diff --git a/pandora_console/godmode/reporting/graph_builder.php b/pandora_console/godmode/reporting/graph_builder.php index ac342f3a13..317f562e6f 100644 --- a/pandora_console/godmode/reporting/graph_builder.php +++ b/pandora_console/godmode/reporting/graph_builder.php @@ -65,6 +65,17 @@ $change_weight = (bool) get_parameter('change_weight', false); $change_label = (bool) get_parameter('change_label', false); $id_graph = (int) get_parameter('id', 0); +if($id_graph !== 0){ + $sql = "SELECT * FROM tgraph + WHERE (private = 0 OR (private = 1 AND id_user = '".$config["id_user"]."')) + AND id_graph = ".$id_graph; + $control = db_process_sql($sql); + if(!$control){ + header('Location: index.php?sec=reporting&sec2=godmode/reporting/graphs'); + } +} + + if ($add_graph) { $name = get_parameter_post ("name"); $description = get_parameter_post ("description"); diff --git a/pandora_console/operation/reporting/graph_viewer.php b/pandora_console/operation/reporting/graph_viewer.php index 03c130bfc7..2840a1e806 100644 --- a/pandora_console/operation/reporting/graph_viewer.php +++ b/pandora_console/operation/reporting/graph_viewer.php @@ -25,6 +25,16 @@ $delete_graph = (bool) get_parameter ('delete_graph'); $view_graph = (bool) get_parameter ('view_graph'); $id_graph = (int) get_parameter ('id'); +if($id_graph !== 0){ + $sql = "SELECT * FROM tgraph + WHERE (private = 0 OR (private = 1 AND id_user = '".$config["id_user"]."')) + AND id_graph = ".$id_graph; + $control = db_process_sql($sql); + if(!$control){ + header('Location: index.php?sec=reporting&sec2=godmode/reporting/graphs'); + } +} + // Delete module SQL code if ($delete_graph) { if (check_acl ($config['id_user'], 0, "AW")) {