calendar-bundle/src/Resources/contao/dca/tl_calendar_events.php
public function checkPermission()
	{
		$bundles = Contao\System::getContainer()->getParameter('kernel.bundles');

		// HOOK: comments extension required
		if (!isset($bundles['ContaoCommentsBundle']))
		{
			$key = array_search('allowComments', $GLOBALS['TL_DCA']['tl_calendar_events']['list']['sorting']['headerFields']);
			unset($GLOBALS['TL_DCA']['tl_calendar_events']['list']['sorting']['headerFields'][$key]);
		}

		if ($this->User->isAdmin)
		{
			return;
		}

		// Set root IDs
		if (empty($this->User->calendars) || !\is_array($this->User->calendars))
		{
			$root = array(0);
		}
		else
		{
			$root = $this->User->calendars;
		}

		$id = \strlen(Contao\Input::get('id')) ? Contao\Input::get('id') : CURRENT_ID;

		// Check current action
		switch (Contao\Input::get('act'))
		{
			case 'paste':
			case 'select':
				if (!\in_array(CURRENT_ID, $root)) // check CURRENT_ID here (see #247)
				{
					throw new Contao\CoreBundle\Exception\AccessDeniedException('Not enough permissions to access calendar ID ' . $id . '.');
				}
				break;

			case 'create':
				if (!\strlen(Contao\Input::get('pid')) || !\in_array(Contao\Input::get('pid'), $root))
				{
					throw new Contao\CoreBundle\Exception\AccessDeniedException('Not enough permissions to create events in calendar ID ' . Contao\Input::get('pid') . '.');
				}
				break;

			case 'cut':
			case 'copy':
				if (!\in_array(Contao\Input::get('pid'), $root))
				{
					throw new Contao\CoreBundle\Exception\AccessDeniedException('Not enough permissions to ' . Contao\Input::get('act') . ' event ID ' . $id . ' to calendar ID ' . Contao\Input::get('pid') . '.');
				}
				// no break;

			case 'edit':
			case 'show':
			case 'delete':
			case 'toggle':
				$objCalendar = $this->Database->prepare("SELECT pid FROM tl_calendar_events WHERE id=?")
											  ->limit(1)
											  ->execute($id);

				if ($objCalendar->numRows < 1)
				{
					throw new Contao\CoreBundle\Exception\AccessDeniedException('Invalid event ID ' . $id . '.');
				}

				if (!\in_array($objCalendar->pid, $root))
				{
					throw new Contao\CoreBundle\Exception\AccessDeniedException('Not enough permissions to ' . Contao\Input::get('act') . ' event ID ' . $id . ' of calendar ID ' . $objCalendar->pid . '.');
				}
				break;

			case 'editAll':
			case 'deleteAll':
			case 'overrideAll':
			case 'cutAll':
			case 'copyAll':
				if (!\in_array($id, $root))
				{
					throw new Contao\CoreBundle\Exception\AccessDeniedException('Not enough permissions to access calendar ID ' . $id . '.');
				}

				$objCalendar = $this->Database->prepare("SELECT id FROM tl_calendar_events WHERE pid=?")
											  ->execute($id);

				/** @var Symfony\Component\HttpFoundation\Session\SessionInterface $objSession */
				$objSession = Contao\System::getContainer()->get('session');

				$session = $objSession->all();
				$session['CURRENT']['IDS'] = array_intersect((array) $session['CURRENT']['IDS'], $objCalendar->fetchEach('id'));
				$objSession->replace($session);
				break;

			default:
				if (\strlen(Contao\Input::get('act')))
				{
					throw new Contao\CoreBundle\Exception\AccessDeniedException('Invalid command "' . Contao\Input::get('act') . '".');
				}
				elseif (!\in_array($id, $root))
				{
					throw new Contao\CoreBundle\Exception\AccessDeniedException('Not enough permissions to access calendar ID ' . $id . '.');
				}
				break;
		}
	}
public function checkPermission()
	{
		$bundles = Contao\System::getContainer()->getParameter('kernel.bundles');

