source: branches/branch-1_5/admin/user_perm.php @ 1003

Last change on this file since 1003 was 1003, checked in by nikrou, 18 years ago

Improve security of sessions:

  • use only cookies to store session id on client side
  • use default php session system with database handler to store sessions on server side
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 7.0 KB
Line 
1<?php
2// +-----------------------------------------------------------------------+
3// | PhpWebGallery - a PHP based picture gallery                           |
4// | Copyright (C) 2002-2003 Pierrick LE GALL - pierrick@phpwebgallery.net |
5// | Copyright (C) 2003-2005 PhpWebGallery Team - http://phpwebgallery.net |
6// +-----------------------------------------------------------------------+
7// | branch        : BSF (Best So Far)
8// | file          : $RCSfile$
9// | last update   : $Date: 2006-01-15 12:52:55 +0000 (Sun, 15 Jan 2006) $
10// | last modifier : $Author: nikrou $
11// | revision      : $Revision: 1003 $
12// +-----------------------------------------------------------------------+
13// | This program is free software; you can redistribute it and/or modify  |
14// | it under the terms of the GNU General Public License as published by  |
15// | the Free Software Foundation                                          |
16// |                                                                       |
17// | This program is distributed in the hope that it will be useful, but   |
18// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
19// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
20// | General Public License for more details.                              |
21// |                                                                       |
22// | You should have received a copy of the GNU General Public License     |
23// | along with this program; if not, write to the Free Software           |
24// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
25// | USA.                                                                  |
26// +-----------------------------------------------------------------------+
27
28if (!defined('IN_ADMIN'))
29{
30  die('Hacking attempt!');
31}
32include_once(PHPWG_ROOT_PATH.'admin/include/isadmin.inc.php');
33
34// +-----------------------------------------------------------------------+
35// |                            variables init                             |
36// +-----------------------------------------------------------------------+
37
38if (isset($_GET['user_id']) and is_numeric($_GET['user_id']))
39{
40  $page['user'] = $_GET['user_id'];
41}
42else
43{
44  echo l10n('user_id URL parameter is missing');
45  exit();
46}
47
48// +-----------------------------------------------------------------------+
49// |                                updates                                |
50// +-----------------------------------------------------------------------+
51
52if (isset($_POST['falsify'])
53    and isset($_POST['cat_true'])
54    and count($_POST['cat_true']) > 0)
55{
56  // if you forbid access to a category, all sub-categories become
57  // automatically forbidden
58  $subcats = get_subcat_ids($_POST['cat_true']);
59  $query = '
60DELETE FROM '.USER_ACCESS_TABLE.'
61  WHERE user_id = '.$page['user'].'
62    AND cat_id IN ('.implode(',', $subcats).')
63;';
64  pwg_query($query);
65}
66else if (isset($_POST['trueify'])
67         and isset($_POST['cat_false'])
68         and count($_POST['cat_false']) > 0)
69{
70  $uppercats = get_uppercat_ids($_POST['cat_false']);
71  $private_uppercats = array();
72
73  $query = '
74SELECT id
75  FROM '.CATEGORIES_TABLE.'
76  WHERE id IN ('.implode(',', $uppercats).')
77    AND status = \'private\'
78;';
79  $result = pwg_query($query);
80  while ($row = mysql_fetch_array($result))
81  {
82    array_push($private_uppercats, $row['id']);
83  }
84
85  // retrying to authorize a category which is already authorized may cause
86  // an error (in SQL statement), so we need to know which categories are
87  // accesible
88  $authorized_ids = array();
89   
90  $query = '
