[21] | 1 | <?php |
---|
[362] | 2 | // +-----------------------------------------------------------------------+ |
---|
[593] | 3 | // | PhpWebGallery - a PHP based picture gallery | |
---|
| 4 | // | Copyright (C) 2002-2003 Pierrick LE GALL - pierrick@phpwebgallery.net | |
---|
[675] | 5 | // | Copyright (C) 2003-2005 PhpWebGallery Team - http://phpwebgallery.net | |
---|
[362] | 6 | // +-----------------------------------------------------------------------+ |
---|
[593] | 7 | // | branch : BSF (Best So Far) |
---|
[362] | 8 | // | file : $RCSfile$ |
---|
| 9 | // | last update : $Date: 2006-01-15 13:45:42 +0000 (Sun, 15 Jan 2006) $ |
---|
| 10 | // | last modifier : $Author: nikrou $ |
---|
| 11 | // | revision : $Revision: 1004 $ |
---|
| 12 | // +-----------------------------------------------------------------------+ |
---|
| 13 | // | This program is free software; you can redistribute it and/or modify | |
---|
| 14 | // | it under the terms of the GNU General Public License as published by | |
---|
| 15 | // | the Free Software Foundation | |
---|
| 16 | // | | |
---|
| 17 | // | This program is distributed in the hope that it will be useful, but | |
---|
| 18 | // | WITHOUT ANY WARRANTY; without even the implied warranty of | |
---|
| 19 | // | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
---|
| 20 | // | General Public License for more details. | |
---|
| 21 | // | | |
---|
| 22 | // | You should have received a copy of the GNU General Public License | |
---|
| 23 | // | along with this program; if not, write to the Free Software | |
---|
| 24 | // | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, | |
---|
| 25 | // | USA. | |
---|
| 26 | // +-----------------------------------------------------------------------+ |
---|
[800] | 27 | |
---|
| 28 | if (!defined('PHPWG_ROOT_PATH')) |
---|
[21] | 29 | { |
---|
[800] | 30 | die ("Hacking attempt!"); |
---|
| 31 | } |
---|
| 32 | include_once(PHPWG_ROOT_PATH.'admin/include/isadmin.inc.php'); |
---|
| 33 | |
---|
| 34 | // +-----------------------------------------------------------------------+ |
---|
| 35 | // | variable initialization | |
---|
| 36 | // +-----------------------------------------------------------------------+ |
---|
| 37 | |
---|
| 38 | // if the category is not correct (not numeric, not private) |
---|
| 39 | if (isset($_GET['cat']) and is_numeric($_GET['cat'])) |
---|
| 40 | { |
---|
| 41 | $query = ' |
---|
| 42 | SELECT status |
---|
| 43 | FROM '.CATEGORIES_TABLE.' |
---|
| 44 | WHERE id = '.$_GET['cat'].' |
---|
| 45 | ;'; |
---|
| 46 | list($status) = mysql_fetch_array(pwg_query($query)); |
---|
| 47 | |
---|
| 48 | if ('private' == $status) |
---|
[21] | 49 | { |
---|
[800] | 50 | $page['cat'] = $_GET['cat']; |
---|
[21] | 51 | } |
---|
| 52 | } |
---|
[800] | 53 | |
---|
| 54 | if (!isset($page['cat'])) |
---|
[21] | 55 | { |
---|
[800] | 56 | $query = ' |
---|
| 57 | SELECT id |
---|
| 58 | FROM '.CATEGORIES_TABLE.' |
---|
| 59 | WHERE status = \'private\' |
---|
| 60 | LIMIT 0,1 |
---|
