source: trunk/admin/cat_perm.php @ 12020

Revision 12020, 9.6 KB checked in by flop25, 8 years ago (diff)

token added for permissions

  • Property svn:eol-style set to LF
Line 
1<?php
2// +-----------------------------------------------------------------------+
3// | Piwigo - a PHP based photo gallery                                    |
4// +-----------------------------------------------------------------------+
5// | Copyright(C) 2008-2011 Piwigo Team                  http://piwigo.org |
6// | Copyright(C) 2003-2008 PhpWebGallery Team    http://phpwebgallery.net |
7// | Copyright(C) 2002-2003 Pierrick LE GALL   http://le-gall.net/pierrick |
8// +-----------------------------------------------------------------------+
9// | This program is free software; you can redistribute it and/or modify  |
10// | it under the terms of the GNU General Public License as published by  |
11// | the Free Software Foundation                                          |
12// |                                                                       |
13// | This program is distributed in the hope that it will be useful, but   |
14// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
15// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
16// | General Public License for more details.                              |
17// |                                                                       |
18// | You should have received a copy of the GNU General Public License     |
19// | along with this program; if not, write to the Free Software           |
20// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
21// | USA.                                                                  |
22// +-----------------------------------------------------------------------+
23
24if (!defined('PHPWG_ROOT_PATH'))
25{
26  die ("Hacking attempt!");
27}
28
29include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
30
31// +-----------------------------------------------------------------------+
32// | Check Access and exit when user status is not ok                      |
33// +-----------------------------------------------------------------------+
34check_status(ACCESS_ADMINISTRATOR);
35
36// +-----------------------------------------------------------------------+
37// |                       variable initialization                         |
38// +-----------------------------------------------------------------------+
39
40// if the category is not correct (not numeric, not private)
41if (isset($_GET['cat']) and is_numeric($_GET['cat']))
42{
43  $query = '
44SELECT status
45  FROM '.CATEGORIES_TABLE.'
46  WHERE id = '.$_GET['cat'].'
47;';
48  list($status) = pwg_db_fetch_row(pwg_query($query));
49 
50  if ('private' == $status)
51  {
52    $page['cat'] = $_GET['cat'];
53  }
54}
55
56if (!isset($page['cat']))
57{
58  $query = '
59SELECT id
60  FROM '.CATEGORIES_TABLE.'
61  WHERE status = \'private\'
62  LIMIT 1
63;';
64
65  list($page['cat']) = pwg_db_fetch_row(pwg_query($query));
66}
67
68// +-----------------------------------------------------------------------+
69// |                           form submission                             |
70// +-----------------------------------------------------------------------+
71if (isset($_POST['deny_groups_submit']) or isset($_POST['grant_groups_submit']) or isset($_POST['deny_users_submit']) or isset($_POST['grant_users_submit']) )
72{
73  check_pwg_token();
74}
75
76if (isset($_POST['deny_groups_submit'])
77         and isset($_POST['deny_groups'])
78         and count($_POST['deny_groups']) > 0)
79{
80  // if you forbid access to a category, all sub-categories become
81  // automatically forbidden
82  $query = '
83DELETE
84  FROM '.GROUP_ACCESS_TABLE.'
85  WHERE group_id IN ('.implode(',', $_POST['deny_groups']).')
86    AND cat_id IN ('.implode(',', get_subcat_ids(array($page['cat']))).')
87;';
88  pwg_query($query);
89}
90else if (isset($_POST['grant_groups_submit'])
91         and isset($_POST['grant_groups'])
92         and count($_POST['grant_groups']) > 0)
93{
94  $cat_ids = (isset($_POST['apply_on_sub'])) ? implode(',', get_subcat_ids(array($page['cat']))).",".implode(',', get_uppercat_ids(array($page['cat']))) : implode(',', get_uppercat_ids(array($page['cat'])));
95
96  $query = '
97SELECT id
98  FROM '.CATEGORIES_TABLE.'
99  WHERE id IN ('.$cat_ids.')
100  AND status = \'private\'
101;';
102  $private_cats = array_from_query($query, 'id');
103
104  // We must not reinsert already existing lines in group_access table
105  $granteds = array();
106  foreach ($private_cats as $cat_id)
107  {
108    $granteds[$cat_id] = array();
109  }
110 
111  $query = '
112SELECT group_id, cat_id
113  FROM '.GROUP_ACCESS_TABLE.'
114  WHERE cat_id IN ('.implode(',', $private_cats).')
115    AND group_id IN ('.implode(',', $_POST['grant_groups']).')
116;';
117  $result = pwg_query($query);
118  while ($row = pwg_db_fetch_assoc($result))
119  {
120    array_push($granteds[$row['cat_id']], $row['group_id']);
121  }
122
123  $inserts = array();
124 
125  foreach ($private_cats as $cat_id)
126  {
127    $group_ids = array_diff($_POST['grant_groups'], $granteds[$cat_id]);
128    foreach ($group_ids as $group_id)
129    {
130      array_push($inserts, array('group_id' => $group_id,
131                                 'cat_id' => $cat_id));
132    }
133  }
134
135  mass_inserts(GROUP_ACCESS_TABLE, array('group_id','cat_id'), $inserts);
