1 | <?php |
---|
2 | // +-----------------------------------------------------------------------+ |
---|
3 | // | user_perm.php | |
---|
4 | // +-----------------------------------------------------------------------+ |
---|
5 | // | application : PhpWebGallery <http://phpwebgallery.net> | |
---|
6 | // | branch : BSF (Best So Far) | |
---|
7 | // +-----------------------------------------------------------------------+ |
---|
8 | // | file : $RCSfile$ |
---|
9 | // | last update : $Date: 2004-03-20 00:52:37 +0000 (Sat, 20 Mar 2004) $ |
---|
10 | // | last modifier : $Author: gweltas $ |
---|
11 | // | revision : $Revision: 393 $ |
---|
12 | // +-----------------------------------------------------------------------+ |
---|
13 | // | This program is free software; you can redistribute it and/or modify | |
---|
14 | // | it under the terms of the GNU General Public License as published by | |
---|
15 | // | the Free Software Foundation | |
---|
16 | // | | |
---|
17 | // | This program is distributed in the hope that it will be useful, but | |
---|
18 | // | WITHOUT ANY WARRANTY; without even the implied warranty of | |
---|
19 | // | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
---|
20 | // | General Public License for more details. | |
---|
21 | // | | |
---|
22 | // | You should have received a copy of the GNU General Public License | |
---|
23 | // | along with this program; if not, write to the Free Software | |
---|
24 | // | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, | |
---|
25 | // | USA. | |
---|
26 | // +-----------------------------------------------------------------------+ |
---|
27 | |
---|
28 | if( !defined("IN_ADMIN") ) |
---|
29 | { |
---|
30 | die ("Hacking attempt!"); |
---|
31 | } |
---|
32 | |
---|
33 | include_once( PHPWG_ROOT_PATH.'admin/include/isadmin.inc.php' ); |
---|
34 | |
---|
35 | // |
---|
36 | // Username search |
---|
37 | // |
---|
38 | function username_search($search_match) |
---|
39 | { |
---|
40 | global $db, $board_config, $template, $lang, $images, $theme, $phpEx, $phpbb_root_path; |
---|
41 | global $starttime, $gen_simple_header; |
---|
42 | |
---|
43 | $gen_simple_header = TRUE; |
---|
44 | |
---|
45 | $username_list = ''; |
---|
46 | if ( !empty($search_match) ) |
---|
47 | { |
---|
48 | $username_search = preg_replace('/\*/', '%', trim(strip_tags($search_match))); |
---|
49 | |
---|
50 | $sql = "SELECT username |
---|
51 | FROM " . USERS_TABLE . " |
---|
52 | WHERE username LIKE '" . str_replace("\'", "''", $username_search) . "' |
---|
53 | ORDER BY username"; |
---|
54 | if ( !($result = $db->sql_query($sql)) ) |
---|
55 | { |
---|
56 | message_die(GENERAL_ERROR, 'Could not obtain search results', '', __LINE__, __FILE__, $sql); |
---|
57 | } |
---|
58 | |
---|
59 | if ( $row = $db->sql_fetchrow($result) ) |
---|
60 | { |
---|
61 | do |
---|
62 | { |
---|
63 | $username_list .= '<option value="' . $row['username'] . '">' . $row['username'] . '</option>'; |
---|
64 | } |
---|
65 | while ( $row = $db->sql_fetchrow($result) ); |
---|
66 | } |
---|
67 | else |
---|
68 | { |
---|
69 | $username_list .= '<option>' . $lang['No_match']. '</option>'; |
---|
70 | } |
---|
71 | $db->sql_freeresult($result); |
