Stuff

<?php
// $Id$

/**
 * @file
 * Restrict upload permissions by type.
 */

/**
 * Implementation of hook_menu().
 */
function upload_perm_per_type_menu($may_cache) {
  $items = array();

  $items[] = array(
    'path' => 'admin/settings/upload_perm_per_type',
    'title' => t('Upload permissions per content type'),
    'description' => t('Restrict access to the upload form, per role, per content type.'),
    'callback' => 'drupal_get_form',
    'callback arguments' => array('upload_perm_per_type_settings'),
  );

  return $items;
}

/**
 * Admin settings form.
 */
function upload_perm_per_type_settings() {
  $form['upload_types'] = array(
    '#type' => 'fieldset',
    '#title' => t('Types'),
    '#description' => t('Check off the roles that should have permission to upload files to the given content types. Click the name of any content type to be taken to its settings page in order to enable/disable file uploads. Note that the only roles listed are those with "upload files" permissions. To configure access permissions, go to the <a href="@access">access control</a> page.', array('@access' => url('admin/user/access'))),
    '#theme' => 'upload_perm_per_type_list',
  );

  // Get a list of all roles who have access to upload files.
  $roles = user_roles(0, 'upload files');
  $num_roles = count($roles);

  // Loop through types with uploads enabled.
  $types = node_get_types();
  foreach ($types as $type => $info) {
    $form['upload_types'][$type]['type'] = array(
      '#value' => l($info->name, "admin/content/types/$type"),
    );
    $form['upload_types'][$type]["upload_perm_roles_$type"] = array(
      '#type' => 'checkboxes',
      '#options' => $roles,
      '#default_value' => variable_get("upload_perm_roles_$type", array_fill(0, $num_roles, 1)),
      '#disabled' => !variable_get("upload_$type", 1),
    );
  }

  return system_settings_form($form);
}

/**
 * Themes the content type / role listing on the settings page.
 *
 * @ingroup themeable
 */
function theme_upload_perm_per_type_list($form) {
  foreach (element_children($form) as $type) {
    $row = array();
    if (is_array($form[$type]['type'])) {
      $row[] = drupal_render($form[$type]['type']);
      $row[] = drupal_render($form[$type]["upload_perm_roles_$type"]);
    }
    $rows[] = $row;
  }

  $header = array(t('Content type'), t('Roles'));
  return theme('table', $header, $rows);
}

/**
 * Implementation of hook_form_alter().
 */
function upload_perm_per_type_form_alter($form_id, &$form) {
  global $user;

  // Check on node forms whether or not user has upload permissions.
  if (isset($form['type']) && isset($form['#node'])) {
    $type = $form['type']['#value'];

    // Make sure user is allowed to upload files and that file attachments are
    // turned on for this content type.
    if (variable_get("upload_$type", 1) && user_access('upload files')) {

      // Check user's roles against list of allowed roles.
      $user_roles = array_flip($user->roles);
      $allowed_roles = variable_get("upload_perm_roles_$type", 1);
      $intersection = array_intersect($user_roles, $allowed_roles);

      // If no roles were found in common, and we're not the superuser, deny
      // access to the form.
      if (empty($intersection) && $user->uid != 1) {
        $form['attachments']['#access'] = 0;
      }

    }
  }
}