diff --git a/phpBB/admin/admin_userauth.php b/phpBB/admin/admin_userauth.php
index ed2f33c26c..faa78d8384 100644
--- a/phpBB/admin/admin_userauth.php
+++ b/phpBB/admin/admin_userauth.php
@@ -22,13 +22,18 @@ $auth_field_match = array(
"auth_edit" => AUTH_EDIT,
"auth_delete" => AUTH_DELETE,
"auth_sticky" => AUTH_STICKY,
- "auth_announce" => AUTH_ANNOUNCE,
+ "auth_announce" => AUTH_ANNOUNCE);
+/* ,
"auth_vote" => AUTH_VOTE,
"auth_votecreate" => AUTH_VOTECREATE,
- "auth_attachments" => AUTH_ATTACH
-);
-$forum_auth_fields = array("auth_view", "auth_read", "auth_post", "auth_reply", "auth_edit", "auth_delete", "auth_sticky", "auth_announce", "auth_votecreate", "auth_vote", "auth_attachments");
+ "auth_attachments" => AUTH_ATTACH,
+ "auth_allow_html" => AUTH_ALLOW_HTML
+ "auth_allow_bbcode" => AUTH_ALLOW_BBCODE
+ "auth_allow_smilies" => AUTH_ALLOW_SMILIES
+);*/
+$forum_auth_fields = array("auth_view", "auth_read", "auth_post", "auth_reply", "auth_edit", "auth_delete", "auth_sticky", "auth_announce");
+//, "auth_votecreate", "auth_vote", "auth_attachments", "auth_allow_html", "auth_allow_bbcode", "auth_allow_smilies"
$forum_auth_key_fields = array("auth_view", "auth_read", "auth_post", "auth_reply");
// ----------
@@ -86,90 +91,89 @@ if(isset($HTTP_POST_VARS['submit']) && !empty($HTTP_POST_VARS[POST_USERS_URL]))
//
// This is where things become fun ...
//
- // We have to do a pile of cross-checking
- // to ensure what the admin has requested
- // for a user doesn't conflict with
- // permissions already assigned. If they
- // do we warn the admin and give them
- // options ... where possible
- //
//
// Get group_id for this user_id
//
- $sql_groupid = "SELECT group_id
- FROM " . USER_GROUP_TABLE . "
- WHERE user_id = $user_id";
+ $sql_groupid = "SELECT ug.group_id, u.user_level
+ FROM " . USER_GROUP_TABLE . " ug, " . USERS_TABLE . " u
+ WHERE u.user_id = $user_id
+ AND ug.user_id = u.user_id";
if(!$result = $db->sql_query($sql_groupid))
{
// Error no such user/group
}
- list($group_id) = $db->sql_fetchrow($result);
+ $ug_info = $db->sql_fetchrow($result);
//
// Carry out requests
//
- if( !$HTTP_POST_VARS['makeadmin'] && $HTTP_POST_VARS['curadmin'] )
+ if( $HTTP_POST_VARS['userlevel'] == "user" && $ug_info['user_level'] == ADMIN)
{
+ //
+ // Make admin a user (if already admin)
+ //
+
//
// Delete any entries granting in auth_access
//
- $sql_unmod = "DELETE FROM " . AUTH_ACCESS_TABLE . "
- WHERE group_id = $group_id";
- if(!$result = $db->sql_query($sql_unmod))
+ $sql = "UPDATE " . AUTH_ACCESS_TABLE . "
+ SET auth_view = 0, auth_read = 0, auth_post = 0, auth_reply = 0, auth_edit = 0, auth_delete = 0, auth_sticky = 0, auth_announce = 0
+ WHERE group_id = " . $ug_info['group_id'];
+ if(!$result = $db->sql_query($sql))
{
- // Error, couldn't delete entries
+ // Error ...
}
//
// Update users level, reset to USER
//
- $sql_userlevel = "UPDATE " . USERS_TABLE . "
+ $sql = "UPDATE " . USERS_TABLE . "
SET user_level = " . USER . "
WHERE user_id = $user_id";
- if(!$result = $db->sql_query($sql_userlevel))
+ if(!$result = $db->sql_query($sql))
{
- // Error, couldn't set user level
+ // Error ...