---|
72 | } |
---|
73 | |
---|
74 | $page_title = $lang['Search']; |
---|
75 | include($phpbb_root_path . 'includes/page_header.'.$phpEx); |
---|
76 | |
---|
77 | $template->set_filenames(array( |
---|
78 | 'search_user_body' => 'search_username.tpl') |
---|
79 | ); |
---|
80 | |
---|
81 | $template->assign_vars(array( |
---|
82 | 'USERNAME' => ( !empty($search_match) ) ? strip_tags($search_match) : '', |
---|
83 | |
---|
84 | 'L_CLOSE_WINDOW' => $lang['Close_window'], |
---|
85 | 'L_SEARCH_USERNAME' => $lang['Find_username'], |
---|
86 | 'L_UPDATE_USERNAME' => $lang['Select_username'], |
---|
87 | 'L_SELECT' => $lang['Select'], |
---|
88 | 'L_SEARCH' => $lang['Search'], |
---|
89 | 'L_SEARCH_EXPLAIN' => $lang['Search_author_explain'], |
---|
90 | 'L_CLOSE_WINDOW' => $lang['Close_window'], |
---|
91 | |
---|
92 | 'S_USERNAME_OPTIONS' => $username_list, |
---|
93 | 'S_SEARCH_ACTION' => append_sid("search.$phpEx?mode=searchuser")) |
---|
94 | ); |
---|
95 | |
---|
96 | if ( $username_list != '' ) |
---|
97 | { |
---|
98 | $template->assign_block_vars('switch_select_name', array()); |
---|
99 | } |
---|
100 | |
---|
101 | $template->pparse('search_user_body'); |
---|
102 | |
---|
103 | include($phpbb_root_path . 'includes/page_tail.'.$phpEx); |
---|
104 | |
---|
105 | return; |
---|
106 | } |
---|
107 | |
---|
108 | if (isset($HTTP_POST_VARS['username']) || isset( $_POST['submit'] )) |
---|
109 | { |
---|
110 | //----------------------------------------------------- template initialization |
---|
111 | $template->set_filenames( array('user'=>'admin/user_perm.tpl') ); |
---|
112 | |
---|
113 | $error = array(); |
---|
114 | $tpl = array( 'permuser_authorized','permuser_forbidden','submit', |
---|
115 | 'permuser_parent_forbidden','permuser_info_message', |
---|
116 | 'adduser_info_back','permuser_only_private' ); |
---|
117 | //--------------------------------------------------------------------- updates |
---|
118 | if ( isset( $_POST['submit'] ) ) |
---|
119 | { |
---|
120 | // cleaning the user_access table for this user |
---|
121 | $query = 'DELETE FROM '.PREFIX_TABLE.'user_access'; |
---|
122 | $query.= ' WHERE user_id = '.$_GET['user_id']; |
---|
123 | $query.= ';'; |
---|
124 | mysql_query( $query ); |
---|
125 | // selecting all private categories |
---|
126 | $query = 'SELECT id'; |
---|
127 | $query.= ' FROM '.PREFIX_TABLE.'categories'; |
---|
128 | $query.= " WHERE status = 'private'"; |
---|
129 | $query.= ';'; |
---|
130 | $result = mysql_query( $query ); |
---|
131 | while ( $row = mysql_fetch_array( $result ) ) |
---|
132 | { |
---|
133 | $radioname = 'access-'.$row['id']; |
---|
134 | if ( $_POST[$radioname] == 0 ) |
---|
135 | { |
---|
136 | $query = 'INSERT INTO '.PREFIX_TABLE.'user_access'; |
---|
137 | $query.= ' (user_id,cat_id) VALUES'; |
---|
138 | $query.= ' ('.$_GET['user_id'].','.$row['id'].')'; |
---|
139 | $query.= ';'; |
---|
140 | mysql_query ( $query ); |
---|
141 | } |
---|
142 | } |
---|
143 | check_favorites( $_GET['user_id'] ); |
---|
144 | synchronize_user( $_GET['user_id'] ); |
---|
145 | $vtp->addSession( $sub, 'confirmation' ); |
---|
146 | $url = './admin.php?page=user_list'; |
---|
