diff options
Diffstat (limited to 'admin')
| -rw-r--r-- | admin/user_perm.php | 303 |
1 files changed, 75 insertions, 228 deletions
diff --git a/admin/user_perm.php b/admin/user_perm.php index e2fd31d1e..f8c83d659 100644 --- a/admin/user_perm.php +++ b/admin/user_perm.php @@ -29,254 +29,101 @@ if( !defined("IN_ADMIN") ) { die ("Hacking attempt!"); } - include_once( PHPWG_ROOT_PATH.'admin/include/isadmin.inc.php' ); -// -// Username search -// -function username_search($search_match) +$userdata = array(); +if ( isset( $_POST['submituser'] ) ) { - global $db, $board_config, $template, $lang, $images, $theme, $phpEx, $phpbb_root_path; - global $starttime, $gen_simple_header; - - $gen_simple_header = TRUE; - - $username_list = ''; - if ( !empty($search_match) ) - { - $username_search = preg_replace('/\*/', '%', trim(strip_tags($search_match))); - - $sql = "SELECT username - FROM " . USERS_TABLE . " - WHERE username LIKE '" . str_replace("\'", "''", $username_search) . "' - ORDER BY username"; - if ( !($result = $db->sql_query($sql)) ) - { - message_die(GENERAL_ERROR, 'Could not obtain search results', '', __LINE__, __FILE__, $sql); - } - - if ( $row = $db->sql_fetchrow($result) ) - { - do - { - $username_list .= '<option value="' . $row['username'] . '">' . $row['username'] . '</option>'; - } - while ( $row = $db->sql_fetchrow($result) ); - } - else - { - $username_list .= '<option>' . $lang['No_match']. '</option>'; - } - $db->sql_freeresult($result); - } - - $page_title = $lang['Search']; - include($phpbb_root_path . 'includes/page_header.'.$phpEx); - - $template->set_filenames(array( - 'search_user_body' => 'search_username.tpl') - ); - - $template->assign_vars(array( - 'USERNAME' => ( !empty($search_match) ) ? strip_tags($search_match) : '', - - 'L_CLOSE_WINDOW' => $lang['Close_window'], - 'L_SEARCH_USERNAME' => $lang['Find_username'], - 'L_UPDATE_USERNAME' => $lang['Select_username'], - 'L_SELECT' => $lang['Select'], - 'L_SEARCH' => $lang['Search'], - 'L_SEARCH_EXPLAIN' => $lang['search_explain'], - 'L_CLOSE_WINDOW' => $lang['Close_window'], - - 'S_USERNAME_OPTIONS' => $username_list, - 'S_SEARCH_ACTION' => append_sid("search.$phpEx?mode=searchuser")) - ); - - if ( $username_list != '' ) - { - $template->assign_block_vars('switch_select_name', array()); - } - - $template->pparse('search_user_body'); - - include($phpbb_root_path . 'includes/page_tail.'.$phpEx); - - return; + $userdata = getuserdata($_POST['username']); } - -if (isset($HTTP_POST_VARS['username']) || isset( $_POST['submit'] )) -{ -//----------------------------------------------------- template initialization -$template->set_filenames( array('user'=>'admin/user_perm.tpl') ); - -$error = array(); -$tpl = array( 'permuser_authorized','permuser_forbidden','submit', - 'permuser_parent_forbidden','permuser_info_message', - 'adduser_info_back','permuser_only_private' ); -//--------------------------------------------------------------------- updates -if ( isset( $_POST['submit'] ) ) +elseif (isset($_POST['falsify']) || isset($_POST['trueify'])) { + $userdata = getuserdata(intval($_POST['userid'])); // cleaning the user_access table for this user - $query = 'DELETE FROM '.PREFIX_TABLE.'user_access'; - $query.= ' WHERE user_id = '.$_GET['user_id']; - $query.= ';'; - pwg_query( $query ); - // selecting all private categories - $query = 'SELECT id'; - $query.= ' FROM '.PREFIX_TABLE.'categories'; - $query.= " WHERE status = 'private'"; - $query.= ';'; - $result = pwg_query( $query ); - while ( $row = mysql_fetch_array( $result ) ) + if (isset($_POST['cat_true']) && count($_POST['cat_true']) > 0) { - $radioname = 'access-'.$row['id']; - if ( $_POST[$radioname] == 0 ) - { - $query = 'INSERT INTO '.PREFIX_TABLE.'user_access'; + foreach ($_POST['cat_true'] as $auth_cat) + { + $query = 'DELETE FROM '.USER_ACCESS_TABLE; + $query.