| 61 | ;'; |
---|
| 62 | |
---|
| 63 | list($page['cat']) = mysql_fetch_array(pwg_query($query)); |
---|
| 64 | } |
---|
| 65 | |
---|
| 66 | // +-----------------------------------------------------------------------+ |
---|
| 67 | // | form submission | |
---|
| 68 | // +-----------------------------------------------------------------------+ |
---|
| 69 | |
---|
| 70 | if (isset($_POST) and false) |
---|
| 71 | { |
---|
| 72 | echo '<pre>'; |
---|
| 73 | print_r($_POST); |
---|
| 74 | echo '</pre>'; |
---|
| 75 | } |
---|
| 76 | |
---|
| 77 | if (isset($_POST['deny_groups_submit']) |
---|
| 78 | and isset($_POST['deny_groups']) |
---|
| 79 | and count($_POST['deny_groups']) > 0) |
---|
| 80 | { |
---|
| 81 | // if you forbid access to a category, all sub-categories become |
---|
| 82 | // automatically forbidden |
---|
| 83 | $query = ' |
---|
| 84 | DELETE |
---|
| 85 | FROM '.GROUP_ACCESS_TABLE.' |
---|
| 86 | WHERE group_id IN ('.implode(',', $_POST['deny_groups']).') |
---|
| 87 | AND cat_id IN ('.implode(',', get_subcat_ids(array($page['cat']))).') |
---|
| 88 | ;'; |
---|
| 89 | pwg_query($query); |
---|
| 90 | } |
---|
| 91 | else if (isset($_POST['grant_groups_submit']) |
---|
| 92 | and isset($_POST['grant_groups']) |
---|
| 93 | and count($_POST['grant_groups']) > 0) |
---|
| 94 | { |
---|
| 95 | $query = ' |
---|
| 96 | SELECT id |
---|
| 97 | FROM '.CATEGORIES_TABLE.' |
---|
| 98 | WHERE id IN ('.implode(',', get_uppercat_ids(array($page['cat']))).') |
---|
| 99 | AND status = \'private\' |
---|
| 100 | ;'; |
---|
| 101 | $private_uppercats = array_from_query($query, 'id'); |
---|
| 102 | |
---|
| 103 | // We must not reinsert already existing lines in group_access table |
---|
| 104 | $granteds = array(); |
---|
| 105 | foreach ($private_uppercats as $cat_id) |
---|
[21] | 106 | { |
---|
[800] | 107 | $granteds[$cat_id] = array(); |
---|
[21] | 108 | } |
---|
[800] | 109 | |
---|
| 110 | $query = ' |
---|
| 111 | SELECT group_id, cat_id |
---|
| 112 | FROM '.GROUP_ACCESS_TABLE.' |
---|
| 113 | WHERE cat_id IN ('.implode(',', $private_uppercats).') |
---|
| 114 | AND group_id IN ('.implode(',', $_POST['grant_groups']).') |
---|
| 115 | ;'; |
---|
| 116 | $result = pwg_query($query); |
---|
| 117 | while ($row = mysql_fetch_array($result)) |
---|
[21] | 118 | { |
---|
[800] | 119 | array_push($granteds[$row['cat_id']], $row['group_id']); |
---|
| 120 | } |
---|
| 121 | |
---|
| 122 | $inserts = array(); |
---|
| 123 | |
---|
| 124 | foreach ($private_uppercats as $cat_id) |
---|
| 125 | { |
---|
| 126 | $group_ids = array_diff($_POST['grant_groups'], $granteds[$cat_id]); |
---|
| 127 | foreach ($group_ids as $group_id) |
---|
[21] | 128 | { |
---|
[800] | 129 | array_push($inserts, array('group_id' => $group_id, |
---|
| 130 | 'cat_id' => $cat_id)); |
---|
[21] | 131 | } |
---|
| 132 | } |
---|
[800] | 133 | |
---|
| 134 | mass_inserts(GROUP_ACCESS_TABLE, array('group_id','cat_id'), $inserts); |
---|
[21] | 135 | } |
---|
[800] | 136 | else if (isset($_POST['deny_users_submit']) |
