1 files changed, 75 insertions, 228 deletions

diff --git a/admin/user_perm.php b/admin/user_perm.php
index e2fd31d1e..f8c83d659 100644
--- a/admin/user_perm.php
+++ b/admin/user_perm.php
@@ -29,254 +29,101 @@ if( !defined("IN_ADMIN") )
 {
   die ("Hacking attempt!");
 }
-
 include_once( PHPWG_ROOT_PATH.'admin/include/isadmin.inc.php' );
 
-//
-// Username search
-//
-function username_search($search_match)
+$userdata = array();
+if ( isset( $_POST['submituser'] ) )
 {
-  global $db, $board_config, $template, $lang, $images, $theme, $phpEx, $phpbb_root_path;
-  global $starttime, $gen_simple_header;
-  
-  $gen_simple_header = TRUE;
-
-  $username_list = '';
-  if ( !empty($search_match) )
-  {
-    $username_search = preg_replace('/\*/', '%', trim(strip_tags($search_match)));
-
-    $sql = "SELECT username 
-      FROM " . USERS_TABLE . " 
-      WHERE username LIKE '" . str_replace("\'", "''", $username_search) . "' 
-      ORDER BY username";
-    if ( !($result = $db->sql_query($sql)) )
-    {
-      message_die(GENERAL_ERROR, 'Could not obtain search results', '', __LINE__, __FILE__, $sql);
-    }
-
-    if ( $row = $db->sql_fetchrow($result) )
-    {
-      do
-      {
-        $username_list .= '<option value="' . $row['username'] . '">' . $row['username'] . '</option>';
-      }
-      while ( $row = $db->sql_fetchrow($result) );
-    }
-    else
-    {
-      $username_list .= '<option>' . $lang['No_match']. '</option>';
-    }
-    $db->sql_freeresult($result);
-  }
-
-  $page_title = $lang['Search'];
-  include($phpbb_root_path . 'includes/page_header.'.$phpEx);
-
-  $template->set_filenames(array(
-    'search_user_body' => 'search_username.tpl')
-  );
-
-  $template->assign_vars(array(
-    'USERNAME' => ( !empty($search_match) ) ? strip_tags($search_match) : '', 
-
-    'L_CLOSE_WINDOW' => $lang['Close_window'], 
-    'L_SEARCH_USERNAME' => $lang['Find_username'], 
-    'L_UPDATE_USERNAME' => $lang['Select_username'], 
-    'L_SELECT' => $lang['Select'], 
-    'L_SEARCH' => $lang['Search'], 
-    'L_SEARCH_EXPLAIN' => $lang['search_explain'], 
-    'L_CLOSE_WINDOW' => $lang['Close_window'], 
-
-    'S_USERNAME_OPTIONS' => $username_list, 
-    'S_SEARCH_ACTION' => append_sid("search.$phpEx?mode=searchuser"))
-  );
-
-  if ( $username_list != '' )
-  {
-    $template->assign_block_vars('switch_select_name', array());
-  }
-
-  $template->pparse('search_user_body');
-
-  include($phpbb_root_path . 'includes/page_tail.'.$phpEx);
-
-  return;
+  $userdata = getuserdata($_POST['username']);
 }
-
-if  (isset($HTTP_POST_VARS['username']) || isset( $_POST['submit'] ))
-{
-//----------------------------------------------------- template initialization
-$template->set_filenames( array('user'=>'admin/user_perm.tpl') );
-
-$error = array();
-$tpl = array( 'permuser_authorized','permuser_forbidden','submit',
-              'permuser_parent_forbidden','permuser_info_message',
-              'adduser_info_back','permuser_only_private' );
-//--------------------------------------------------------------------- updates
-if ( isset( $_POST['submit'] ) )
+elseif (isset($_POST['falsify']) || isset($_POST['trueify']))
 {
+  $userdata = getuserdata(intval($_POST['userid']));
   // cleaning the user_access table for this user
-  $query = 'DELETE FROM '.PREFIX_TABLE.'user_access';
-  $query.= ' WHERE user_id = '.$_GET['user_id'];
-  $query.= ';';
-  pwg_query( $query );
-  // selecting all private categories
-  $query = 'SELECT id';
