1 | <?php |
---|
2 | // +-----------------------------------------------------------------------+ |
---|
3 | // | PhpWebGallery - a PHP based picture gallery | |
---|
4 | // | Copyright (C) 2002-2003 Pierrick LE GALL - pierrick@phpwebgallery.net | |
---|
5 | // | Copyright (C) 2003-2005 PhpWebGallery Team - http://phpwebgallery.net | |
---|
6 | // +-----------------------------------------------------------------------+ |
---|
7 | // | branch : BSF (Best So Far) |
---|
8 | // | file : $RCSfile$ |
---|
9 | // | last update : $Date: 2006-01-15 13:49:29 +0000 (Sun, 15 Jan 2006) $ |
---|
10 | // | last modifier : $Author: nikrou $ |
---|
11 | // | revision : $Revision: 1005 $ |
---|
12 | // +-----------------------------------------------------------------------+ |
---|
13 | // | This program is free software; you can redistribute it and/or modify | |
---|
14 | // | it under the terms of the GNU General Public License as published by | |
---|
15 | // | the Free Software Foundation | |
---|
16 | // | | |
---|
17 | // | This program is distributed in the hope that it will be useful, but | |
---|
18 | // | WITHOUT ANY WARRANTY; without even the implied warranty of | |
---|
19 | // | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
---|
20 | // | General Public License for more details. | |
---|
21 | // | | |
---|
22 | // | You should have received a copy of the GNU General Public License | |
---|
23 | // | along with this program; if not, write to the Free Software | |
---|
24 | // | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, | |
---|
25 | // | USA. | |
---|
26 | // +-----------------------------------------------------------------------+ |
---|
27 | |
---|
28 | if (!defined('PHPWG_ROOT_PATH')) |
---|
29 | { |
---|
30 | die ("Hacking attempt!"); |
---|
31 | } |
---|
32 | include_once(PHPWG_ROOT_PATH.'admin/include/isadmin.inc.php'); |
---|
33 | |
---|
34 | // +-----------------------------------------------------------------------+ |
---|
35 | // | variable initialization | |
---|
36 | // +-----------------------------------------------------------------------+ |
---|
37 | |
---|
38 | // if the category is not correct (not numeric, not private) |
---|
39 | if (isset($_GET['cat']) and is_numeric($_GET['cat'])) |
---|
40 | { |
---|
41 | $query = ' |
---|
42 | SELECT status |
---|
43 | FROM '.CATEGORIES_TABLE.' |
---|
44 | WHERE id = '.$_GET['cat'].' |
---|
45 | ;'; |
---|
46 | list($status) = mysql_fetch_array(pwg_query($query)); |
---|
47 | |
---|
48 | if ('private' == $status) |
---|
49 | { |
---|
50 | $page['cat'] = $_GET['cat']; |
---|
51 | } |
---|
52 | } |
---|
53 | |
---|
54 | if (!isset($page['cat'])) |
---|
55 | { |
---|
56 | $query = ' |
---|
57 | SELECT id |
---|
58 | FROM '.CATEGORIES_TABLE.' |
---|
59 | WHERE status = \'private\' |
---|
60 | LIMIT 0,1 |
---|
61 | ;'; |
---|
62 | |
---|
63 | list($page['cat']) = mysql_fetch_array(pwg_query($query)); |
---|
64 | } |
---|
65 | |
---|
66 | // +-----------------------------------------------------------------------+ |
---|
67 | // | form submission | |
---|
68 | // +-----------------------------------------------------------------------+ |
---|
69 | |
---|
70 | if (isset($_POST) and false) |
---|
71 | { |
---|
72 | echo '<pre>'; |
---|
73 | print_r($_POST); |
---|
74 | echo '</pre>'; |
---|
75 | } |
---|
76 | |
---|
77 | if (isset($_POST['deny_groups_submit']) |
---|
78 | and isset($_POST['deny_groups']) |
---|
79 | and count($_POST['deny_groups']) > 0) |
---|
80 | { |
---|
