[21] | 1 | <?php |
---|
[362] | 2 | // +-----------------------------------------------------------------------+ |
---|
[8728] | 3 | // | Piwigo - a PHP based photo gallery | |
---|
[2297] | 4 | // +-----------------------------------------------------------------------+ |
---|
[8728] | 5 | // | Copyright(C) 2008-2011 Piwigo Team http://piwigo.org | |
---|
[2297] | 6 | // | Copyright(C) 2003-2008 PhpWebGallery Team http://phpwebgallery.net | |
---|
| 7 | // | Copyright(C) 2002-2003 Pierrick LE GALL http://le-gall.net/pierrick | |
---|
| 8 | // +-----------------------------------------------------------------------+ |
---|
| 9 | // | This program is free software; you can redistribute it and/or modify | |
---|
| 10 | // | it under the terms of the GNU General Public License as published by | |
---|
| 11 | // | the Free Software Foundation | |
---|
| 12 | // | | |
---|
| 13 | // | This program is distributed in the hope that it will be useful, but | |
---|
| 14 | // | WITHOUT ANY WARRANTY; without even the implied warranty of | |
---|
| 15 | // | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
---|
| 16 | // | General Public License for more details. | |
---|
| 17 | // | | |
---|
| 18 | // | You should have received a copy of the GNU General Public License | |
---|
| 19 | // | along with this program; if not, write to the Free Software | |
---|
| 20 | // | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, | |
---|
| 21 | // | USA. | |
---|
| 22 | // +-----------------------------------------------------------------------+ |
---|
[800] | 23 | |
---|
| 24 | if (!defined('PHPWG_ROOT_PATH')) |
---|
[21] | 25 | { |
---|
[800] | 26 | die ("Hacking attempt!"); |
---|
| 27 | } |
---|
| 28 | |
---|
[1072] | 29 | include_once(PHPWG_ROOT_PATH.'admin/include/functions.php'); |
---|
| 30 | |
---|
[800] | 31 | // +-----------------------------------------------------------------------+ |
---|
[1072] | 32 | // | Check Access and exit when user status is not ok | |
---|
| 33 | // +-----------------------------------------------------------------------+ |
---|
| 34 | check_status(ACCESS_ADMINISTRATOR); |
---|
| 35 | |
---|
| 36 | // +-----------------------------------------------------------------------+ |
---|
[800] | 37 | // | variable initialization | |
---|
| 38 | // +-----------------------------------------------------------------------+ |
---|
| 39 | |
---|
| 40 | // if the category is not correct (not numeric, not private) |
---|
| 41 | if (isset($_GET['cat']) and is_numeric($_GET['cat'])) |
---|
| 42 | { |
---|
| 43 | $query = ' |
---|
| 44 | SELECT status |
---|
| 45 | FROM '.CATEGORIES_TABLE.' |
---|
| 46 | WHERE id = '.$_GET['cat'].' |
---|
| 47 | ;'; |
---|
[4325] | 48 | list($status) = pwg_db_fetch_row(pwg_query($query)); |
---|
[800] | 49 | |
---|
| 50 | if ('private' == $status) |
---|
[21] | 51 | { |
---|
[800] | 52 | $page['cat'] = $_GET['cat']; |
---|
[21] | 53 | } |
---|
| 54 | } |
---|
[800] | 55 | |
---|
| 56 | if (!isset($page['cat'])) |
---|
[21] | 57 | { |
---|
[800] | 58 | $query = ' |
---|
| 59 | SELECT id |
---|
| 60 | FROM '.CATEGORIES_TABLE.' |
---|
| 61 | WHERE status = \'private\' |
---|
[4334] | 62 | LIMIT 1 |
---|
[800] | 63 | ;'; |
---|
| 64 | |
---|