-  $query.= ' FROM '.PREFIX_TABLE.'categories';
-  $query.= " WHERE status = 'private'";
-  $query.= ';';
-  $result = pwg_query( $query );
-  while ( $row = mysql_fetch_array( $result ) )
+  if (isset($_POST['cat_true']) && count($_POST['cat_true']) > 0)
   {
-    $radioname = 'access-'.$row['id'];
-    if ( $_POST[$radioname] == 0 )
-    {
-      $query = 'INSERT INTO '.PREFIX_TABLE.'user_access';
+    foreach ($_POST['cat_true'] as $auth_cat)
+	{
+  	  $query = 'DELETE FROM '.USER_ACCESS_TABLE;
+      $query.= ' WHERE user_id = '.$userdata['id'];
+      $query.= ' AND cat_id='.$auth_cat.';';
+      pwg_query ( $query );
+	}
+  }
+  
+  if (isset($_POST['cat_false']) && count($_POST['cat_false']) > 0)
+  {
+    foreach ($_POST['cat_false'] as $auth_cat)
+	{
+  	  $query = 'INSERT INTO '.USER_ACCESS_TABLE;
       $query.= ' (user_id,cat_id) VALUES';
-      $query.= ' ('.$_GET['user_id'].','.$row['id'].')';
+      $query.= ' ('.$userdata['id'].','.$auth_cat.')';
       $query.= ';';
       pwg_query ( $query );
-    }
+	}
   }
-  check_favorites( $_GET['user_id'] );
-  synchronize_user( $_GET['user_id'] );
-  $vtp->addSession( $sub, 'confirmation' );
-  $url = './admin.php?page=user_list';
-  $vtp->setVar( $sub, 'confirmation.back_url', add_session_id( $url ) );
-  $vtp->closeSession( $sub, 'confirmation' );
 }
-//---------------------------------------------------------------- form display
 
-$restrictions = get_user_restrictions( $_GET['user_id'], $page['user_status'],
-                                  false, false );
-$action = './admin.php?page=user_perm&amp;user_id='.$_GET['user_id'];
-$vtp->setVar( $sub, 'action', add_session_id( $action ) );
-// Association of group_ids with group_names -> caching informations
-$query = 'SELECT id,name';
-$query.= ' FROM '.PREFIX_TABLE.'groups';
-$query.= ';';
-$result = pwg_query( $query );
-$groups = array();
-while ( $row = mysql_fetch_array( $result ) )
-{
-  $groups[$row['id']] = $row['name'];
-}
-// Listing of groups the user belongs to
-$query = 'SELECT ug.group_id as groupid';
-$query.= ' FROM '.PREFIX_TABLE.'user_group as ug';
-$query.= ' WHERE user_id = '.$_GET['user_id'];
-$query.= ';';
-$result = pwg_query( $query );
-$usergroups = array();
-while ( $row = mysql_fetch_array( $result ) )
+//----------------------------------------------------- template initialization
+
+if ( empty($userdata))
 {
-  array_push( $usergroups, $row['groupid'] );
+  $template->set_filenames( array('user'=>'admin/user_perm.tpl') );
+  $template->assign_vars(array(
+    'L_SELECT_USERNAME'=>$lang['Select_username'],
+    'L_LOOKUP_USER'=>$lang['Look_up_user'],
+    'L_FIND_USERNAME'=>$lang['Find_username'],
+    'L_AUTH_USER'=>$lang['permuser_only_private'],
+    'L_SUBMIT'=>$lang['submit'],
+
+    'F_SEARCH_USER_ACTION' => add_session_id(PHPWG_ROOT_PATH.'admin.php?page=user_perm'),
+    'U_SEARCH_USER' => add_session_id(PHPWG_ROOT_PATH.'admin/search.php')
+    ));
 }
-// only private categories are listed
-$query = 'SELECT id';
-$query.= ' FROM '.PREFIX_TABLE.'categories';
-$query.= " WHERE status = 'private'";
-$query.= ';';
-$result = pwg_query( $query );
-while ( $row = mysql_fetch_array( $result ) )
+else
 {
-  $vtp->addSession( $sub, 'category' );
-  $vtp->setVar( $sub, 'category.id', $row['id'] );
-  // we have to know whether the user is authorized to access this
-  // category. The category can be accessible for this user thanks to his
-  // personnal access rights OR thanks to the access rights of a group he
-  // belongs to.