---|
| 137 | and isset($_POST['deny_users']) |
---|
| 138 | and count($_POST['deny_users']) > 0) |
---|
[21] | 139 | { |
---|
[800] | 140 | // if you forbid access to a category, all sub-categories become |
---|
| 141 | // automatically forbidden |
---|
| 142 | $query = ' |
---|
| 143 | DELETE |
---|
| 144 | FROM '.USER_ACCESS_TABLE.' |
---|
| 145 | WHERE user_id IN ('.implode(',', $_POST['deny_users']).') |
---|
| 146 | AND cat_id IN ('.implode(',', get_subcat_ids(array($page['cat']))).') |
---|
| 147 | ;'; |
---|
| 148 | pwg_query($query); |
---|
| 149 | } |
---|
| 150 | else if (isset($_POST['grant_users_submit']) |
---|
| 151 | and isset($_POST['grant_users']) |
---|
| 152 | and count($_POST['grant_users']) > 0) |
---|
| 153 | { |
---|
| 154 | $query = ' |
---|
| 155 | SELECT id |
---|
| 156 | FROM '.CATEGORIES_TABLE.' |
---|
| 157 | WHERE id IN ('.implode(',', get_uppercat_ids(array($page['cat']))).') |
---|
| 158 | AND status = \'private\' |
---|
| 159 | ;'; |
---|
| 160 | $private_uppercats = array_from_query($query, 'id'); |
---|
| 161 | |
---|
| 162 | // We must not reinsert already existing lines in user_access table |
---|
| 163 | $granteds = array(); |
---|
| 164 | foreach ($private_uppercats as $cat_id) |
---|
[21] | 165 | { |
---|
[800] | 166 | $granteds[$cat_id] = array(); |
---|
[21] | 167 | } |
---|
[800] | 168 | |
---|
| 169 | $query = ' |
---|
| 170 | SELECT user_id, cat_id |
---|
| 171 | FROM '.USER_ACCESS_TABLE.' |
---|
| 172 | WHERE cat_id IN ('.implode(',', $private_uppercats).') |
---|
| 173 | AND user_id IN ('.implode(',', $_POST['grant_users']).') |
---|
| 174 | ;'; |
---|
| 175 | $result = pwg_query($query); |
---|
| 176 | while ($row = mysql_fetch_array($result)) |
---|
[21] | 177 | { |
---|
[800] | 178 | array_push($granteds[$row['cat_id']], $row['user_id']); |
---|
| 179 | } |
---|
| 180 | |
---|
| 181 | $inserts = array(); |
---|
| 182 | |
---|
| 183 | foreach ($private_uppercats as $cat_id) |
---|
| 184 | { |
---|
| 185 | $user_ids = array_diff($_POST['grant_users'], $granteds[$cat_id]); |
---|
| 186 | foreach ($user_ids as $user_id) |
---|
[21] | 187 | { |
---|
[800] | 188 | array_push($inserts, array('user_id' => $user_id, |
---|
| 189 | 'cat_id' => $cat_id)); |
---|
[21] | 190 | } |
---|
| 191 | } |
---|
[800] | 192 | |
---|
| 193 | mass_inserts(USER_ACCESS_TABLE, array('user_id','cat_id'), $inserts); |
---|
[21] | 194 | } |
---|
[800] | 195 | |
---|
| 196 | // +-----------------------------------------------------------------------+ |
---|
| 197 | // | template initialization | |
---|
| 198 | // +-----------------------------------------------------------------------+ |
---|
[817] | 199 | |
---|
[800] | 200 | $template->set_filenames(array('cat_perm'=>'admin/cat_perm.tpl')); |
---|
| 201 | |
---|
[817] | 202 | $template->assign_vars( |
---|
| 203 | array( |
---|
[825] | 204 | 'CATEGORIES_NAV' => |
---|
| 205 | get_cat_display_name_from_id( |
---|
| 206 | $page['cat'], |
---|
| 207 | 'admin.php?page=cat_modify&cat_id=' |
---|
| 208 | ), |