147 | $vtp->setVar( $sub, 'confirmation.back_url', add_session_id( $url ) ); |
---|
148 | $vtp->closeSession( $sub, 'confirmation' ); |
---|
149 | } |
---|
150 | //---------------------------------------------------------------- form display |
---|
151 | |
---|
152 | $restrictions = get_user_restrictions( $_GET['user_id'], $page['user_status'], |
---|
153 | false, false ); |
---|
154 | $action = './admin.php?page=user_perm&user_id='.$_GET['user_id']; |
---|
155 | $vtp->setVar( $sub, 'action', add_session_id( $action ) ); |
---|
156 | // Association of group_ids with group_names -> caching informations |
---|
157 | $query = 'SELECT id,name'; |
---|
158 | $query.= ' FROM '.PREFIX_TABLE.'groups'; |
---|
159 | $query.= ';'; |
---|
160 | $result = mysql_query( $query ); |
---|
161 | $groups = array(); |
---|
162 | while ( $row = mysql_fetch_array( $result ) ) |
---|
163 | { |
---|
164 | $groups[$row['id']] = $row['name']; |
---|
165 | } |
---|
166 | // Listing of groups the user belongs to |
---|
167 | $query = 'SELECT ug.group_id as groupid'; |
---|
168 | $query.= ' FROM '.PREFIX_TABLE.'user_group as ug'; |
---|
169 | $query.= ' WHERE user_id = '.$_GET['user_id']; |
---|
170 | $query.= ';'; |
---|
171 | $result = mysql_query( $query ); |
---|
172 | $usergroups = array(); |
---|
173 | while ( $row = mysql_fetch_array( $result ) ) |
---|
174 | { |
---|
175 | array_push( $usergroups, $row['groupid'] ); |
---|
176 | } |
---|
177 | // only private categories are listed |
---|
178 | $query = 'SELECT id'; |
---|
179 | $query.= ' FROM '.PREFIX_TABLE.'categories'; |
---|
180 | $query.= " WHERE status = 'private'"; |
---|
181 | $query.= ';'; |
---|
182 | $result = mysql_query( $query ); |
---|
183 | while ( $row = mysql_fetch_array( $result ) ) |
---|
184 | { |
---|
185 | $vtp->addSession( $sub, 'category' ); |
---|
186 | $vtp->setVar( $sub, 'category.id', $row['id'] ); |
---|
187 | // we have to know whether the user is authorized to access this |
---|
188 | // category. The category can be accessible for this user thanks to his |
---|
189 | // personnal access rights OR thanks to the access rights of a group he |
---|
190 | // belongs to. |
---|
191 | // 1. group access : |
---|
192 | // retrieving all authorized groups for this category and for this user |
---|
193 | $query = 'SELECT ga.group_id as groupid'; |
---|
194 | $query.= ' FROM '.PREFIX_TABLE.'group_access as ga'; |
---|
195 | $query.= ', '.PREFIX_TABLE.'user_group as ug'; |
---|
196 | $query.= ' WHERE ga.group_id = ug.group_id'; |
---|
197 | $query.= ' AND ug.user_id = '.$_GET['user_id']; |
---|
198 | $query.= ' AND cat_id = '.$row['id']; |
---|
199 | $query.= ';'; |
---|
200 | $subresult = mysql_query( $query ); |
---|
201 | $authorized_groups = array(); |
---|
202 | while ( $subrow = mysql_fetch_array( $subresult ) ) |
---|
203 | { |
---|
204 | array_push( $authorized_groups, $subrow['groupid'] ); |
---|
205 | } |
---|
206 | // 2. personnal access |
---|
207 | $is_user_allowed = is_user_allowed( $row['id'], $restrictions ); |
---|
208 | // link to the category permission management |
---|
209 | $url = './admin.php?page=cat_perm&cat_id='.$row['id']; |
---|
210 | $vtp->setVar( $sub, 'category.cat_perm_link', add_session_id( $url ) ); |