[4325] | 65 | list($page['cat']) = pwg_db_fetch_row(pwg_query($query)); |
---|
[800] | 66 | } |
---|
| 67 | |
---|
| 68 | // +-----------------------------------------------------------------------+ |
---|
| 69 | // | form submission | |
---|
| 70 | // +-----------------------------------------------------------------------+ |
---|
| 71 | |
---|
| 72 | |
---|
| 73 | if (isset($_POST['deny_groups_submit']) |
---|
| 74 | and isset($_POST['deny_groups']) |
---|
| 75 | and count($_POST['deny_groups']) > 0) |
---|
| 76 | { |
---|
| 77 | // if you forbid access to a category, all sub-categories become |
---|
| 78 | // automatically forbidden |
---|
| 79 | $query = ' |
---|
| 80 | DELETE |
---|
| 81 | FROM '.GROUP_ACCESS_TABLE.' |
---|
| 82 | WHERE group_id IN ('.implode(',', $_POST['deny_groups']).') |
---|
| 83 | AND cat_id IN ('.implode(',', get_subcat_ids(array($page['cat']))).') |
---|
| 84 | ;'; |
---|
| 85 | pwg_query($query); |
---|
| 86 | } |
---|
| 87 | else if (isset($_POST['grant_groups_submit']) |
---|
| 88 | and isset($_POST['grant_groups']) |
---|
| 89 | and count($_POST['grant_groups']) > 0) |
---|
| 90 | { |
---|
| 91 | $query = ' |
---|
| 92 | SELECT id |
---|
| 93 | FROM '.CATEGORIES_TABLE.' |
---|
| 94 | WHERE id IN ('.implode(',', get_uppercat_ids(array($page['cat']))).') |
---|
| 95 | AND status = \'private\' |
---|
| 96 | ;'; |
---|
| 97 | $private_uppercats = array_from_query($query, 'id'); |
---|
| 98 | |
---|
| 99 | // We must not reinsert already existing lines in group_access table |
---|
| 100 | $granteds = array(); |
---|
| 101 | foreach ($private_uppercats as $cat_id) |
---|
[21] | 102 | { |
---|
[800] | 103 | $granteds[$cat_id] = array(); |
---|
[21] | 104 | } |
---|
[800] | 105 | |
---|
| 106 | $query = ' |
---|
| 107 | SELECT group_id, cat_id |
---|
| 108 | FROM '.GROUP_ACCESS_TABLE.' |
---|
| 109 | WHERE cat_id IN ('.implode(',', $private_uppercats).') |
---|
| 110 | AND group_id IN ('.implode(',', $_POST['grant_groups']).') |
---|
| 111 | ;'; |
---|
| 112 | $result = pwg_query($query); |
---|
[4325] | 113 | while ($row = pwg_db_fetch_assoc($result)) |
---|
[21] | 114 | { |
---|
[800] | 115 | array_push($granteds[$row['cat_id']], $row['group_id']); |
---|
| 116 | } |
---|
| 117 | |
---|
| 118 | $inserts = array(); |
---|
| 119 | |
---|
| 120 | foreach ($private_uppercats as $cat_id) |
---|
| 121 | { |
---|
| 122 | $group_ids = array_diff($_POST['grant_groups'], $granteds[$cat_id]); |
---|
| 123 | foreach ($group_ids as $group_id) |
---|
[21] | 124 | { |
---|
[800] | 125 | array_push($inserts, array('group_id' => $group_id, |
---|
| 126 | 'cat_id' => $cat_id)); |
---|
[21] | 127 | } |
---|
| 128 | } |
---|
[800] | 129 | |
---|
| 130 | mass_inserts(GROUP_ACCESS_TABLE, array('group_id','cat_id'), $inserts); |
---|
[21] | 131 | } |
---|
[800] | 132 | else if (isset($_POST['deny_users_submit']) |
---|
| 133 | and isset($_POST['deny_users']) |
---|
| 134 | and count($_POST['deny_users']) > 0) |
---|
[21] | 135 | { |
---|
[800] | 136 | // if you forbid access to a category, all sub-categories become |
---|
| 137 | // automatically forbidden |
---|
| 138 | $query = ' |
---|
| 139 | DELETE |
---|
| 140 | FROM '.USER_ACCESS_TABLE.' |
---|
| 141 | WHERE user_id IN ('.implode(',', $_POST['deny_users']).') |