81 | // if you forbid access to a category, all sub-categories become |
---|
82 | // automatically forbidden |
---|
83 | $query = ' |
---|
84 | DELETE |
---|
85 | FROM '.GROUP_ACCESS_TABLE.' |
---|
86 | WHERE group_id IN ('.implode(',', $_POST['deny_groups']).') |
---|
87 | AND cat_id IN ('.implode(',', get_subcat_ids(array($page['cat']))).') |
---|
88 | ;'; |
---|
89 | pwg_query($query); |
---|
90 | } |
---|
91 | else if (isset($_POST['grant_groups_submit']) |
---|
92 | and isset($_POST['grant_groups']) |
---|
93 | and count($_POST['grant_groups']) > 0) |
---|
94 | { |
---|
95 | $query = ' |
---|
96 | SELECT id |
---|
97 | FROM '.CATEGORIES_TABLE.' |
---|
98 | WHERE id IN ('.implode(',', get_uppercat_ids(array($page['cat']))).') |
---|
99 | AND status = \'private\' |
---|
100 | ;'; |
---|
101 | $private_uppercats = array_from_query($query, 'id'); |
---|
102 | |
---|
103 | // We must not reinsert already existing lines in group_access table |
---|
104 | $granteds = array(); |
---|
105 | foreach ($private_uppercats as $cat_id) |
---|
106 | { |
---|
107 | $granteds[$cat_id] = array(); |
---|
108 | } |
---|
109 | |
---|
110 | $query = ' |
---|
111 | SELECT group_id, cat_id |
---|
112 | FROM '.GROUP_ACCESS_TABLE.' |
---|
113 | WHERE cat_id IN ('.implode(',', $private_uppercats).') |
---|
114 | AND group_id IN ('.implode(',', $_POST['grant_groups']).') |
---|
115 | ;'; |
---|
116 | $result = pwg_query($query); |
---|
117 | while ($row = mysql_fetch_array($result)) |
---|
118 | { |
---|
119 | array_push($granteds[$row['cat_id']], $row['group_id']); |
---|
120 | } |
---|
121 | |
---|
122 | $inserts = array(); |
---|
123 | |
---|
124 | foreach ($private_uppercats as $cat_id) |
---|
125 | { |
---|
126 | $group_ids = array_diff($_POST['grant_groups'], $granteds[$cat_id]); |
---|
127 | foreach ($group_ids as $group_id) |
---|
128 | { |
---|
129 | array_push($inserts, array('group_id' => $group_id, |
---|
130 | 'cat_id' => $cat_id)); |
---|
131 | } |
---|
132 | } |
---|
133 | |
---|
134 | mass_inserts(GROUP_ACCESS_TABLE, array('group_id','cat_id'), $inserts); |
---|
135 | } |
---|
136 | else if (isset($_POST['deny_users_submit']) |
---|
137 | and isset($_POST['deny_users']) |
---|
138 | and count($_POST['deny_users']) > 0) |
---|
139 | { |
---|
140 | // if you forbid access to a category, all sub-categories become |
---|
141 | // automatically forbidden |
---|
142 | $query = ' |
---|
143 | DELETE |
---|
144 | FROM '.USER_ACCESS_TABLE.' |
---|
145 | WHERE user_id IN ('.implode(',', $_POST['deny_users']).') |
---|
146 | AND cat_id IN ('.implode(',', get_subcat_ids(array($page['cat']))).') |
---|
147 | ;'; |
---|
148 | pwg_query($query); |
---|
149 | } |
---|
150 | else if (isset($_POST['grant_users_submit']) |
---|
151 | and isset($_POST['grant_users']) |
---|
152 | and count($_POST['grant_users']) > 0) |
---|
153 | { |
---|
154 | $query = ' |
---|
155 | SELECT id |
---|
156 | FROM '.CATEGORIES_TABLE.' |
---|
157 | WHERE id IN ('.implode(',', get_uppercat_ids(array($page['cat']))).') |
---|
158 | AND status = \'private\' |
---|
159 | ;'; |
---|
160 | $private_uppercats = array_from_query($query, 'id'); |
---|
161 | |
---|
162 | // We must not reinsert already existing lines in user_access table |
---|
163 | $granteds = array(); |
---|
164 | foreach ($private_uppercats as $cat_id) |
---|
165 | { |
---|
166 | $granteds[$cat_id] = array(); |
---|
167 | } |
---|
168 | |
---|
169 | $query = ' |
---|
170 | SELECT user_id, cat_id |
---|
171 | FROM '.USER_ACCESS_TABLE.' |
---|