}
- header("Location: userauth.$phpEx?" . POST_USERS_URL . "=$user_id");
+ header("Location: admin_userauth.$phpEx?" . POST_USERS_URL . "=$user_id");
}
- else if( $HTTP_POST_VARS['makeadmin'] && !$HTTP_POST_VARS['curadmin'] )
+ else if( $HTTP_POST_VARS['userlevel'] == "admin" && $ug_info['user_level'] != ADMIN )
{
+
//
- // Switch user_level to ADMIN
+ // Make user an admin (if already user)
//
$sql_userlevel = "UPDATE " . USERS_TABLE . "
SET user_level = " . ADMIN . "
WHERE user_id = $user_id";
if(!$result = $db->sql_query($sql_userlevel))
{
- // Error, couldn't set user level
+ // Error ...
}
- // This needs changing -> Remove the
- // user from auth_access where special
- // access permissions are granted but leave
- // moderator status
- //
- // ---------------------------------------
// Delete any entries in auth_access, they
// are unrequired if user is becoming an
// admin
//
+ $sql_unmod = "UPDATE " . AUTH_ACCESS_TABLE . "
+ SET auth_view = 0, auth_read = 0, auth_post = 0, auth_reply = 0, auth_edit = 0, auth_delete = 0, auth_sticky = 0, auth_announce = 0
+ WHERE group_id = " . $ug_info['group_id'];
+ if(!$result = $db->sql_query($sql_unmod))
+ {
+ // Error ...
+ }
+
$sql_unauth = "DELETE FROM " . AUTH_ACCESS_TABLE . "
- WHERE aa.group_id = $group_id";
+ WHERE group_id = $group_id
+ AND auth_mod = 0";
if(!$result = $db->sql_query($sql_unauth))
{
- // Error, couldn't delete entries
+ // Error ...
}
- //
- //
- // ----------------------------------------
-
- header("Location: userauth.$phpEx?" . POST_USERS_URL . "=$user_id");
+ header("Location: admin_userauth.$phpEx?" . POST_USERS_URL . "=$user_id");
}
else
@@ -179,23 +183,29 @@ if(isset($HTTP_POST_VARS['submit']) && !empty($HTTP_POST_VARS[POST_USERS_URL]))
$change_prv_ary = (isset($HTTP_POST_VARS['private'])) ? $HTTP_POST_VARS['private'] : 0;
//
- // Pull all the group info
+ // Pull all the auth/group
// for this user
//
- $sql = "SELECT aa.forum_id, aa.auth_view, aa.auth_read, aa.auth_post, aa.auth_reply, aa.auth_edit, aa.auth_delete, aa.auth_votecreate, aa.auth_vote, aa.auth_attachments, aa.auth_mod, g.group_single_user
+ $sql = "SELECT aa.forum_id, aa.auth_view, aa.auth_read, aa.auth_post, aa.auth_reply, aa.auth_edit, aa.auth_delete, aa.auth_sticky, aa.auth_announce, aa.auth_mod, g.group_single_user
FROM " . AUTH_ACCESS_TABLE . " aa, " . USER_GROUP_TABLE . " ug, " . GROUPS_TABLE. " g
WHERE ug.user_id = $user_id
AND g.group_id = ug.group_id
- AND aa.group_id = ug.group_id
- AND g.group_single_user <> " . TRUE;
+ AND aa.group_id = ug.group_id";
$au_result = $db->sql_query($sql);
- $num_u_access = $db->sql_numrows($au_result);
- if($num_u_access)
+ if($num_u_access = $db->sql_numrows($au_result))
{
$u_access = $db->sql_fetchrowset($au_result);
}
+ $sql = "SELECT f.forum_id, f.auth_view, f.auth_read, f.auth_post, f.auth_reply, f.auth_edit, f.auth_delete, f.auth_sticky, f.auth_announce
+ FROM " . FORUMS_TABLE . " f, " . CATEGORIES_TABLE . " c
+ WHERE c.cat_id = f.cat_id
+ ORDER BY c.cat_order ASC, f.forum_order ASC";
+ $fa_result = $db->sql_query($sql);
+
+ $forum_access = $db->sql_fetchrowset($fa_result);
+
//
// The data above lists access and moderator permissions
// for this user given by all the groups they belong to.