-  // 1. group access :
-  //    retrieving all authorized groups for this category and for this user
-  $query = 'SELECT ga.group_id as groupid';
-  $query.= ' FROM '.PREFIX_TABLE.'group_access as ga';
-  $query.= ', '.PREFIX_TABLE.'user_group as ug';
-  $query.= ' WHERE ga.group_id = ug.group_id';
-  $query.= ' AND ug.user_id = '.$_GET['user_id'];
-  $query.= ' AND cat_id = '.$row['id'];
-  $query.= ';';
-  $subresult = pwg_query( $query );
-  $authorized_groups = array();
-  while ( $subrow = mysql_fetch_array( $subresult ) )
-  {
-    array_push( $authorized_groups, $subrow['groupid'] );
-  }
-  // 2. personnal access
-  $is_user_allowed = is_user_allowed( $row['id'], $restrictions );
-  // link to the category permission management
-  $url = './admin.php?page=cat_perm&amp;cat_id='.$row['id'];
-  $vtp->setVar( $sub, 'category.cat_perm_link', add_session_id( $url ) );
-  // color of the category : green if the user is allowed by himself or
-  // thanks to a group he belongs to
-  if ( $is_user_allowed == 0 or count( $authorized_groups ) > 0 )
-  {
-    $vtp->setVar( $sub, 'category.color', 'green' );
-  }
-  else
-  {
-    $vtp->setVar( $sub, 'category.color', 'red' );
-  }
-  // category name
-  $cat_infos = get_cat_info( $row['id'] );
-  $name = get_cat_display_name($cat_infos['name']);
-  $vtp->setVar( $sub, 'category.name', $name );
-  // usergroups
-  if ( count( $usergroups ) > 0 )
-  {
-    $vtp->addSession( $sub, 'usergroups' );
-    foreach ( $usergroups as $i => $usergroup ) {
-      $vtp->addSession( $sub, 'usergroup' );
-      $vtp->setVar( $sub, 'usergroup.name', $groups[$usergroup] );
-      $url = './admin.php?page=group_perm&amp;group_id='.$usergroup;
-      $vtp->setVar( $sub, 'usergroup.url', add_session_id( $url ) );
-      if ( in_array( $usergroup, $authorized_groups ) )
-      {
-        $vtp->setVar( $sub, 'usergroup.color', 'green' );
-      }
-      else
-      {
-        $vtp->setVar( $sub, 'usergroup.color', 'red' );
-      }
-      if ( $i < count( $usergroups ) - 1 )
-      {
-        $vtp->setVar( $sub, 'usergroup.separation', ',' );
-      }
-      $vtp->closeSession( $sub, 'usergroup' );
-    }
-    $vtp->closeSession( $sub, 'usergroups' );
-  }
-  // any subcat forbidden for this user ?
-  if ( $is_user_allowed == 2 )
-  {
-    $vtp->addSession( $sub, 'parent_forbidden' );
-    $vtp->closeSession( $sub, 'parent_forbidden' );
-  }
-  // personnal forbidden or authorized access ?
-  if ( $is_user_allowed == 0 )
+  $cat_url = '<a href="'.add_session_id(PHPWG_ROOT_PATH.'admin.php?page=cat_options&section=status');
+  $cat_url .= '">'.$lang['permuser_info_link'].'</a>';
+  $template->set_filenames( array('user'=>'admin/cat_options.tpl') );
+  $template->assign_vars(array(
+    'L_RESET'=>$lang['reset'],
+    'L_CAT_OPTIONS_TRUE'=>$lang['authorized'],
+    'L_CAT_OPTIONS_FALSE'=>$lang['forbidden'],
+    'L_CAT_OPTIONS_INFO'=>$lang['permuser_info'].'&nbsp;'.$cat_url,
+	
+	'HIDDEN_NAME'=> 'userid',
+	'HIDDEN_VALUE'=>$userdata['id'],
+    'F_ACTION' => add_session_id(PHPWG_ROOT_PATH.'admin.php?page=user_perm'),
+    ));
+
+
+  // only private categories are listed
+  $query_true = 'SELECT id,name,uppercats,global_rank FROM '.CATEGORIES_TABLE;
+  $query_true.= ' LEFT JOIN '.USER_ACCESS_TABLE.' as u';
+  $query_true.= ' ON u.cat_id=id';
+  $query_true.= ' WHERE status = \'private\' AND u.user_id='.$userdata['id'].';';
+  $result = pwg_query($query_true);
+  $categorie_true = array();
+  while (!empty($result) && $row = mysql_fetch_array($result))
   {
-    $vtp->setVar( $sub, 'category.authorized_checked', ' checked="checked"' );
+    array_push($categorie_true, $row);
   }
-  else
+  
+  $query = 'SELECT id,name,uppercats,global_rank FROM '.CATEGORIES_TABLE;
+  $query.= ' WHERE status = \'private\'';
+  $result = pwg_query($query);
+  $categorie_false = array();
+  while ($row = mysql_fetch_array($result))
   {
-    $vtp->setVar( $sub, 'category.forbidden_checked', ' checked="checked"' );
+    if (!in_array($row,$categorie_true))
+	  array_push($categorie_false, $row);
   }
-  $vtp->closeSession( $sub, 'category' );
-}
-//----------------------------------------------------------- default code
-else
-{
-$sub = $vtp->Open( '../template/'.$user['template'].'/admin/user_select_body.vtp' );
-$tpl = array( 'Look_up_user', 'Find_username', 'Select_username' );
-templatize_array( $tpl, 'lang', $sub );
-  $vtp->addSession( $sub, 'user' );
-  $vtp->setVarTab( $sub, array(
-      'user.S_USER_ACTION' => append_sid("./admin.php?page=user_search"),
-    'user.U_SEARCH_USER' => append_sid("./search.php"))
-    );
-  $vtp->closeSession( $sub, 'user' );
+  usort($categorie_true, 'global_rank_compare');
+  usort($categorie_false, 'global_rank_compare');
+  display_select_categories($categorie_true, array(), 'category_option_true', true);
+  display_select_categories($categorie_false, array(), 'category_option_false', true);
 }
+
 //----------------------------------------------------------- sending html code
-$vtp->Parse( $handle , 'sub', $sub );
+$template->assign_var_from_handle('ADMIN_CONTENT', 'user');
 ?>