		// HOOK: comments extension required
		if (!isset($bundles['ContaoCommentsBundle']))
		{
			$key = array_search('allowComments', $GLOBALS['TL_DCA']['tl_calendar_events']['list']['sorting']['headerFields']);
			unset($GLOBALS['TL_DCA']['tl_calendar_events']['list']['sorting']['headerFields'][$key]);
		}

		if ($this->User->isAdmin)
		{
			return;
		}

		// Set root IDs
		if (empty($this->User->calendars) || !\is_array($this->User->calendars))
		{
			$root = array(0);
		}
		else
		{
			$root = $this->User->calendars;
		}

		$id = \strlen(Contao\Input::get('id')) ? Contao\Input::get('id') : CURRENT_ID;

		// Check current action
		switch (Contao\Input::get('act'))
		{
			case 'paste':
			case 'select':
				if (!\in_array(CURRENT_ID, $root)) // check CURRENT_ID here (see #247)
				{
					throw new Contao\CoreBundle\Exception\AccessDeniedException('Not enough permissions to access calendar ID ' . $id . '.');
				}
				break;

			case 'create':
				if (!\strlen(Contao\Input::get('pid')) || !\in_array(Contao\Input::get('pid'), $root))
				{
					throw new Contao\CoreBundle\Exception\AccessDeniedException('Not enough permissions to create events in calendar ID ' . Contao\Input::get('pid') . '.');
				}
				break;

			case 'cut':
			case 'copy':
				if (!\in_array(Contao\Input::get('pid'), $root))
				{
					throw new Contao\CoreBundle\Exception\AccessDeniedException('Not enough permissions to ' . Contao\Input::get('act') . ' event ID ' . $id . ' to calendar ID ' . Contao\Input::get('pid') . '.');
				}
				// no break;

			case 'edit':
			case 'show':
			case 'delete':
			case 'toggle':
				$objCalendar = $this->Database->prepare("SELECT pid FROM tl_calendar_events WHERE id=?")
											  ->limit(1)
											  ->execute($id);

				if ($objCalendar->numRows < 1)
				{
					throw new Contao\CoreBundle\Exception\AccessDeniedException('Invalid event ID ' . $id . '.');
				}

				if (!\in_array($objCalendar->pid, $root))
				{
					throw new Contao\CoreBundle\Exception\AccessDeniedException('Not enough permissions to ' . Contao\Input::get('act') . ' event ID ' . $id . ' of calendar ID ' . $objCalendar->pid . '.');
				}
				break;

			case 'editAll':
			case 'deleteAll':
			case 'overrideAll':
			case 'cutAll':
			case 'copyAll':
				if (!\in_array($id, $root))
				{
					throw new Contao\CoreBundle\Exception\AccessDeniedException('Not enough permissions to access calendar ID ' . $id . '.');
				}

				$objCalendar = $this->Database->prepare("SELECT id FROM tl_calendar_events WHERE pid=?")
											  ->execute($id);

				/** @var Symfony\Component\HttpFoundation\Session\SessionInterface $objSession */
				$objSession = Contao\System::getContainer()->get('session');

				$session = $objSession->all();
				$session['CURRENT']['IDS'] = array_intersect((array) $session['CURRENT']['IDS'], $objCalendar->fetchEach('id'));
				$objSession->replace($session);
				break;

