Changeset 170 for trunk/phpbms/loadsearch.php

Timestamp:

11/10/06 19:49:30 (6 years ago)

Author:

brieb

Message:

Implements #20. Needs heavy testing on install/update and trying different security options.

Files:

• trunk/phpbms/loadsearch.php (modified) (4 diffs)

trunk/phpbms/loadsearch.php

@@ -38 +38 @@
 */
         require("include/session.php");
+        require("include/common_functions.php");
         
         function deleteSearch($id){
@@ -108 +109 @@
         }//end function
 
-        function showLoad($tabledefid,$basepath,$userid,$accesslevel){
+        function showLoad($tabledefid,$basepath,$userid,$securitywhere){
                 global $dblink;
                 
                 $querystatement="SELECT id,name,userid FROM usersearches 
-                                                WHERE tabledefid=".$tabledefid." AND type=\"SCH\" AND ((userid=0 and accesslevel<=".$accesslevel.") OR userid=\"".$userid."\") ORDER BY userid, name";
+                                                WHERE tabledefid=".$tabledefid." AND type=\"SCH\" AND ((userid=0 ".$securitywhere.") OR userid=\"".$userid."\") ORDER BY userid, name";
                 $queryresult = mysql_query($querystatement,$dblink);
                 if(!$queryresult) reportError(500,"Cannot retrieve saved search infromation");
                 
+
+                $querystatement="SELECT advsearchroleid FROM tabledefs WHERE id=".$tabledefid ;
+                $tabledefresult = mysql_query($querystatement,$dblink);
+                if(!$tabledefresult) reportError(500,"Cannot retrieve table definition information.");
+                $tableinfo=mysql_fetch_array($tabledefresult);
                 
                 ?>
@@ -132 +138 @@
                                         </p>
                                         <p>
-                                                <textarea id="LSSQL" rows="8" cols="10" <?php if($_SESSION["userinfo"]["accesslevel"]<30) echo " readonly=\"readonly\""?>></textarea>
+                                                <textarea id="LSSQL" rows="8" cols="10" <?php if(!hasRights($tableinfo["advsearchroleid"])) echo " readonly=\"readonly\""?>></textarea>
                                         </p>
                                 </td>
@@ -148 +154 @@
                 switch($_GET["cmd"]){
                         case "show":
-                                showLoad($_GET["tid"],$_GET["base"],$_SESSION["userinfo"]["id"],$_SESSION["userinfo"]["accesslevel"]);
+                                $securitywhere="";
+                                if ($_SESSION["userinfo"]["admin"]!=1 && count($_SESSION["userinfo"]["roles"])>0)
+                                        $securitywhere=" AND roleid IN (".implode(",",$_SESSION["userinfo"]["roles"]).",0)";                    
+                                showLoad($_GET["tid"],$_GET["base"],$_SESSION["userinfo"]["id"],$securitywhere);
                         break;
                         case "getsearch":