X-Git-Url: https://git.infodrom.org/?p=misc%2Fkostenrechnung;a=blobdiff_plain;f=lib%2Fgeneral.php;h=837a4b8a807222931fa55f7821d19d3a603d3990;hp=3f82f4a7f499208dfe59d544a36ef0d3d563dc70;hb=deaf08b6e3fc5c35d139b83db7f4951f4685eb30;hpb=162cb09efc77d87f8d05a9c3f9d8f6520bea7600
diff --git a/lib/general.php b/lib/general.php
index 3f82f4a..837a4b8 100644
--- a/lib/general.php
+++ b/lib/general.php
@@ -5,6 +5,34 @@ function passwd($login,$pass)
return md5(md5($pass).$login);
}
+function format_ajax($data)
+{
+ header('Content-type: application/json; charset=UTF-8');
+ echo json_encode($data);
+ exit;
+}
+
+function check_permissions($name)
+{
+ $sql = sprintf("SELECT count(*) AS count FROM sys_mask "
+ . "JOIN sys_menu ON sys_mask.menu = sys_menu.id "
+ . "JOIN sys_group_mask ON sys_mask.id = sys_group_mask.mask "
+ . "WHERE sys_group_mask.gid = %d AND fname = '%s'",
+ $_SESSION['sys']['group'], pg_escape_string($name));
+
+ $sth = pg_query($sql);
+
+ if ($sth === false) return false;
+
+ $row = pg_fetch_assoc($sth);
+ if ($row === false) return false;
+
+ if ($row['count'] == 0)
+ return false;
+
+ return true;
+}
+
function check_session()
{
if (!empty($_SESSION['sys']['login']) && !empty($_GET['logout'])) {
@@ -13,7 +41,8 @@ function check_session()
exit();
}
- if (!empty($_POST['login']) && !empty($_POST['passwd'])) {
+ if (substr($_SERVER["SCRIPT_FILENAME"],-10) == '/index.php' &&
+ !empty($_POST['login']) && !empty($_POST['passwd'])) {
require_once('lib/login.php');
if (check_passwd()) {
header('Location: ./');
@@ -25,6 +54,44 @@ function check_session()
header('Location: ./?login=true');
exit();
}
+
+ /* regular mask */
+ if (!empty($_GET['mask'])) {
+ if (check_permissions($_GET['mask']))
+ return true;
+ else {
+ header('Location: ./');
+ exit();
+ }
+ }
+
+ /* table data */
+ if (substr($_SERVER["SCRIPT_FILENAME"],-17) == '/ricoXMLquery.php' &&
+ !empty($_GET['id']) && substr($_GET['id'],0,5) == 'grid_') {
+ if (check_permissions(substr($_GET['id'],5)))
+ return true;
+ else
+ format_ajax(array('error' => 'No permission to access data'));
+ }
+
+ /* table connections */
+ if (substr($_SERVER["SCRIPT_FILENAME"],-25) == '/ricoUpdateConnection.php' &&
+ !empty($_GET['id']) && substr($_GET['id'],0,5) == 'grid_') {
+ if (check_permissions(substr($_GET['id'],5)))
+ return true;
+ else
+ format_ajax(array('error' => 'No permission to access data'));
+ }
+
+ /* ajax calls */
+ if (substr($_SERVER["SCRIPT_FILENAME"],-9) == '/ajax.php' &&
+ !empty($_POST['source'])) {
+ if (check_permissions($_POST['source']))
+ return true;
+ else
+ format_ajax(array('error' => 'No permission to access data'));
+ }
+
}
function sanitise_filename($file)
@@ -91,12 +158,7 @@ function process()
return mask($_GET['mask']);
}
- $masks = array('sys_user','sys_group','sys_mask',
- 'anbaugeraete','arbeitsarten','personal','materialien','gebiet','geraete',
- 'kostenstellen','materialverbrauch','einsatz');
- $ret = '';
- foreach ($masks as $m)
- $ret .= sprintf('%s
', $m, $m);
+ $ret = '