dbxe/fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add permissions for every table (view, add, edit, and delete). Important change to increase security on the REST API and will be beneficial for more detailed control of permissions.

Browse Source
This commit is contained in:
Mark Crane
2013-09-25 20:23:10 +00:00
parent 99f6238790
commit 7ba40f465e
27 changed files with 816 additions and 331 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/vars/vars_textarea.php
+5 -5
View File
@@ -26,7 +26,7 @@
include "root.php";
require_once "resources/require.php";
require_once "resources/check_auth.php";
if (permission_exists('variable_view')) {
if (permission_exists('var_view')) {
//access granted
}
else {
@@ -45,7 +45,7 @@ else {
$page["title"] = $text['title-variables_advanced'];
//restore the default vars.xml
if ($_GET['a'] == "default" && permission_exists('variable_edit')) {
if ($_GET['a'] == "default" && permission_exists('var_edit')) {
//read default config file
$fd = fopen($_SESSION['switch']['conf']['dir'].".orig/vars.xml", "r");
$v_content = fread($fd, filesize($_SESSION['switch']['conf']['dir'].".orig/vars.xml"));
@@ -59,7 +59,7 @@ if ($_GET['a'] == "default" && permission_exists('variable_edit')) {
}
//save the vars.xml
if ($_POST['a'] == "save" && permission_exists('variable_edit')) {
if ($_POST['a'] == "save" && permission_exists('var_edit')) {
$v_content = str_replace("\r","",$_POST['code']);
$fd = fopen($_SESSION['switch']['conf']['dir']."/vars.xml", "w");
fwrite($fd, $v_content);
@@ -107,7 +107,7 @@ if ($_GET['a'] == "default" && permission_exists('variable_edit')) {
<br /><br />
</td>
<td align='right' valign='top'>
<?php if (permission_exists('variable_edit')) { ?>
<?php if (permission_exists('var_edit')) { ?>
<input type="submit" class='btn' value="<?=$text['button-save']?>" />
<?php } ?>
</td>
@@ -133,7 +133,7 @@ if ($_GET['a'] == "default" && permission_exists('variable_edit')) {
<input type="hidden" name="f" value="<?php echo $_GET['f']; ?>" />
<input type="hidden" name="a" value="save" />
<?php
if (permission_exists('variable_edit')) {
if (permission_exists('var_edit')) {
echo "<input type='button' class='btn' value='".$text['button-restore']."' onclick=\"document.location.href='vars.php?a=default&f=vars.xml';\" />";
}
?>