bold;color:red;">This article has been created by an other user ({$inputauthor}).<br>Cet article a &eacute;t&eacute; cr&eacute;&eacute; par un autre utilisateur ({$inputauthor}).<br>Dit artikel werd aangemaakt door een andere gebruiker ({$inputauthor}).</b>{/if}

{$new_endform}

Now if someone could share some insight on how to change the Author of an article, the issue of "remove user from cmsms installation > articles owned by removed user are now editable by all" could be tackled...

Greetings,
Manuel

[Wishbone]

I can make a UDT to change the author to the primary admin when a DeleteUserPost event is triggered, if that's what you are looking for.

[manuel]

That sounds perfect!
I would indeed love to see that!!

Greetings,
Manuel

[Wishbone]

OK.. I'll hack one up tonight.

[manuel]

small update:
module_custom/News/templates/articlelist.tpl (now showing removed items to admin)

Code: Select all

{capture assign='adminname'}{$smarty.session.cms_admin_username}{/capture}
{if $adminname != '##REPLACE_WITH_YOUR_ADMIN_USERNAME##'}
{assign var='statustext' value='REPLACED'}
{include file='file:##REPLACE_WITH_YOUR_ABSOLUTE_PATH##/modules/News/templates/articlelist.tpl' assign='capturedtemplate'}
{$capturedtemplate|regex_replace:"/(<th class=\"pageicon\">REPLACED<\/th>)/":""|regex_replace:"/(<td)(.)*?(icons\/system\/true.gif|icons\/system\/false.gif)(.)*?(<\/a><\/td>)/":""}
{else}
{include file='file:##REPLACE_WITH_YOUR_ABSOLUTE_PATH##/modules/News/templates/articlelist.tpl'}
{/if}

module_custom/News/templates/editarticle.tpl (remains the same as posted above)

/module_custom/News/templates/customfieldstab.tpl: (If you don't want editors testing out what would happen if they edit your custom field definitions...)

Code: Select all

{capture assign='adminname'}{$smarty.session.cms_admin_username}{/capture}
{if $adminname != '##REPLACE_WITH_YOUR_ADMIN_USERNAME##'}
<p style="color:red;">Deze functie is niet beschikbaar</p>
<p style="color:red;">Cette fonctionnalit&eacute; n'est pas disponible</p>
<p style="color:red;">This feature is not available</p>
{else}
{include file='file:##REPLACE_WITH_YOUR_ABSOLUTE_PATH##/modules/News/templates/customfieldstab.tpl'}
{/if}

/module_custom/News/templates/categorylist.tpl (If you don't want editors messing up your hard coded categories...)

Code: Select all

{capture assign='adminname'}{$smarty.session.cms_admin_username}{/capture}
{if $adminname != '##REPLACE_WITH_YOUR_ADMIN_USERNAME##'}
<p style="color:red;"><a href="##URL##" target="_blank">Contacteer ##COMPANY##</a> om een categorie toe te voegen</p>
<p style="color:red;"><a href="##URL##" target="_blank">Contactez ##COMPANY##</a> pour ajouter une cat&eacute;gorie</p>
<p style="color:red;"><a href="##URL##" target="_blank">Contact ##COMPANY##</a> to add a category</p>
{else}
{include file='file:##REPLACE_WITH_YOUR_ABSOLUTE_PATH##/modules/News/templates/categorylist.tpl'}
{/if}

Greetings,
Manuel

[Inula]

Hi Manuel,

Know this is an old post, but still very usefull! Thanks a lot for your great piece of work. Didn't know about module_custom, so I learned a lot!

Wondered if it is possible to only list the articles that are editable by Author and hide the rest.

Inula.

[manuel]

Dear Inula,

Glad you found it useful!
To edit the list that is being displayed, you should look at further customizing "articlelist.tpl" (the part below the {foreach from=$items item=entry} where the rows are created listing the articles).
You will need to verify if you can use the same conditions like they are currently used in the "editarticle.tpl" where they determine if the article can be shown/edited or not.
To have this work, the critical test to perform will be "can i use $extravalue" inside that foreach...

{capture assign='adminname'}{$smarty.session.cms_admin_username}{/capture}
{if substr_count($extravalue, $adminname)}{assign var='editor' value='1'}{/if}
{if $adminname == "$inputauthor" || $adminname == '##REPLACE_WITH_YOUR_ADMIN_USERNAME##' || $inputauthor == '' || $editor == '1'}

ps: fair warning: please only use this for non-super-secure websites as the $smarty.session.cms_admin_username is grabbed from a cookie!

Maybe someone who can make a UDT that doesn't grab the admin username from a cookie is reading this? Your input would be greatly appreciated! (can't hurt to try...)

ps2: you can read about using module_custom for customizing language strings and customizing admin templates in the official cmsms docs

Greetings,
Manuel

[Inula]

Dear Manuel,

Have been working on it today. Can't even get the inputauthor to show up in de articlelist. So I think it's not possible to only show the articles from logged-in author.

Thanks anyway!!