			default:
				if (\strlen(Contao\Input::get('act')))
				{
					throw new Contao\CoreBundle\Exception\AccessDeniedException('Invalid command "' . Contao\Input::get('act') . '".');
				}
				elseif (!\in_array($id, $root))
				{
					throw new Contao\CoreBundle\Exception\AccessDeniedException('Not enough permissions to access calendar ID ' . $id . '.');
				}
				break;
		}
	}
public function checkPermission ( ) { $ bundles = Contao \ System :: getContainer ( ) -> getParameter ( 'kernel.bundles' ) ; // HOOK: comments extension required if ( ! isset ( $ bundles [ 'ContaoCommentsBundle' ] ) ) { $ key = array_search ( 'allowComments' , $ GLOBALS [ 'TL_DCA' ] [ 'tl_calendar_events' ] [ 'list' ] [ 'sorting' ] [ 'headerFields' ] ) ; unset ( $ GLOBALS [ 'TL_DCA' ] [ 'tl_calendar_events' ] [ 'list' ] [ 'sorting' ] [ 'headerFields' ] [ $ key ] ) ; } if ( $ this -> User -> isAdmin ) { return ; } // Set root IDs if ( empty ( $ this -> User -> calendars ) || ! \ is_array ( $ this -> User -> calendars ) ) { $ root = array ( 0 ) ; } else { $ root = $ this -> User -> calendars ; } $ id = \ strlen ( Contao \ Input :: get ( 'id' ) ) ? Contao \ Input :: get ( 'id' ) : CURRENT_ID ; // Check current action switch ( Contao \ Input :: get ( 'act' ) ) { case 'paste' : case 'select' : if ( ! \ in_array ( CURRENT_ID , $ root ) ) // check CURRENT_ID here (see #247) { throw new Contao \ CoreBundle \ Exception \ AccessDeniedException ( 'Not enough permissions to access calendar ID ' . $ id . '.' ) ; } break ; case 'create' : if ( ! \ strlen ( Contao \ Input :: get ( 'pid' ) ) || ! \ in_array ( Contao \ Input :: get ( 'pid' ) , $ root ) ) { throw new Contao \ CoreBundle \ Exception \ AccessDeniedException ( 'Not enough permissions to create events in calendar ID ' . Contao \ Input :: get ( 'pid' ) . '.' ) ; } break ; case 'cut' : case 'copy' : if ( ! \ in_array ( Contao \ Input :: get ( 'pid' ) , $ root ) ) { throw new Contao \ CoreBundle \ Exception \ AccessDeniedException ( 'Not enough permissions to ' . Contao \ Input :: get ( 'act' ) . ' event ID ' . $ id . ' to calendar ID ' . Contao \ Input :: get ( 'pid' ) . '.' ) ; } // no break; case 'edit' : case 'show' : case 'delete' : case 'toggle' : $ objCalendar = $ this -> Database -> prepare ( "SELECT pid FROM tl_calendar_events WHERE id=?" ) -> limit ( 1 ) -> execute ( $ id ) ; if ( $ objCalendar -> numRows < 1 ) { throw new Contao \ CoreBundle \ Exception \ AccessDeniedException ( 'Invalid event ID ' . $ id . '.' ) ; } if ( ! \ in_array ( $ objCalendar -> pid , $ root ) ) { throw new Contao \ CoreBundle \ Exception \ AccessDeniedException ( 'Not enough permissions to ' . Contao \ Input :: get ( 'act' ) . ' event ID ' . $ id . ' of calendar ID ' . $ objCalendar -> pid . '.' ) ; } break ; case 'editAll' : case 'deleteAll' : case 'overrideAll' : case 'cutAll' : case 'copyAll' : if ( ! \ in_array ( $ id , $ root ) ) { throw new Contao \ CoreBundle \ Exception \ AccessDeniedException ( 'Not enough permissions to access calendar ID ' . $ id . '.' ) ; } $ objCalendar = $ this -> Database -> prepare ( "SELECT id FROM tl_calendar_events WHERE pid=?" ) -> execute ( $ id ) ; /** @var Symfony\Component\HttpFoundation\Session\SessionInterface $objSession */ $ objSession = Contao \ System :: getContainer ( ) -> get ( 'session' ) ; $ session = $ objSession -> all ( ) ; $ session [ 'CURRENT' ] [ 'IDS' ] = array_intersect ( ( array ) $ session [ 'CURRENT' ] [ 'IDS' ] , $ objCalendar -> fetchEach ( 'id' ) ) ; $ objSession -> replace ( $ session ) ; break ; default : if ( \ strlen ( Contao \ Input :: get ( 'act' ) ) ) { throw new Contao \ CoreBundle \ Exception \ AccessDeniedException ( 'Invalid command "' . Contao \ Input :: get ( 'act' ) . '".' ) ; } elseif ( ! \ in_array ( $ id , $ root ) ) { throw new Contao \ CoreBundle \ Exception \ AccessDeniedException ( 'Not enough permissions to access calendar ID ' . $ id . '.' ) ; } break ; } }
Check permissions to edit table tl_calendar_events

@throws Contao\CoreBundle\Exception\AccessDeniedException
Check permissions to edit table tl_calendar_events