---|
211 | // color of the category : green if the user is allowed by himself or |
---|
212 | // thanks to a group he belongs to |
---|
213 | if ( $is_user_allowed == 0 or count( $authorized_groups ) > 0 ) |
---|
214 | { |
---|
215 | $vtp->setVar( $sub, 'category.color', 'green' ); |
---|
216 | } |
---|
217 | else |
---|
218 | { |
---|
219 | $vtp->setVar( $sub, 'category.color', 'red' ); |
---|
220 | } |
---|
221 | // category name |
---|
222 | $cat_infos = get_cat_info( $row['id'] ); |
---|
223 | $name = get_cat_display_name( $cat_infos['name'],' > ', |
---|
224 | 'font-weight:bold;' ); |
---|
225 | $vtp->setVar( $sub, 'category.name', $name ); |
---|
226 | // usergroups |
---|
227 | if ( count( $usergroups ) > 0 ) |
---|
228 | { |
---|
229 | $vtp->addSession( $sub, 'usergroups' ); |
---|
230 | foreach ( $usergroups as $i => $usergroup ) { |
---|
231 | $vtp->addSession( $sub, 'usergroup' ); |
---|
232 | $vtp->setVar( $sub, 'usergroup.name', $groups[$usergroup] ); |
---|
233 | $url = './admin.php?page=group_perm&group_id='.$usergroup; |
---|
234 | $vtp->setVar( $sub, 'usergroup.url', add_session_id( $url ) ); |
---|
235 | if ( in_array( $usergroup, $authorized_groups ) ) |
---|
236 | { |
---|
237 | $vtp->setVar( $sub, 'usergroup.color', 'green' ); |
---|
238 | } |
---|
239 | else |
---|
240 | { |
---|
241 | $vtp->setVar( $sub, 'usergroup.color', 'red' ); |
---|
242 | } |
---|
243 | if ( $i < count( $usergroups ) - 1 ) |
---|
244 | { |
---|
245 | $vtp->setVar( $sub, 'usergroup.separation', ',' ); |
---|
246 | } |
---|
247 | $vtp->closeSession( $sub, 'usergroup' ); |
---|
248 | } |
---|
249 | $vtp->closeSession( $sub, 'usergroups' ); |
---|
250 | } |
---|
251 | // any subcat forbidden for this user ? |
---|
252 | if ( $is_user_allowed == 2 ) |
---|
253 | { |
---|
254 | $vtp->addSession( $sub, 'parent_forbidden' ); |
---|
255 | $vtp->closeSession( $sub, 'parent_forbidden' ); |
---|
256 | } |
---|
257 | // personnal forbidden or authorized access ? |
---|
258 | if ( $is_user_allowed == 0 ) |
---|
259 | { |
---|
260 | $vtp->setVar( $sub, 'category.authorized_checked', ' checked="checked"' ); |
---|
261 | } |
---|
262 | else |
---|
263 | { |
---|
264 | $vtp->setVar( $sub, 'category.forbidden_checked', ' checked="checked"' ); |
---|
265 | } |
---|
266 | $vtp->closeSession( $sub, 'category' ); |
---|
267 | } |
---|
268 | //----------------------------------------------------------- default code |
---|
269 | else |
---|
270 | { |
---|
271 | $sub = $vtp->Open( '../template/'.$user['template'].'/admin/user_select_body.vtp' ); |
---|
272 | $tpl = array( 'Look_up_user', 'Find_username', 'Select_username' ); |
---|
273 | templatize_array( $tpl, 'lang', $sub ); |
---|
274 | $vtp->addSession( $sub, 'user' ); |
---|
275 | $vtp->setVarTab( $sub, array( |
---|
276 | 'user.S_USER_ACTION' => append_sid("./admin.php?page=user_search"), |
---|
277 | 'user.U_SEARCH_USER' => append_sid("./search.php")) |
---|
278 | ); |
---|
279 | $vtp->closeSession( $sub, 'user' ); |
---|
280 | } |
---|
281 | //----------------------------------------------------------- sending html code |
---|
282 | $vtp->Parse( $handle , 'sub', $sub ); |
---|
283 | ?> |
---|