---|
| 142 | AND cat_id IN ('.implode(',', get_subcat_ids(array($page['cat']))).') |
---|
| 143 | ;'; |
---|
| 144 | pwg_query($query); |
---|
| 145 | } |
---|
[11729] | 146 | else if (isset($_POST['grant_users_submit'])) |
---|
[800] | 147 | { |
---|
[11729] | 148 | add_permission_on_category($page['cat'], $_POST['grant_users']); |
---|
[21] | 149 | } |
---|
[800] | 150 | |
---|
| 151 | // +-----------------------------------------------------------------------+ |
---|
| 152 | // | template initialization | |
---|
| 153 | // +-----------------------------------------------------------------------+ |
---|
[817] | 154 | |
---|
[2530] | 155 | $template->set_filename('cat_perm', 'cat_perm.tpl'); |
---|
[800] | 156 | |
---|
[2288] | 157 | $template->assign( |
---|
[817] | 158 | array( |
---|
[825] | 159 | 'CATEGORIES_NAV' => |
---|
| 160 | get_cat_display_name_from_id( |
---|
| 161 | $page['cat'], |
---|
| 162 | 'admin.php?page=cat_modify&cat_id=' |
---|
| 163 | ), |
---|
[5920] | 164 | 'U_HELP' => get_root_url().'admin/popuphelp.php?page=cat_perm', |
---|
[2288] | 165 | 'F_ACTION' => get_root_url().'admin.php?page=cat_perm&cat='.$page['cat'] |
---|
[817] | 166 | ) |
---|
| 167 | ); |
---|
[800] | 168 | |
---|
| 169 | // +-----------------------------------------------------------------------+ |
---|
| 170 | // | form construction | |
---|
| 171 | // +-----------------------------------------------------------------------+ |
---|
| 172 | |
---|
| 173 | // groups denied are the groups not granted. So we need to find all groups |
---|
| 174 | // minus groups granted to find groups denied. |
---|
| 175 | |
---|
| 176 | $groups = array(); |
---|
| 177 | |
---|
| 178 | $query = ' |
---|
| 179 | SELECT id, name |
---|
| 180 | FROM '.GROUPS_TABLE.' |
---|
[1960] | 181 | ORDER BY name ASC |
---|
[800] | 182 | ;'; |
---|
[2223] | 183 | $groups = simple_hash_from_query($query, 'id', 'name'); |
---|
| 184 | $template->assign('all_groups', $groups); |
---|
[800] | 185 | |
---|
[2223] | 186 | // groups granted to access the category |
---|
[800] | 187 | $query = ' |
---|
| 188 | SELECT group_id |
---|
| 189 | FROM '.GROUP_ACCESS_TABLE.' |
---|
| 190 | WHERE cat_id = '.$page['cat'].' |
---|
| 191 | ;'; |
---|
| 192 | $group_granted_ids = array_from_query($query, 'group_id'); |
---|
[2349] | 193 | $group_granted_ids = order_by_name($group_granted_ids, $groups); |
---|
[2223] | 194 | $template->assign('group_granted_ids', $group_granted_ids); |
---|
[800] | 195 | |
---|
| 196 | |
---|
| 197 | // groups denied |
---|
[2223] | 198 | $template->assign('group_denied_ids', |
---|
[2349] | 199 | order_by_name(array_diff(array_keys($groups), $group_granted_ids), $groups) |
---|
[2223] | 200 | ); |
---|
[800] | 201 | |
---|
| 202 | // users... |
---|
| 203 | $users = array(); |
---|
| 204 | |
---|
| 205 | $query = ' |
---|
[808] | 206 | SELECT '.$conf['user_fields']['id'].' AS id, |
---|
| 207 | '.$conf['user_fields']['username'].' AS username |
---|
[800] | 208 | FROM '.USERS_TABLE.' |
---|
| 209 | ;'; |
---|
[2223] | 210 | $users = simple_hash_from_query($query, 'id', 'username'); |
---|
| 211 | $template->assign('all_users', $users); |
---|
[800] | 212 | |
---|
[2223] | 213 | |