172 | WHERE cat_id IN ('.implode(',', $private_uppercats).') |
---|
173 | AND user_id IN ('.implode(',', $_POST['grant_users']).') |
---|
174 | ;'; |
---|
175 | $result = pwg_query($query); |
---|
176 | while ($row = mysql_fetch_array($result)) |
---|
177 | { |
---|
178 | array_push($granteds[$row['cat_id']], $row['user_id']); |
---|
179 | } |
---|
180 | |
---|
181 | $inserts = array(); |
---|
182 | |
---|
183 | foreach ($private_uppercats as $cat_id) |
---|
184 | { |
---|
185 | $user_ids = array_diff($_POST['grant_users'], $granteds[$cat_id]); |
---|
186 | foreach ($user_ids as $user_id) |
---|
187 | { |
---|
188 | array_push($inserts, array('user_id' => $user_id, |
---|
189 | 'cat_id' => $cat_id)); |
---|
190 | } |
---|
191 | } |
---|
192 | |
---|
193 | mass_inserts(USER_ACCESS_TABLE, array('user_id','cat_id'), $inserts); |
---|
194 | } |
---|
195 | |
---|
196 | // +-----------------------------------------------------------------------+ |
---|
197 | // | template initialization | |
---|
198 | // +-----------------------------------------------------------------------+ |
---|
199 | |
---|
200 | $template->set_filenames(array('cat_perm'=>'admin/cat_perm.tpl')); |
---|
201 | |
---|
202 | $template->assign_vars( |
---|
203 | array( |
---|
204 | 'CATEGORIES_NAV' => |
---|
205 | get_cat_display_name_from_id( |
---|
206 | $page['cat'], |
---|
207 | 'admin.php?page=cat_modify&cat_id=' |
---|
208 | ), |
---|
209 | 'U_HELP' => PHPWG_ROOT_PATH.'/popuphelp.php?page=cat_perm', |
---|
210 | 'F_ACTION' => |
---|
211 | add_session_id( |
---|
212 | PHPWG_ROOT_PATH.'admin.php?page=cat_perm&cat='.$page['cat'] |
---|
213 | ) |
---|
214 | ) |
---|
215 | ); |
---|
216 | |
---|
217 | // +-----------------------------------------------------------------------+ |
---|
218 | // | form construction | |
---|
219 | // +-----------------------------------------------------------------------+ |
---|
220 | |
---|
221 | // groups denied are the groups not granted. So we need to find all groups |
---|
222 | // minus groups granted to find groups denied. |
---|
223 | |
---|
224 | $groups = array(); |
---|
225 | |
---|
226 | $query = ' |
---|
227 | SELECT id, name |
---|
228 | FROM '.GROUPS_TABLE.' |
---|
229 | ;'; |
---|
230 | $result = pwg_query($query); |
---|
231 | |
---|
232 | while ($row = mysql_fetch_array($result)) |
---|
233 | { |
---|
234 | $groups[$row['id']] = $row['name']; |
---|
235 | } |
---|
236 | |
---|
237 | $query = ' |
---|
238 | SELECT group_id |
---|
239 | FROM '.GROUP_ACCESS_TABLE.' |
---|
240 | WHERE cat_id = '.$page['cat'].' |
---|
241 | ;'; |
---|
242 | $group_granted_ids = array_from_query($query, 'group_id'); |
---|
243 | |
---|
244 | // groups granted to access the category |
---|
245 | foreach ($group_granted_ids as $group_id) |
---|
246 | { |
---|
247 | $template->assign_block_vars( |
---|
248 | 'group_granted', |
---|
249 | array( |
---|
250 | 'NAME'=>$groups[$group_id], |
---|
251 | 'ID'=>$group_id |
---|
252 | ) |
---|
253 | ); |
---|
254 | } |
---|
255 | |
---|
256 | // groups denied |
---|
257 | foreach (array_diff(array_keys($groups), $group_granted_ids) as $group_id) |
---|
258 | { |
---|
259 | $template->assign_block_vars( |
---|
260 | 'group_denied', |
---|
261 | array( |
---|
262 | 'NAME'=>$groups[$group_id], |
---|
263 | 'ID'=>$group_id |
---|
264 | ) |
---|
265 | ); |
---|
266 | } |
---|
267 | |
---|
268 | // users... |
---|
269 | $users = array(); |
---|
270 | |
---|
271 | $query = ' |
---|
272 | SELECT '.$conf['user_fields']['id'].' AS id, |
---|