136}
137else if (isset($_POST['deny_users_submit'])
138         and isset($_POST['deny_users'])
139         and count($_POST['deny_users']) > 0)
140{
141  // if you forbid access to a category, all sub-categories become
142  // automatically forbidden
143  $query = '
144DELETE
145  FROM '.USER_ACCESS_TABLE.'
146  WHERE user_id IN ('.implode(',', $_POST['deny_users']).')
147    AND cat_id IN ('.implode(',', get_subcat_ids(array($page['cat']))).')
148;';
149  pwg_query($query);
150}
151else if (isset($_POST['grant_users_submit']))
152{
153  add_permission_on_category($page['cat'], $_POST['grant_users']);
154}
155
156// +-----------------------------------------------------------------------+
157// |                       template initialization                         |
158// +-----------------------------------------------------------------------+
159
160$template->set_filename('cat_perm', 'cat_perm.tpl');
161
162$template->assign(
163  array(
164    'CATEGORIES_NAV' =>
165      get_cat_display_name_from_id(
166        $page['cat'],
167        'admin.php?page=cat_modify&amp;cat_id='
168        ),
169    'U_HELP' => get_root_url().'admin/popuphelp.php?page=cat_perm',
170    'F_ACTION' => get_root_url().'admin.php?page=cat_perm&amp;cat='.$page['cat']
171    )
172  );
173
174// +-----------------------------------------------------------------------+
175// |                          form construction                            |
176// +-----------------------------------------------------------------------+
177
178// groups denied are the groups not granted. So we need to find all groups
179// minus groups granted to find groups denied.
180
181$groups = array();
182
183$query = '
184SELECT id, name
185  FROM '.GROUPS_TABLE.'
186  ORDER BY name ASC
187;';
188$groups = simple_hash_from_query($query, 'id', 'name');
189$template->assign('all_groups', $groups);
190
191// groups granted to access the category
192$query = '
193SELECT group_id
194  FROM '.GROUP_ACCESS_TABLE.'
195  WHERE cat_id = '.$page['cat'].'
196;';
197$group_granted_ids = array_from_query($query, 'group_id');
198$group_granted_ids = order_by_name($group_granted_ids, $groups);
199$template->assign('group_granted_ids', $group_granted_ids);
200
201
202// groups denied
203$template->assign('group_denied_ids',
204    order_by_name(array_diff(array_keys($groups), $group_granted_ids), $groups)
205  );
206
207// users...
208$users = array();
209
210$query = '
211SELECT '.$conf['user_fields']['id'].' AS id,
212       '.$conf['user_fields']['username'].' AS username
213  FROM '.USERS_TABLE.'
214;';
215$users = simple_hash_from_query($query, 'id', 'username');
216$template->assign('all_users', $users);
217
218
219$query = '
220SELECT user_id
221  FROM '.USER_ACCESS_TABLE.'
222  WHERE cat_id = '.$page['cat'].'
223;';
224$user_granted_direct_ids = array_from_query($query, 'user_id');
225$user_granted_direct_ids = order_by_name($user_granted_direct_ids, $users);
226$template->assign('user_granted_direct_ids', $user_granted_direct_ids);
227
228
229
230$user_granted_indirect_ids = array();
231if (count($group_granted_ids) > 0)
232{
233  $granted_groups = array();
234
235  $query = '
236SELECT user_id, group_id
237  FROM '.USER_GROUP_TABLE.'
238  WHERE group_id IN ('.implode(',', $group_granted_ids).')
239';
240  $result = pwg_query($query);
241  while ($row = pwg_db_fetch_assoc($result))
242  {
243    if (!isset($granted_groups[$row['group_id']]))
244    {
245      $granted_groups[$row['group_id']] = array();
246    }
247    array_push($granted_groups[$row['group_id']], $row['user_id']);
248  }
249
250  $user_granted_by_group_ids = array();
251
252  foreach ($granted_groups as $group_users)
253  {
254    $user_granted_by_group_ids = array_merge($user_granted_by_group_ids,
255                                             $group_users);
256  }
257  $user_granted_by_group_ids = array_unique($user_granted_by_group_ids);
258 
259 
260  $user_granted_indirect_ids = array_diff($user_granted_by_group_ids,
261                                          $user_granted_direct_ids);
262  $user_granted_indirect_ids = 
263    order_by_name($user_granted_indirect_ids, $users); 
264  foreach ($user_granted_indirect_ids as $user_id)
265  {
266    foreach ($granted_groups as $group_id => $group_users)
267    {
268      if (in_array($user_id, $group_users))
269      {
270        $template->append(
271          'user_granted_indirects',
272          array(
273            'USER'=>$users[$user_id],
274            'GROUP'=>$groups[$group_id]
275            )
276          );
277        break;
278      }
279    }
280  }
281}
282
283$user_denied_ids = array_diff(array_keys($users),
284                              $user_granted_indirect_ids,
285                              $user_granted_direct_ids);
286$user_denied_ids = order_by_name($user_denied_ids, $users);
287$template->assign('user_denied_ids', $user_denied_ids);
288
289
290// +-----------------------------------------------------------------------+
291// |                           sending html code                           |
292// +-----------------------------------------------------------------------+
293$template->assign(array('PWG_TOKEN' => get_pwg_token()));
294
295$template->assign_var_from_handle('ADMIN_CONTENT', 'cat_perm');
296?>
Note: See TracBrowser for help on using the repository browser.