@@ -211,73 +221,214 @@ if(isset($HTTP_POST_VARS['submit']) && !empty($HTTP_POST_VARS[POST_USERS_URL]))
//
//
- // Check against moderator table ...
+ //
//
- $valid_auth_mod_chg = array();
+ $warning_mod = array();
+ $valid_auth_mod = array();
+ $valid_auth_mod_sql = array();
+
reset($change_mod_ary);
+
while(list($chg_forum_id, $value) = each($change_mod_ary))
{
$a_match = $value;
+
+ $auth_exists = FALSE;
+
for($i = 0; $i < count($u_access); $i++)
{
$forum_id = $u_access[$i]['forum_id'];
- if($forum_id == $chg_forum_id && $u_access[$i]['auth_mod'] == 1)
+ if( $forum_id == $chg_forum_id )
{
- $a_match = 0;
+
+ if( $u_access[$i]['auth_mod'] == $value && $u_access[$i]['group_single_user'] )
+ {
+ $a_match = -1;
+ }
+ else if( $u_access[$i]['auth_mod'] && !$value && !$u_access[$i]['group_single_user'] )
+ {
+ //
+ // User is being removed as a moderator but is a moderator
+ // via a group, carry out the update but warn the moderator
+ //
+ $warning_mod[$chg_forum_id] = TRUE;
+ }
+ else
+ {
+ if(!$value)
+ {
+ $sql = "DELETE FROM " . AUTH_ACCESS_TABLE;
+ }
+ else
+ {
+ $sql = "UPDATE " . AUTH_ACCESS_TABLE . "
+ SET auth_view = 0, auth_read = 0, auth_post = 0, auth_reply = 0, auth_edit = 0, auth_delete = 0, auth_sticky = 0, auth_announce = 0, auth_mod = " . TRUE;
+ }
+ $valid_auth_mod_sql[$chg_forum_id] = $sql . " WHERE forum_id = $chg_forum_id AND group_id = " . $ug_info['group_id'];
+ $valid_auth_mod[$chg_forum_id] = 1;
+ }
+
+ $auth_exists = TRUE;
}
}
-
- $valid_auth_mod_chg[$chg_forum_id] = $a_match;
-
+
+ if(!$auth_exists && $value)
+ {
+ $valid_auth_mod_sql[$chg_forum_id] = "INSERT INTO " . AUTH_ACCESS_TABLE . " (forum_id, group_id, auth_mod) VALUES ($chg_forum_id, " . $ug_info['group_id'] . ", 1)";
+ $valid_auth_mod[$chg_forum_id] = 0;
+ }
}
- //
- // valid_auth_mod_chg now contains an array (key is forum_id)
- // where the value is 1 if the user should be an admin and 0
- // where the user is prevented (either by the admin disallowing
- // or the user belonging to a group which already moderates)
- //
- print_r($valid_auth_mod_chg);
- echo "
";
//
- // Check against priv access table ...
+ // Check against priv access table ...
//
- $valid_auth_prv_chg = array();
+ $warning_mod = array();
+ $valid_auth_acl_sql = array();
+
+ reset($valid_auth_mod);
reset($change_prv_ary);
+
while(list($chg_forum_id, $value) = each($change_prv_ary))
{
- $a_match = $value;
+ $valid_auth_acl_sql[$chg_forum_id] = "";
+ $auth_exists = FALSE;
+
for($i = 0; $i < count($u_access); $i++)
{
- $forum_id = $u_access[$i]['forum_id'];
-
- if($forum_id == $chg_forum_id)
+ if( $u_access[$i]['forum_id'] == $chg_forum_id )
{
- for($k = 0; $k < count($forum_auth_key_fields); $k++)
+
+ //
+ // If we're updating/inserting a moderator access
+ // control then we don't need to both with anything here,
+ // adding (or updating) a user to mod status automatically
+ // grants access to all forum functions (unless they
+ // are set at admin status!). Removing moderator permissions
+ // automatically removes all priviledges, it does mean the
+ // admin has to re-enable ACL privs but it does prevent
+ // them accidently leaving a user with access to a forum
+ // they should be now denied.
