jostreff/nsedit
1
0
Fork 0
mirror of https://github.com/tuxis-ie/nsedit.git synced 2025-04-20 20:13:40 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

group permissions check & first check on index page

Browse source
This commit is contained in:
Richard Underwood 2017-01-06 15:50:54 +00:00
parent a57af479b8
commit 6d56c7a44f
2 changed files with 20 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
includes/permissions.inc.php
View file

@ -82,7 +82,7 @@ function set_permissions($userid,$groupid,$zone,$permissions) {
writelog("Added '$permissionmap[$permissions]' permissions for $who from zone $zone."); writelog("Added '$permissionmap[$permissions]' permissions for $who from zone $zone.");
return $db->lastInsertRowID(); return $db->lastInsertRowID();
} else { } else {
writelog("Failed to add permissions to zone $zone for $who."); writelog("Failed to add permissions to zone $zone ($zoneid) for $who.");
return null; return null;
} }
} }
@ -192,8 +192,25 @@ function permissions($zone,$userid) {
return $perm; return $perm;
} else { } else {
$perm=0; $perm=0;
$zoneid=get_zone_id($zone);
$db = get_db();
$q = $db->prepare('SELECT p.permissions FROM groupmembers gm LEFT JOIN permissions p ON p."group"=gm."group" WHERE zone=? AND p."group">0 AND gm.user=?');
$q->bindValue(1, $zoneid, SQLITE3_INTEGER);
$q->bindValue(2, $userid, SQLITE3_INTEGER);
$r = $q->execute();
while ($row = $r->fetchArray(SQLITE3_NUM)) {
$perm=$perm|$row[0];
}
return $perm;
} }
} }
// Utility function - check a permission for current user
function check_permissions($zone,$permmask) {
return (bool) (permissions($zone,get_user_id(get_sess_user()))&$permmask);
}
?> ?>

3
zones.php
View file

@ -153,7 +153,7 @@ function quote_content($content) {
} }
function check_account($zone) { function check_account($zone) {
return is_adminuser() or ($zone->account === get_sess_user()); return is_adminuser() or ($zone->account === get_sess_user()) or check_permissions($zone->id,PERM_VIEW);
} }
if (isset($_GET['action'])) { if (isset($_GET['action'])) {
@ -200,6 +200,7 @@ case "listrecords":
$zone->parse($zonedata); $zone->parse($zonedata);
$records = $zone->rrsets2records(); $records = $zone->rrsets2records();
// if(permissions($zone->id))
if(!empty($_POST['label'])) { if(!empty($_POST['label'])) {
$records=array_filter($records, $records=array_filter($records,
function ($val) { function ($val) {