= ' WHERE user_id = '.$userdata['id']; + $query.= ' AND cat_id='.$auth_cat.';'; + pwg_query ( $query ); + } + } + + if (isset($_POST['cat_false']) && count($_POST['cat_false']) > 0) + { + foreach ($_POST['cat_false'] as $auth_cat) + { + $query = 'INSERT INTO '.USER_ACCESS_TABLE; $query.= ' (user_id,cat_id) VALUES'; - $query.= ' ('.$_GET['user_id'].','.$row['id'].')'; + $query.= ' ('.$userdata['id'].','.$auth_cat.')'; $query.= ';'; pwg_query ( $query ); - } + } } - check_favorites( $_GET['user_id'] ); - synchronize_user( $_GET['user_id'] ); - $vtp->addSession( $sub, 'confirmation' ); - $url = './admin.php?page=user_list'; - $vtp->setVar( $sub, 'confirmation.back_url', add_session_id( $url ) ); - $vtp->closeSession( $sub, 'confirmation' ); } -//---------------------------------------------------------------- form display -$restrictions = get_user_restrictions( $_GET['user_id'], $page['user_status'], - false, false ); -$action = './admin.php?page=user_perm&user_id='.$_GET['user_id']; -$vtp->setVar( $sub, 'action', add_session_id( $action ) ); -// Association of group_ids with group_names -> caching informations -$query = 'SELECT id,name'; -$query.= ' FROM '.PREFIX_TABLE.'groups'; -$query.= ';'; -$result = pwg_query( $query ); -$groups = array(); -while ( $row = mysql_fetch_array( $result ) ) -{ - $groups[$row['id']] = $row['name']; -} -// Listing of groups the user belongs to -$query = 'SELECT ug.group_id as groupid'; -$query.= ' FROM '.PREFIX_TABLE.'user_group as ug'; -$query.= ' WHERE user_id = '.$_GET['user_id']; -$query.= ';'; -$result = pwg_query( $query ); -$usergroups = array(); -while ( $row = mysql_fetch_array( $result ) ) +//----------------------------------------------------- template initialization + +if ( empty($userdata)) { - array_push( $usergroups, $row['groupid'] ); + $template->set_filenames( array('user'=>'admin/user_perm.tpl') ); + $template->assign_vars(array( + 'L_SELECT_USERNAME'=>$lang['Select_username'], + 'L_LOOKUP_USER'=>$lang['Look_up_user'], + 'L_FIND_USERNAME'=>$lang['Find_username'], + 'L_AUTH_USER'=>$lang['permuser_only_private'], + 'L_SUBMIT'=>$lang['submit'], + + 'F_SEARCH_USER_ACTION' => add_session_id(PHPWG_ROOT_PATH.'admin.php?page=user_perm'), + 'U_SEARCH_USER' => add_session_id(PHPWG_ROOT_PATH.'admin/search.php') + )); } -// only private categories are listed -$query = 'SELECT id'; -$query.= ' FROM '.PREFIX_TABLE.'categories'; -$query.= " WHERE status = 'private'"; -$query.= ';'; -$result = pwg_query( $query ); -while ( $row = mysql_fetch_array( $result ) ) +else { - $vtp->addSession( $sub, 'category' ); - $vtp->setVar( $sub, 'category.id', $row['id'] ); - // we have to know whether the user is authorized to access this - // category. The category can be accessible for this user thanks to his - // personnal access rights OR thanks to the access rights of a group he - // belongs to. - // 1. group access : - // retrieving all authorized groups for this category and for this user - $query = 'SELECT ga.group_id as groupid'; - $query.= ' FROM '.PREFIX_TABLE.'group_access as ga'; - $query.= ', '.PREFIX_TABLE.'user_group as ug'; - $query.= ' WHERE ga.group_id = ug.group_id'; - $query.= ' AND ug.user_id = '.$_GET['user_id']; - $query.= ' AND cat_id = '.$row['id']; - $query.= ';'; - $subresult = pwg_query( $query ); - $authorized_groups = array(); - while ( $subrow = mysql_fetch_array( $subresult ) ) - { - array_push( $authorized_groups, $subrow['groupid'] ); - } - // 2. personnal access - $is_user_allowed = is_user_allowed( $row['id'], $restrictions ); - // link to the category permission management - $url = './admin.php?page=cat_perm&cat_id='.