admins with default ACL "deny" are no longer allowed to change their default ACL

[mailer.git] / inc / libs / admins_functions.php

diff --git a/inc/libs/admins_functions.php b/inc/libs/admins_functions.php
index b168a75d4730c25bb748c25eaac413fcbfb5c0ac..d4ced65b01a0e87bb6b2b575251a1fec9b6dc33f 100644 (file)
--- a/inc/libs/admins_functions.php
+++ b/inc/libs/admins_functions.php
@@ -40,7 +40,7 @@ if (ereg(basename(__FILE__), $_SERVER['PHP_SELF']))
 
 // Check ACL for menu combination
 function ADMINS_CHECK_ACL($act, $wht) {
-       global $ADMINS, $ADMINS_ACLS, $_CONFIG, $CACHE;
+       global $cacheArray, $_CONFIG, $cacheInstance;
        // If action is login or logout allow allways!
        $default = "allow";
        if (($act == "login") || ($act == "logout")) return true;
@@ -49,13 +49,13 @@ function ADMINS_CHECK_ACL($act, $wht) {
        $ret = false;
 
        // Get admin's defult access right
-       if (!empty($ADMINS['def_acl'][$_SESSION['admin_login']])) {
+       if (!empty($cacheArray['admins']['def_acl'][$_SESSION['admin_login']])) {
                // Load from cache
-               $default = $ADMINS['def_acl'][$_SESSION['admin_login']];
+               $default = $cacheArray['admins']['def_acl'][$_SESSION['admin_login']];
 
                // Count cache hits
                $_CONFIG['cache_hits']++;
-       } elseif (!is_object($CACHE)) {
+       } elseif (!is_object($cacheInstance)) {
                // Load from database
                $result = SQL_QUERY_ESC("SELECT default_acl FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1",
                 array($_SESSION['admin_login']), __FILE__, __LINE__);
@@ -82,19 +82,19 @@ function ADMINS_CHECK_ACL($act, $wht) {
        $lines = 0; $acl_mode = "failed";
        if (GET_EXT_VERSION("cache") >= "0.1.2") {
                // Load only from array when there are lines!
-               if (count($ADMINS_ACLS) > 0) {
+               if ((isset($cacheArray['admin_acls'])) && (is_array($cacheArray['admin_acls'])) && (count($cacheArray['admin_acls']) > 0)) {
                        // Load ACL from array
-                       foreach ($ADMINS_ACLS['admin_id'] as $id=>$aid_acls) {
+                       foreach ($cacheArray['admin_acls']['admin_id'] as $id=>$aid_acls) {
                                if ($aid == $aid_acls) {
                                        // Okay, one line was found!
-                                       if ((!empty($act)) && ($ADMINS_ACLS['action_menu'][$id] == $act)) {
+                                       if ((!empty($act)) && ($cacheArray['admin_acls']['action_menu'][$id] == $act)) {
                                                // Main menu line found
-                                               $acl_mode = $ADMINS_ACLS['access_mode'][$id];
+                                               $acl_mode = $cacheArray['admin_acls']['access_mode'][$id];
                                                $lines = 1;
                                        }
-                                        elseif ((!empty($wht)) && ($ADMINS_ACLS['what_menu'][$id] == $wht)) {
+                                        elseif ((!empty($wht)) && ($cacheArray['admin_acls']['what_menu'][$id] == $wht)) {
                                                // Check sub menu
-                                               $acl_mode = $ADMINS_ACLS['access_mode'][$id];
+                                               $acl_mode = $cacheArray['admin_acls']['access_mode'][$id];
                                                $lines = 1;
                                        }
                                        if ($lines == 1) {
@@ -175,10 +175,10 @@ WHERE email='%s'".$locked." LIMIT 1",
 
 // Change a lot admin account
 function ADMINS_CHANGE_ADMIN_ACCOUNT($POST) {
-       global $CACHE;
+       global $cacheInstance;
 
        // Begin the update
-       $CACHE_UPDATE = "0";
+       $cacheInstance_UPDATE = "0";
        foreach ($POST['login'] as $id=>$login) {
                // Secure ID number
                $id = bigintval($id);
@@ -186,7 +186,7 @@ function ADMINS_CHANGE_ADMIN_ACCOUNT($POST) {
                // When both passwords match update admin account
                if ($POST['pass1'][$id] == $POST['pass2'][$id]) {
                        // Save only when both passwords are the same (also when they are empty)
-                       $ADD = ""; $CACHE_UPDATE = "1";
+                       $ADD = ""; $cacheInstance_UPDATE = "1";
 
                        // Generate hash
                        $hash = generateHash($POST['pass1'][$id]);
@@ -200,9 +200,6 @@ function ADMINS_CHANGE_ADMIN_ACCOUNT($POST) {
 
