quote:

---

On the "Events Calendar Mod", it seems that Any "normal user" can Edit/Delete any other member's Event ( including Admin's events). Shouldn't this work the same way that normal Posts work, where every member can ONLY edit/delete their own posts.

---

select case sMode
 case "delete" 
  if mlev >= intAllowed then
   sSQL = "DELETE FROM " & strTablePrefix & "EVENTS WHERE Event_ID=" & Request.QueryString("Event_ID")
   my_Conn.Execute ssql
   strCMessage = "The selected event was deleted"
  end if

select case sMode
  case "delete" 
   if mlev >= intAllowed then
    sSQL = "SELECT ADDED_BY FROM " & strTablePrefix & "EVENTS WHERE EVENT_ID=" & Request.QueryString("Event_ID")
    Set rsDelete = Server.CreateObject("ADODB.RECORDSET")
    rsDelete.Open sSQL, my_Conn, adOpenForwardOnly, adLockReadOnly, adCmdTxt
    if not(rsDelete.EOF or rsDelete.BOF) then
     if (clng(rsDelete("ADDED_BY")) = MemberID) or (mlev = 4) then
      sSQL = "DELETE FROM " & strTablePrefix & "EVENTS WHERE Event_ID=" & Request.QueryString("Event_ID")
      my_Conn.Execute ssql
      strCMessage = "The selected event was deleted"
     else
      strCMessage = "No authorization to delete the event"
     end if
    else
     strCMessage = "The selected event was not found"
    end if
    rsDelete.Close
    Set rsDelete = Nothing
   end if

	case "edit"
   if mlev >= intAllowed then
    sSQL = "SELECT ADDED_BY FROM " & strTablePrefix & "EVENTS WHERE EVENT_ID=" & Request.QueryString("Event_ID")
    Set rsEdit = Server.CreateObject("ADODB.RECORDSET")
    rsEdit.Open sSQL, my_Conn, adOpenForwardOnly, adLockReadOnly, adCmdTxt
    if not(rsEdit.EOF or rsEdit.BOF) then
     if (clng(rsEdit("ADDED_BY")) = MemberID) or (mlev = 4) then
      sMode = "edit"
      strCMessage = "Event Edit Successful"
     else
      strCMessage = "No authorization to edit the event"
     end if
    else
     strCMessage = "The selected event was not found"
    end if
    rsEdit.Close
    Set rsEdit = Nothing
   end if

'set the mode
dim sMode, berror
sMode = Request.QueryString("mode")
select case sMode
 case "delete" 
 if mlev >= intAllowed then
  sSQL = "DELETE FROM " & strTablePrefix & "EVENTS WHERE Event_ID=" & Request.QueryString("Event_ID")
  my_Conn.Execute ssql
  strCMessage = "The selected event was deleted"
 end if
case "edit"
 if mlev >= intAllowed then
  sMode = "edit"
  strCMessage = "Event Edit Successful"
 end if
case "add"
 if mlev >= intAllowed then
  smode = "add"
 end if
end select

'**set the mode
dim sMode, bError, strCMessage
sMode = Request.QueryString("mode")
select case sMode
 case "delete" 
  if mlev >= intAllowed then
   if CheckAuthorization() then
    sSQL = "DELETE FROM " & strTablePrefix & "EVENTS WHERE Event_ID=" & Request.QueryString("Event_ID")
    my_Conn.Execute ssql
    strCMessage = "The selected event was deleted"
   end if
  end if
case "edit"
 sMode = ""
 if mlev >= intAllowed then
  if CheckAuthorization() then
   sMode = "edit"
   strCMessage = "Event Edit Successful"
  end if
 end if
case "add"
 if mlev < intAllowed then
  sMode = ""
 end if
end select

function CheckAuthorization()
    dim strSql, rsAuthorization
    if mLev = 4 then  CheckAuthorization = true : exit function
    CheckAuthorization = false
    strSql = "SELECT ADDED_BY FROM " & strTablePrefix & "EVENTS E WHERE E.EVENT_ID=" & Request.QueryString("Event_ID")
    Set rsAuthorization = Server.CreateObject("ADODB.RECORDSET")
    rsAuthorization.Open strSql, my_Conn, adOpenForwardOnly, adLockReadOnly, adCmdTxt
    if not (rsAuthorization.BOF or rsAuthorization.EOF) then 
     if (clng(rsAuthorization("ADDED_BY")) = MemberID) then 
      CheckAuthorization = true
     else
      strCMessage  = "No authorization to modify/delete the event"
     end if
    else
     strCMessage = "The selected event was not found"
    end if
    rsAuthorization.Close 
    Set rsAuthorization = nothing
end function