273 | '.$conf['user_fields']['username'].' AS username |
---|
274 | FROM '.USERS_TABLE.' |
---|
275 | WHERE '.$conf['user_fields']['id'].' != '.$conf['guest_id'].' |
---|
276 | ;'; |
---|
277 | $result = pwg_query($query); |
---|
278 | while($row = mysql_fetch_array($result)) |
---|
279 | { |
---|
280 | $users[$row['id']] = $row['username']; |
---|
281 | } |
---|
282 | |
---|
283 | $query = ' |
---|
284 | SELECT user_id |
---|
285 | FROM '.USER_ACCESS_TABLE.' |
---|
286 | WHERE cat_id = '.$page['cat'].' |
---|
287 | ;'; |
---|
288 | $user_granted_direct_ids = array_from_query($query, 'user_id'); |
---|
289 | |
---|
290 | foreach ($user_granted_direct_ids as $user_id) |
---|
291 | { |
---|
292 | $template->assign_block_vars( |
---|
293 | 'user_granted', |
---|
294 | array( |
---|
295 | 'NAME'=>$users[$user_id], |
---|
296 | 'ID'=>$user_id |
---|
297 | ) |
---|
298 | ); |
---|
299 | } |
---|
300 | |
---|
301 | $user_granted_indirect_ids = array(); |
---|
302 | if (count($group_granted_ids) > 0) |
---|
303 | { |
---|
304 | $granted_groups = array(); |
---|
305 | |
---|
306 | $query = ' |
---|
307 | SELECT user_id, group_id |
---|
308 | FROM '.USER_GROUP_TABLE.' |
---|
309 | WHERE group_id IN ('.implode(',', $group_granted_ids).') |
---|
310 | '; |
---|
311 | $result = pwg_query($query); |
---|
312 | while ($row = mysql_fetch_array($result)) |
---|
313 | { |
---|
314 | if (!isset($granted_groups[$row['group_id']])) |
---|
315 | { |
---|
316 | $granted_groups[$row['group_id']] = array(); |
---|
317 | } |
---|
318 | array_push($granted_groups[$row['group_id']], $row['user_id']); |
---|
319 | } |
---|
320 | |
---|
321 | $user_granted_by_group_ids = array(); |
---|
322 | |
---|
323 | foreach ($granted_groups as $group_users) |
---|
324 | { |
---|
325 | $user_granted_by_group_ids = array_merge($user_granted_by_group_ids, |
---|
326 | $group_users); |
---|
327 | } |
---|
328 | $user_granted_by_group_ids = array_unique($user_granted_by_group_ids); |
---|
329 | |
---|
330 | |
---|
331 | $user_granted_indirect_ids = array_diff($user_granted_by_group_ids, |
---|
332 | $user_granted_direct_ids); |
---|
333 | |
---|
334 | foreach ($user_granted_indirect_ids as $user_id) |
---|
335 | { |
---|
336 | $group = ''; |
---|
337 | |
---|
338 | foreach ($granted_groups as $group_id => $group_users) |
---|
339 | { |
---|
340 | if (in_array($user_id, $group_users)) |
---|
341 | { |
---|
342 | $group = $groups[$group_id]; |
---|
343 | break; |
---|
344 | } |
---|
345 | } |
---|
346 | |
---|
347 | $template->assign_block_vars( |
---|
348 | 'user_granted_indirect', |
---|
349 | array( |
---|
350 | 'NAME'=>$users[$user_id], |
---|
351 | 'GROUP'=>$group |
---|
352 | ) |
---|
353 | ); |
---|
354 | } |
---|
355 | } |
---|
356 | |
---|
357 | $user_denied_ids = array_diff(array_keys($users), |
---|
358 | $user_granted_indirect_ids, |
---|
359 | $user_granted_direct_ids); |
---|
360 | |
---|
361 | foreach ($user_denied_ids as $user_id) |
---|
362 | { |
---|
363 | $template->assign_block_vars( |
---|
364 | 'user_denied', |
---|
365 | array( |
---|
366 | 'NAME'=>$users[$user_id], |
---|
367 | 'ID'=>$user_id |
---|
368 | ) |
---|
369 | ); |
---|
370 | } |
---|
371 | |
---|
372 | |
---|
373 | // +-----------------------------------------------------------------------+ |
---|
374 | // | sending html code | |
---|
375 | // +-----------------------------------------------------------------------+ |
---|
376 | $template->assign_var_from_handle('ADMIN_CONTENT', 'cat_perm'); |
---|
377 | ?> |
---|