+ //
+// echo " " . $chg_forum_id . " : " . $valid_auth_mod[$chg_forum_id] . " ";
+
+// echo $chg_forum_id . " : " . $valid_auth_mod[$chg_forum_id] . " : " . $u_access[$i]['auth_mod'] . " ";
+
+ if( empty($valid_auth_mod[$chg_forum_id]) && !$u_access[$i]['auth_mod'])
{
- $a_match = $a_match && $u_access[$i][$forum_auth_key_fields[$k]];
+ //
+ // User isn't a moderator so now we have to decide whether the
+ // the access needs creating, updating or deleting ...
+ //
+
+ for($j = 0; $j < count($forum_access); $j++)
+ {
+ if( $chg_forum_id == $forum_access[$j]['forum_id'] )
+ {
+ $update_acl_sql = "";
+
+ for($k = 0; $k < count($forum_auth_fields); $k++)
+ {
+ $auth_field = $forum_auth_fields[$k];
+
+ if( $forum_access[$j][$auth_field] == AUTH_ACL )
+ {
+
+ if( $u_access[$i][$auth_field] && !$value && !$u_access[$i]['group_single_user'] )
+ {
+
+ //
+ // User is having ACL access removed from this field
+ // but retains access via a group they belong too,
+ // carry out the update but warn the moderator
+ //
+
+ $warning_acl[$chg_forum_id][$auth_field] = TRUE;
+ }
+ else if( $u_access[$i][$auth_field] != $value && $u_access[$i]['group_single_user'] )
+ {
+ $update_acl_sql .= ($update_acl_sql != "") ? ", $auth_field = $value" : "$auth_field = $value";
+ }
+ }
+ }
+
+ $valid_auth_acl_sql[$chg_forum_id] = "UPDATE " . AUTH_ACCESS_TABLE . " SET " . $update_acl_sql ." WHERE forum_id = $chg_forum_id AND group_id = " . $ug_info['group_id'];
+
+ } // forum_id = forum_access
+
+ } // for ... forum_access
+
+ } // not_mod
+
+ $auth_exists = TRUE;
+
+ } // if forum ... chg_forum
+
+ } // for ... u_access
+
+ if($valid_auth_acl_sql[$chg_forum_id] == "" && !$auth_exists)
+ {
+ for($j = 0; $j < count($forum_access); $j++)
+ {
+ if( $chg_forum_id == $forum_access[$j]['forum_id'] && $value)
+ {
+ $valid_auth_acl_sql_val = "";
+ $valid_auth_acl_sql_fld = "";
+
+ for($k = 0; $k < count($forum_auth_fields); $k++)
+ {
+ $auth_field = $forum_auth_fields[$k];
+
+ if( $forum_access[$j][$auth_field] == AUTH_ACL )
+ {
+ $valid_auth_acl_sql_fld .= ($valid_auth_acl_sql_fld != "") ? ", $auth_field" : "$auth_field";
+ $valid_auth_acl_sql_val .= ($valid_auth_acl_sql_val != "") ? ", $value" : "$value";
+ }
+ }
+
+ $valid_auth_acl_sql[$chg_forum_id] = "INSERT INTO " . AUTH_ACCESS_TABLE . " (forum_id, group_id, $valid_auth_acl_sql_fld) VALUES ($chg_forum_id, " . $ug_info['group_id'] . ", $valid_auth_acl_sql_val)";
}
}
}
-
- $valid_auth_prv_chg[$chg_forum_id] = $a_match;
-
}
+
+// print_r($valid_auth_acl_sql);
+// echo "
";
+
//
- // valid_auth_mod_chg now contains an array (key is forum_id)
- // where the value is 1 if the user should be an admin and 0
- // where the user is prevented (either by the admin disallowing
- // or the user belonging to a group which already moderates)
+ // The next part requires that we know whether we're
+ // updating an existing entry, inserting a new one or
+ // deleting an existing entry ... as well as what we're
+ // updating and with what value ...
//
+
+ //
+ // Checks complete, make updates
+ //
+ while(list($chg_forum_id, $sql) = each($valid_auth_mod_sql))
+ {
+ if( !empty($sql) )
+ {
+ if(!$result = $db->sql_query($sql))
+ {
+ // Error ...
+ }
+ }
+ }
- print_r($valid_auth_prv_chg);
- echo "