---|
[800] | 214 | $query = ' |
---|
| 215 | SELECT user_id |
---|
| 216 | FROM '.USER_ACCESS_TABLE.' |
---|
| 217 | WHERE cat_id = '.$page['cat'].' |
---|
| 218 | ;'; |
---|
| 219 | $user_granted_direct_ids = array_from_query($query, 'user_id'); |
---|
[2349] | 220 | $user_granted_direct_ids = order_by_name($user_granted_direct_ids, $users); |
---|
[2223] | 221 | $template->assign('user_granted_direct_ids', $user_granted_direct_ids); |
---|
[800] | 222 | |
---|
[2223] | 223 | |
---|
| 224 | |
---|
[800] | 225 | $user_granted_indirect_ids = array(); |
---|
| 226 | if (count($group_granted_ids) > 0) |
---|
| 227 | { |
---|
| 228 | $granted_groups = array(); |
---|
| 229 | |
---|
| 230 | $query = ' |
---|
| 231 | SELECT user_id, group_id |
---|
| 232 | FROM '.USER_GROUP_TABLE.' |
---|
| 233 | WHERE group_id IN ('.implode(',', $group_granted_ids).') |
---|
| 234 | '; |
---|
| 235 | $result = pwg_query($query); |
---|
[4325] | 236 | while ($row = pwg_db_fetch_assoc($result)) |
---|
[21] | 237 | { |
---|
[800] | 238 | if (!isset($granted_groups[$row['group_id']])) |
---|
| 239 | { |
---|
| 240 | $granted_groups[$row['group_id']] = array(); |
---|
| 241 | } |
---|
| 242 | array_push($granted_groups[$row['group_id']], $row['user_id']); |
---|
[21] | 243 | } |
---|
| 244 | |
---|
[800] | 245 | $user_granted_by_group_ids = array(); |
---|
| 246 | |
---|
| 247 | foreach ($granted_groups as $group_users) |
---|
[21] | 248 | { |
---|
[800] | 249 | $user_granted_by_group_ids = array_merge($user_granted_by_group_ids, |
---|
| 250 | $group_users); |
---|
[21] | 251 | } |
---|
[800] | 252 | $user_granted_by_group_ids = array_unique($user_granted_by_group_ids); |
---|
| 253 | |
---|
| 254 | |
---|
| 255 | $user_granted_indirect_ids = array_diff($user_granted_by_group_ids, |
---|
| 256 | $user_granted_direct_ids); |
---|
[2349] | 257 | $user_granted_indirect_ids = |
---|
| 258 | order_by_name($user_granted_indirect_ids, $users); |
---|
[800] | 259 | foreach ($user_granted_indirect_ids as $user_id) |
---|
[21] | 260 | { |
---|
[800] | 261 | foreach ($granted_groups as $group_id => $group_users) |
---|
[21] | 262 | { |
---|
[800] | 263 | if (in_array($user_id, $group_users)) |
---|
[21] | 264 | { |
---|
[2223] | 265 | $template->append( |
---|
| 266 | 'user_granted_indirects', |
---|
| 267 | array( |
---|
| 268 | 'USER'=>$users[$user_id], |
---|
| 269 | 'GROUP'=>$groups[$group_id] |
---|
| 270 | ) |
---|
| 271 | ); |
---|
[800] | 272 | break; |
---|
[21] | 273 | } |
---|
| 274 | } |
---|
| 275 | } |
---|
| 276 | } |
---|
[800] | 277 | |
---|
| 278 | $user_denied_ids = array_diff(array_keys($users), |
---|
| 279 | $user_granted_indirect_ids, |
---|
| 280 | $user_granted_direct_ids); |
---|
[2349] | 281 | $user_denied_ids = order_by_name($user_denied_ids, $users); |
---|
[2223] | 282 | $template->assign('user_denied_ids', $user_denied_ids); |
---|
[800] | 283 | |
---|
| 284 | |
---|
| 285 | // +-----------------------------------------------------------------------+ |
---|
| 286 | // | sending html code | |
---|
| 287 | // +-----------------------------------------------------------------------+ |
---|
| 288 | $template->assign_var_from_handle('ADMIN_CONTENT', 'cat_perm'); |
---|
[362] | 289 | ?> |
---|