---|
[862] | 209 | 'U_HELP' => PHPWG_ROOT_PATH.'/popuphelp.php?page=cat_perm', |
---|
[1004] | 210 | 'F_ACTION' => PHPWG_ROOT_PATH.'admin.php?page=cat_perm&cat='.$page['cat'] |
---|
[817] | 211 | ) |
---|
| 212 | ); |
---|
[800] | 213 | |
---|
| 214 | // +-----------------------------------------------------------------------+ |
---|
| 215 | // | form construction | |
---|
| 216 | // +-----------------------------------------------------------------------+ |
---|
| 217 | |
---|
| 218 | // groups denied are the groups not granted. So we need to find all groups |
---|
| 219 | // minus groups granted to find groups denied. |
---|
| 220 | |
---|
| 221 | $groups = array(); |
---|
| 222 | |
---|
| 223 | $query = ' |
---|
| 224 | SELECT id, name |
---|
| 225 | FROM '.GROUPS_TABLE.' |
---|
| 226 | ;'; |
---|
| 227 | $result = pwg_query($query); |
---|
| 228 | |
---|
| 229 | while ($row = mysql_fetch_array($result)) |
---|
[190] | 230 | { |
---|
[800] | 231 | $groups[$row['id']] = $row['name']; |
---|
[190] | 232 | } |
---|
[800] | 233 | |
---|
| 234 | $query = ' |
---|
| 235 | SELECT group_id |
---|
| 236 | FROM '.GROUP_ACCESS_TABLE.' |
---|
| 237 | WHERE cat_id = '.$page['cat'].' |
---|
| 238 | ;'; |
---|
| 239 | $group_granted_ids = array_from_query($query, 'group_id'); |
---|
| 240 | |
---|
| 241 | // groups granted to access the category |
---|
| 242 | foreach ($group_granted_ids as $group_id) |
---|
[21] | 243 | { |
---|
[800] | 244 | $template->assign_block_vars( |
---|
| 245 | 'group_granted', |
---|
| 246 | array( |
---|
| 247 | 'NAME'=>$groups[$group_id], |
---|
| 248 | 'ID'=>$group_id |
---|
| 249 | ) |
---|
| 250 | ); |
---|
| 251 | } |
---|
| 252 | |
---|
| 253 | // groups denied |
---|
| 254 | foreach (array_diff(array_keys($groups), $group_granted_ids) as $group_id) |
---|
| 255 | { |
---|
| 256 | $template->assign_block_vars( |
---|
| 257 | 'group_denied', |
---|
| 258 | array( |
---|
| 259 | 'NAME'=>$groups[$group_id], |
---|
| 260 | 'ID'=>$group_id |
---|
| 261 | ) |
---|
| 262 | ); |
---|
| 263 | } |
---|
| 264 | |
---|
| 265 | // users... |
---|
| 266 | $users = array(); |
---|
| 267 | |
---|
| 268 | $query = ' |
---|
[808] | 269 | SELECT '.$conf['user_fields']['id'].' AS id, |
---|
| 270 | '.$conf['user_fields']['username'].' AS username |
---|
[800] | 271 | FROM '.USERS_TABLE.' |
---|
[873] | 272 | WHERE '.$conf['user_fields']['id'].' != '.$conf['guest_id'].' |
---|
[800] | 273 | ;'; |
---|
| 274 | $result = pwg_query($query); |
---|
| 275 | while($row = mysql_fetch_array($result)) |
---|
| 276 | { |
---|
| 277 | $users[$row['id']] = $row['username']; |
---|
| 278 | } |
---|
| 279 | |
---|
| 280 | $query = ' |
---|
| 281 | SELECT user_id |
---|
| 282 | FROM '.USER_ACCESS_TABLE.' |
---|
| 283 | WHERE cat_id = '.$page['cat'].' |
---|
| 284 | ;'; |
---|
| 285 | $user_granted_direct_ids = array_from_query($query, 'user_id'); |
---|
| 286 | |
---|
| 287 | foreach ($user_granted_direct_ids as $user_id) |
---|
| 288 | { |
---|
| 289 | $template->assign_block_vars( |
---|
