Netsyms/Mods-for-HESK-Netsyms
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Only allow users to modify permissions that they have access to

Browse Source
This commit is contained in:
Mike Koch 2018-02-11 22:00:44 -05:00
parent 48b28fc3cd
commit 35ed664dfd
No known key found for this signature in database
GPG Key ID: 9BA5D7F8391455ED
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
admin/manage_permission_groups.php
View File

@ -198,7 +198,7 @@ function createEditModal($template, $features, $categories)
$disabled = ' disabled'; $disabled = ' disabled';
}?> }?>
<?php if (in_array($category['id'], $_SESSION['categories']) || $checked): ?> <?php if ($_SESSION['isadmin'] || in_array($category['id'], $_SESSION['categories']) || $checked): ?>
<div class="checkbox"> <div class="checkbox">
<label> <label>
<input type="checkbox" name="categories[]" <input type="checkbox" name="categories[]"
@ -231,7 +231,7 @@ function createEditModal($template, $features, $categories)
$template['heskprivileges'] === 'ALL') { $template['heskprivileges'] === 'ALL') {
$disabled = ' disabled'; $disabled = ' disabled';
} }
if (strpos($_SESSION['heskprivileges'], $feature) !== false || $checked): ?> if ($_SESSION['isadmin'] || strpos($_SESSION['heskprivileges'], $feature) !== false || $checked): ?>
<div class="checkbox"> <div class="checkbox">
<label> <label>
<input type="checkbox" name="features[]" <input type="checkbox" name="features[]"
@ -299,7 +299,7 @@ function buildCreateModal($features, $categories)
<div class="form-group"> <div class="form-group">
<?php <?php
foreach ($categories as $category): foreach ($categories as $category):
if (in_array($category['id'], $_SESSION['categories']) || hesk_SESSION('isadmin')): ?> if (hesk_SESSION('isadmin') || in_array($category['id'], $_SESSION['categories'])): ?>
<div class="checkbox"> <div class="checkbox">
<label> <label>
<input type="checkbox" name="categories[]" <input type="checkbox" name="categories[]"
@ -396,7 +396,7 @@ function save()
} }
// Update features based on user visibility // Update features based on user visibility
$originalFeatures = explode(',', $row['features']); $originalFeatures = explode(',', $row['heskprivileges']);
$newFeatures = array(); $newFeatures = array();
foreach ($originalFeatures as $innerFeature) { foreach ($originalFeatures as $innerFeature) {
if (in_array($innerFeature, $featArray) && strpos($_SESSION['heskprivileges'], $innerFeature) !== false) { if (in_array($innerFeature, $featArray) && strpos($_SESSION['heskprivileges'], $innerFeature) !== false) {