                        // Rewrite cookie when it's own account
                        if ($aid == $id) {
-                               // Timeout
-                               $TIMEOUT = time() + bigintval($_SESSION['admin_to']);
-
                                // Set timeout cookie
                                set_session("admin_last", time());
 
@@ -219,8 +216,18 @@ function ADMINS_CHANGE_ADMIN_ACCOUNT($POST) {
 
                        }
 
+                       // Get default ACL from admin to check if we can allow him to change the default ACL
+                       $result = SQL_QUERY_ESC("SELECT default_acl FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1",
+                        array($_SESSION['admin_login']), __FILE__, __LINE__);
+                       list($default) = SQL_FETCHROW($result);
+
+                       // Free result
+                       SQL_FREERESULT($result);
+
                        // Update admin account
-                       $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET
+                       if ($default == "allow") {
+                               // Allow changing default ACL
+                               $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET
 login='%s'".$ADD.",
 email='%s',
 default_acl='%s',
@@ -233,6 +240,20 @@ WHERE id=%d LIMIT 1",
        $POST['la_mode'][$id],
        $id
 ), __FILE__, __LINE__);
+                       } else {
+                               // Do not allow it here
+                               $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET
+login='%s'".$ADD.",
+email='%s',
+la_mode='%s'
+WHERE id=%d LIMIT 1",
+ array(
+       $login,
+       $POST['email'][$id],
+       $POST['la_mode'][$id],
+       $id
+), __FILE__, __LINE__);
+                       }
 
                        // Admin account saved
                        $MSG = ADMIN_ACCOUNT_SAVED;
@@ -248,8 +269,8 @@ WHERE id=%d LIMIT 1",
        }
 
        // Remove cache file
-       if ((EXT_IS_ACTIVE("cache")) && ($CACHE_UPDATE == "1")) {
-               if ($CACHE->cache_file("admins", true)) $CACHE->cache_destroy();
+       if ((EXT_IS_ACTIVE("cache")) && ($cacheInstance_UPDATE == "1")) {
+               if ($cacheInstance->cache_file("admins", true)) $cacheInstance->cache_destroy();
        }
 }
 
@@ -272,7 +293,15 @@ function ADMINS_EDIT_ADMIN_ACCOUNTS ($POST) {
                        // Prepare some more data for the template
                        $content['sw']          = $SW;
                        $content['id']          = $id;
-                       $content['mode']    = ADD_OPTION_LINES("/ARRAY/", array("allow", "deny"), array(ADMINS_ALLOW_MODE, ADMINS_DENY_MODE), $content['mode']);
+
+                       // Shall we allow changing default ACL?
+                       if ($content['mode'] == "allow") {
+                               // Allow chaning it
+                               $content['mode']    = ADD_OPTION_LINES("/ARRAY/", array("allow", "deny"), array(ADMINS_ALLOW_MODE, ADMINS_DENY_MODE), $content['mode']);
+                       } else {
+                               // Don't allow it
+                               $content['mode'] = " ";
+                       }
                        $content['la_mode'] = ADD_OPTION_LINES("/ARRAY/", array("global", "OLD", "NEW"), array(ADMINS_GLOBAL_LA_SETTING, ADMINS_OLD_LA_SETTING, ADMINS_NEW_LA_SETTING), $content['la_mode']);
 
                        // Load row template and switch color
@@ -333,7 +362,7 @@ function ADMINS_DELETE_ADMIN_ACCOUNTS ($POST) {
 // Remove the given accounts
 function ADMINS_REMOVE_ADMIN_ACCOUNTS ($POST) {
        // Begin removal
-       $CACHE_UPDATE = "0";
+       $cacheInstance_UPDATE = "0";
        foreach ($POST['sel'] as $id=>$del) {
                // Secure ID number
                $id = bigintval($id);
@@ -348,13 +377,13 @@ function ADMINS_REMOVE_ADMIN_ACCOUNTS ($POST) {
                        $result = SQL_QUERY_ESC("DELETE LOW_PRIORITY FROM "._MYSQL_PREFIX."_admins WHERE id=%d LIMIT 1",
                         array($id), __FILE__, __LINE__);
 
-                       $CACHE_UPDATE = "1";
+                       $cacheInstance_UPDATE = "1";
                }
        }
 
        // Remove cache if cache system is activated
-       if ((EXT_IS_ACTIVE("cache")) && ($CACHE_UPDATE == "1")) {
-               if ($CACHE->cache_file("admins", true)) $CACHE->cache_destroy();
+       if ((EXT_IS_ACTIVE("cache")) && ($cacheInstance_UPDATE == "1")) {
+               if ($cacheInstance->cache_file("admins", true)) $cacheInstance->cache_destroy();
        }
 }