From e352458ef09a278a87d3cc3aba3021062658d2ef Mon Sep 17 00:00:00 2001
From: rabuzarus <>
Date: Thu, 23 Jun 2016 10:07:13 +0200
Subject: [PATCH] pub calendar - permission clean up and docu

---
 include/event.php | 25 +++++++++++++++++++------
 mod/cal.php       |  3 ++-
 2 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/include/event.php b/include/event.php
index f2783ab36e..7b77ee8d61 100644
--- a/include/event.php
+++ b/include/event.php
@@ -818,13 +818,26 @@ function widget_events() {
 	// of the profile page it should be the personal /events page. So we can use $a->user
 	$user = ($a->data['user']['nickname'] ? $a->data['user']['nickname'] : $a->user['nickname']);
 
-	// a little bit tricky permission testing because we have to respect many cases
-	if(!(local_user()) && !($owner_uid) // not the private events page (we don't get the $owner_uid for /events)
-			|| (intval($owner_uid) && local_user() !== $owner_uid && !(feature_enabled($owner_uid, "export_calendar"))) // cal logged in user (test permission at foreign profile page)
-			|| ( !(local_user()) && !(feature_enabled($owner_uid, "export_calendar"))) // if cal && not logged in && feature is not enabled
-		) {
+
+	// The permission testing is a little bit tricky because we have to respect many cases
+
+	// It's not the private events page (we don't get the $owner_uid for /events)
+	if(! local_user() && ! $owner_uid)
+		return;
+
+	// Cal logged in user (test permission at foreign profile page)
+	// If the $owner uid is available we know it is part of one of the profile pages (like /cal)
+	// So we have to test if if it's the own profile page of the logged in user 
+	// or a foreign one. For foreign profile pages we need to check if the feature
+	// for exporting the cal is enabled (otherwise the widget would appear for logged in users
+	// on foreigen profile pages even if the widget is disabled)
+	if(intval($owner_uid) && local_user() !== $owner_uid && ! feature_enabled($owner_uid, "export_calendar")) 
+		return;
+
+	// If it's a kind of profile page (intval($owner_uid)) return if the user not logged in and
+	// export feature isn't enabled
+	if(intval($owner_uid) && ! local_user() && ! feature_enabled($owner_uid, "export_calendar"))
 		return;
-	}
 
 	return replace_macros(get_markup_template("events_aside.tpl"), array(
 		'$etitle' => t("Export"),
diff --git a/mod/cal.php b/mod/cal.php
index b04c3aab42..a211a0ead9 100644
--- a/mod/cal.php
+++ b/mod/cal.php
@@ -303,7 +303,8 @@ function cal_content(&$a) {
 		}
 
 		// Test permissions
-		if( ((local_user() !== $owner_uid)) && !(feature_enabled($owner_uid, "export_calendar"))) {
+		// Respect the export feature setting for all other /cal pages if it's not the own profile
+		if( ((local_user() !== $owner_uid)) && ! feature_enabled($owner_uid, "export_calendar")) {
 			notice( t('Permission denied.') . EOL);
 			return;
 		}
-- 
2.39.5