| 290 | 'user_granted', |
---|
| 291 | array( |
---|
| 292 | 'NAME'=>$users[$user_id], |
---|
| 293 | 'ID'=>$user_id |
---|
| 294 | ) |
---|
| 295 | ); |
---|
| 296 | } |
---|
| 297 | |
---|
| 298 | $user_granted_indirect_ids = array(); |
---|
| 299 | if (count($group_granted_ids) > 0) |
---|
| 300 | { |
---|
| 301 | $granted_groups = array(); |
---|
| 302 | |
---|
| 303 | $query = ' |
---|
| 304 | SELECT user_id, group_id |
---|
| 305 | FROM '.USER_GROUP_TABLE.' |
---|
| 306 | WHERE group_id IN ('.implode(',', $group_granted_ids).') |
---|
| 307 | '; |
---|
| 308 | $result = pwg_query($query); |
---|
| 309 | while ($row = mysql_fetch_array($result)) |
---|
[21] | 310 | { |
---|
[800] | 311 | if (!isset($granted_groups[$row['group_id']])) |
---|
| 312 | { |
---|
| 313 | $granted_groups[$row['group_id']] = array(); |
---|
| 314 | } |
---|
| 315 | array_push($granted_groups[$row['group_id']], $row['user_id']); |
---|
[21] | 316 | } |
---|
| 317 | |
---|
[800] | 318 | $user_granted_by_group_ids = array(); |
---|
| 319 | |
---|
| 320 | foreach ($granted_groups as $group_users) |
---|
[21] | 321 | { |
---|
[800] | 322 | $user_granted_by_group_ids = array_merge($user_granted_by_group_ids, |
---|
| 323 | $group_users); |
---|
[21] | 324 | } |
---|
[800] | 325 | $user_granted_by_group_ids = array_unique($user_granted_by_group_ids); |
---|
| 326 | |
---|
| 327 | |
---|
| 328 | $user_granted_indirect_ids = array_diff($user_granted_by_group_ids, |
---|
| 329 | $user_granted_direct_ids); |
---|
| 330 | |
---|
| 331 | foreach ($user_granted_indirect_ids as $user_id) |
---|
[21] | 332 | { |
---|
[800] | 333 | $group = ''; |
---|
| 334 | |
---|
| 335 | foreach ($granted_groups as $group_id => $group_users) |
---|
[21] | 336 | { |
---|
[800] | 337 | if (in_array($user_id, $group_users)) |
---|
[21] | 338 | { |
---|
[800] | 339 | $group = $groups[$group_id]; |
---|
| 340 | break; |
---|
[21] | 341 | } |
---|
| 342 | } |
---|
[800] | 343 | |
---|
| 344 | $template->assign_block_vars( |
---|
| 345 | 'user_granted_indirect', |
---|
| 346 | array( |
---|
| 347 | 'NAME'=>$users[$user_id], |
---|
| 348 | 'GROUP'=>$group |
---|
| 349 | ) |
---|
| 350 | ); |
---|
[21] | 351 | } |
---|
| 352 | } |
---|
[800] | 353 | |
---|
| 354 | $user_denied_ids = array_diff(array_keys($users), |
---|
| 355 | $user_granted_indirect_ids, |
---|
| 356 | $user_granted_direct_ids); |
---|
| 357 | |
---|
| 358 | foreach ($user_denied_ids as $user_id) |
---|
| 359 | { |
---|
| 360 | $template->assign_block_vars( |
---|
| 361 | 'user_denied', |
---|
| 362 | array( |
---|
| 363 | 'NAME'=>$users[$user_id], |
---|
| 364 | 'ID'=>$user_id |
---|
| 365 | ) |
---|
| 366 | ); |
---|
| 367 | } |
---|
| 368 | |
---|
| 369 | |
---|
| 370 | // +-----------------------------------------------------------------------+ |
---|
| 371 | // | sending html code | |
---|
| 372 | // +-----------------------------------------------------------------------+ |
---|
| 373 | $template->assign_var_from_handle('ADMIN_CONTENT', 'cat_perm'); |
---|
[362] | 374 | ?> |
---|