$row['id']; - $vtp->setVar( $sub, 'category.cat_perm_link', add_session_id( $url ) ); - // color of the category : green if the user is allowed by himself or - // thanks to a group he belongs to - if ( $is_user_allowed == 0 or count( $authorized_groups ) > 0 ) - { - $vtp->setVar( $sub, 'category.color', 'green' ); - } - else - { - $vtp->setVar( $sub, 'category.color', 'red' ); - } - // category name - $cat_infos = get_cat_info( $row['id'] ); - $name = get_cat_display_name($cat_infos['name']); - $vtp->setVar( $sub, 'category.name', $name ); - // usergroups - if ( count( $usergroups ) > 0 ) - { - $vtp->addSession( $sub, 'usergroups' ); - foreach ( $usergroups as $i => $usergroup ) { - $vtp->addSession( $sub, 'usergroup' ); - $vtp->setVar( $sub, 'usergroup.name', $groups[$usergroup] ); - $url = './admin.php?page=group_perm&group_id='.$usergroup; - $vtp->setVar( $sub, 'usergroup.url', add_session_id( $url ) ); - if ( in_array( $usergroup, $authorized_groups ) ) - { - $vtp->setVar( $sub, 'usergroup.color', 'green' ); - } - else - { - $vtp->setVar( $sub, 'usergroup.color', 'red' ); - } - if ( $i < count( $usergroups ) - 1 ) - { - $vtp->setVar( $sub, 'usergroup.separation', ',' ); - } - $vtp->closeSession( $sub, 'usergroup' ); - } - $vtp->closeSession( $sub, 'usergroups' ); - } - // any subcat forbidden for this user ? - if ( $is_user_allowed == 2 ) - { - $vtp->addSession( $sub, 'parent_forbidden' ); - $vtp->closeSession( $sub, 'parent_forbidden' ); - } - // personnal forbidden or authorized access ? - if ( $is_user_allowed == 0 ) + $cat_url = '<a href="'.add_session_id(PHPWG_ROOT_PATH.'admin.php?page=cat_options§ion=status'); + $cat_url .= '">'.$lang['permuser_info_link'].'</a>'; + $template->set_filenames( array('user'=>'admin/cat_options.tpl') ); + $template->assign_vars(array( + 'L_RESET'=>$lang['reset'], + 'L_CAT_OPTIONS_TRUE'=>$lang['authorized'], + 'L_CAT_OPTIONS_FALSE'=>$lang['forbidden'], + 'L_CAT_OPTIONS_INFO'=>$lang['permuser_info'].' '.$cat_url, + + 'HIDDEN_NAME'=> 'userid', + 'HIDDEN_VALUE'=>$userdata['id'], + 'F_ACTION' => add_session_id(PHPWG_ROOT_PATH.'admin.php?page=user_perm'), + )); + + + // only private categories are listed + $query_true = 'SELECT id,name,uppercats,global_rank FROM '.CATEGORIES_TABLE; + $query_true.= ' LEFT JOIN '.USER_ACCESS_TABLE.' as u'; + $query_true.= ' ON u.cat_id=id'; + $query_true.= ' WHERE status = \'private\' AND u.user_id='.$userdata['id'].';'; + $result = pwg_query($query_true); + $categorie_true = array(); + while (!empty($result) && $row = mysql_fetch_array($result)) { - $vtp->setVar( $sub, 'category.authorized_checked', ' checked="checked"' ); + array_push($categorie_true, $row); } - else + + $query = 'SELECT id,name,uppercats,global_rank FROM '.CATEGORIES_TABLE; + $query.= ' WHERE status = \'private\''; + $result = pwg_query($query); + $categorie_false = array(); + while ($row = mysql_fetch_array($result)) { - $vtp->setVar( $sub, 'category.forbidden_checked', ' checked="checked"' ); + if (!in_array($row,$categorie_true)) + array_push($categorie_false, $row); } - $vtp->closeSession( $sub, 'category' ); -} -//----------------------------------------------------------- default code -else -{ -$sub = $vtp->Open( '../template/'.$user['template'].'/admin/user_select_body.vtp' ); -$tpl = array( 'Look_up_user', 'Find_username', 'Select_username' ); -templatize_array( $tpl, 'lang', $sub ); - $vtp->addSession( $sub, 'user' ); - $vtp->setVarTab( $sub, array( - 'user.S_USER_ACTION' => append_sid("./admin.php?page=user_search"), - 'user.U_SEARCH_USER' => append_sid("./search.php")) - ); - $vtp->closeSession( $sub, 'user' ); + usort($categorie_true, 'global_rank_compare'); + usort($categorie_false, 'global_rank_compare'); + display_select_categories($categorie_true, array(), 'category_option_true', true); + display_select_categories($categorie_false, array(), 'category_option_false', true); } + //----------------------------------------------------------- sending html code -$vtp->Parse( $handle , 'sub', $sub ); +$template->assign_var_from_handle('ADMIN_CONTENT', 'user'); ?> |