91SELECT cat_id
92  FROM '.USER_ACCESS_TABLE.'
93  WHERE user_id = '.$page['user'].'
94;';
95  $result = pwg_query($query);
96 
97  while ($row = mysql_fetch_array($result))
98  {
99    array_push($authorized_ids, $row['cat_id']);
100  }
101 
102  $inserts = array();
103  $to_autorize_ids = array_diff($private_uppercats, $authorized_ids);
104  foreach ($to_autorize_ids as $to_autorize_id)
105  {
106    array_push($inserts, array('user_id' => $page['user'],
107                               'cat_id' => $to_autorize_id));
108  }
109
110  mass_inserts(USER_ACCESS_TABLE, array('user_id','cat_id'), $inserts);
111}
112
113// +-----------------------------------------------------------------------+
114// |                             template init                             |
115// +-----------------------------------------------------------------------+
116
117$template->set_filenames(
118  array(
119    'user_perm' => 'admin/user_perm.tpl',
120    'double_select' => 'admin/double_select.tpl'
121    )
122  );
123
124$template->assign_vars(
125  array(
126    'TITLE' =>
127      sprintf(
128        l10n('Manage permissions for user "%s"'),
129        get_username($page['user']
130          )
131        ),
132    'L_CAT_OPTIONS_TRUE'=>$lang['authorized'],
133    'L_CAT_OPTIONS_FALSE'=>$lang['forbidden'],
134   
135    'F_ACTION' =>
136        PHPWG_ROOT_PATH.
137        'admin.php?page=user_perm'.
138        '&amp;user_id='.$page['user']
139    )
140  );
141
142
143// retrieve category ids authorized to the groups the user belongs to
144$group_authorized = array();
145
146$query = '
147SELECT DISTINCT cat_id, c.uppercats, c.global_rank
148  FROM '.USER_GROUP_TABLE.' AS ug
149    INNER JOIN '.GROUP_ACCESS_TABLE.' AS ga
150      ON ug.group_id = ga.group_id
151    INNER JOIN '.CATEGORIES_TABLE.' AS c
152      ON c.id = ga.cat_id
153  WHERE ug.user_id = '.$page['user'].'
154;';
155$result = pwg_query($query);
156
157if (mysql_num_rows($result) > 0)
158{
159  $template->assign_block_vars('groups', array());
160
161  $cats = array();
162  while ($row = mysql_fetch_array($result))
163  {
164    array_push($cats, $row);
165    array_push($group_authorized, $row['cat_id']);
166  }
167  usort($cats, 'global_rank_compare');
168
169  foreach ($cats as $category)
170  {
171    $template->assign_block_vars(
172      'groups.category',
173      array(
174        'NAME' => get_cat_display_name_cache($category['uppercats'], '', false)
175        )
176      );
177  }
178}
179
180// only private categories are listed
181$query_true = '
182SELECT id,name,uppercats,global_rank
183  FROM '.CATEGORIES_TABLE.' INNER JOIN '.USER_ACCESS_TABLE.' ON cat_id = id
184  WHERE status = \'private\'
185    AND user_id = '.$page['user'];
186if (count($group_authorized) > 0)
187{
188  $query_true.= '
189    AND cat_id NOT IN ('.implode(',', $group_authorized).')';
190}
191$query_true.= '
192;';
193display_select_cat_wrapper($query_true,array(),'category_option_true');
194 
195$result = pwg_query($query_true);
196$authorized_ids = array();
197while ($row = mysql_fetch_array($result))
198{
199  array_push($authorized_ids, $row['id']);
200}
201
202$query_false = '
203SELECT id,name,uppercats,global_rank
204  FROM '.CATEGORIES_TABLE.'
205  WHERE status = \'private\'';
206if (count($authorized_ids) > 0)
207{
208  $query_false.= '
209    AND id NOT IN ('.implode(',', $authorized_ids).')';
210}
211if (count($group_authorized) > 0)
212{
213  $query_false.= '
214    AND id NOT IN ('.implode(',', $group_authorized).')';
215}
216$query_false.= '
217;';
218display_select_cat_wrapper($query_false,array(),'category_option_false');
219
220// +-----------------------------------------------------------------------+
221// |                           sending html code                           |
222// +-----------------------------------------------------------------------+
223
224$template->assign_var_from_handle('DOUBLE_SELECT', 'double_select');
225$template->assign_var_from_handle('ADMIN_CONTENT', 'user_perm');
226?>
Note: See TracBrowser for help on using the repository browser.