tyler.durden
/
pandorafms
mirror of https://github.com/pandorafms/pandorafms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch '1933-TMB-eventos-varios' into 'develop' 

Fixed permission checks in event_acl

See merge request artica/pandorafms!1303
This commit is contained in:
vgilc 2018-02-26 10:32:17 +01:00
parent 3f7e6f7ed3 49f1ad38e7
commit 2313c4165e
2 changed files with 18 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
pandora_console/include/functions_events.php
View File

@ -1981,6 +1981,11 @@ function events_get_response_target($event_id, $response_id, $server_id, $histor
$event_st = events_display_status($event['estado']);
$target = str_replace('_event_status_', $event_st["title"], $target);
}
if (strpos($target, '_group_custom_id_') !== false) {
$group_custom_id = db_get_value($dbh, "SELECT custom_id FROM tgrupo WHERE id_grupo=?", $event["id_grupo"]);
$event_st = events_display_status($event['estado']);
$target = str_replace('_group_custom_id_', $group_custom_id, $target);
}
// Parse the event custom data
if (!empty($event['custom_data'])){
$custom_data = json_decode (base64_decode ($event['custom_data']));

16
pandora_console/include/functions_tags.php
View File

@ -1481,10 +1481,20 @@ function tags_checks_event_acl($id_user, $id_group, $access, $tags = array(), $c
}
$group_ids = implode(',', $childrens_ids);
}
$tag_conds = "";
if(!empty($tags_str)) {
$tag_conds = " AND (tags IN ('$tags_str') OR tags = '') ";
}
else {
$tag_conds = " AND tags = '' ";
}
$sql = "SELECT id_usuario FROM tusuario_perfil
WHERE id_usuario = '".$config["id_user"]."' AND tags IN ('$tags_str')
AND id_perfil IN (SELECT id_perfil FROM tperfil WHERE ".get_acl_column($access)."=1)
AND id_grupo IN ($group_ids)";
WHERE id_usuario = '".$config["id_user"]."' $tag_conds
AND id_perfil IN (SELECT id_perfil FROM tperfil WHERE ".get_acl_column($access)."=1)
AND id_grupo IN ($group_ids)";
$has_perm = db_get_value_sql ($sql);
if ($has_perm) {