dbxe/fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Improve code for access controls.

Browse Source
This commit is contained in:
markjcrane
2016-06-21 18:00:38 -06:00
parent 774dfd1053
commit f4765e954b
3 changed files with 89 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/access_controls/access_control_delete.php
+11 -7
View File
@@ -1,14 +1,18 @@
<?php <?php
require_once "root.php";
require_once "resources/require.php"; //includes
require_once "resources/check_auth.php"; require_once "root.php";
if (permission_exists('access_control_delete')) { require_once "resources/require.php";
//check permissions
require_once "resources/check_auth.php";
if (permission_exists('access_control_delete')) {
//access granted //access granted
} }
else { else {
echo "access denied"; echo "access denied";
exit; exit;
} }
//add multi-lingual support //add multi-lingual support
$language = new text; $language = new text;
app/access_controls/access_control_edit.php
+18 -14
View File
@@ -1,14 +1,18 @@
<?php <?php
require_once "root.php";
require_once "resources/require.php"; //includes
require_once "resources/check_auth.php"; require_once "root.php";
if (permission_exists('access_control_add') || permission_exists('access_control_edit')) { require_once "resources/require.php";
//check permissions
require_once "resources/check_auth.php";
if (permission_exists('access_control_add') || permission_exists('access_control_edit')) {
//access granted //access granted
} }
else { else {
echo "access denied"; echo "access denied";
exit; exit;
} }
//add multi-lingual support //add multi-lingual support
$language = new text; $language = new text;
@@ -75,8 +79,8 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
unset($sql); unset($sql);
remove_config_from_cache('configuration:acl.conf'); remove_config_from_cache('configuration:acl.conf');
$_SESSION['message'] = $text['message-add']; $_SESSION["message"] = $text['message-add'];
header('Location: access_controls.php'); header("Location: access_controls.php");
return; return;
} //if ($action == "add") } //if ($action == "add")
@@ -91,8 +95,8 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
unset($sql); unset($sql);
remove_config_from_cache('configuration:acl.conf'); remove_config_from_cache('configuration:acl.conf');
$_SESSION['message'] = $text['message-update']; $_SESSION["message"] = $text['message-update'];
header('Location: access_controls.php'); header("Location: access_controls.php");
return; return;
} //if ($action == "update") } //if ($action == "update")
@@ -120,8 +124,8 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
require_once "resources/header.php"; require_once "resources/header.php";
//show the content //show the content
echo "<form method='post' name='frm' action=''>\n"; echo "<form name='frm' id='frm' method='post' action=''>\n";
echo "<table width='100%' border='0' cellpadding='6' cellspacing='0'>\n"; echo "<table width='100%' border='0' cellpadding='0' cellspacing='0'>\n";
echo "<tr>\n"; echo "<tr>\n";
echo "<td align='left' width='30%' nowrap='nowrap' valign='top'><b>".$text['title-access_control']."</b><br><br></td>\n"; echo "<td align='left' width='30%' nowrap='nowrap' valign='top'><b>".$text['title-access_control']."</b><br><br></td>\n";
echo "<td width='70%' align='right' valign='top'>\n"; echo "<td width='70%' align='right' valign='top'>\n";
@@ -186,7 +190,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
echo " </tr>"; echo " </tr>";
echo "</table>"; echo "</table>";
echo "</form>"; echo "</form>";
echo "<br><br>"; echo "<br /><br />";
if ($action == "update") { if ($action == "update") {
require "access_control_nodes.php"; require "access_control_nodes.php";
app/access_controls/access_controls.php
+31 -27
View File
@@ -1,14 +1,18 @@
<?php <?php
require_once "root.php";
require_once "resources/require.php"; //includes
require_once "resources/check_auth.php"; require_once "root.php";
if (permission_exists('access_control_view')) { require_once "resources/require.php";
//check permissions
require_once "resources/check_auth.php";
if (permission_exists('access_control_view')) {
//access granted //access granted
} }
else { else {
echo "access denied"; echo "access denied";
exit; exit;
} }
//add multi-lingual support //add multi-lingual support
$language = new text; $language = new text;
@@ -22,20 +26,7 @@ else {
require_once "resources/header.php"; require_once "resources/header.php";
require_once "resources/paging.php"; require_once "resources/paging.php";
//show the content //prepare to page the results
echo "<table width='100%' border='0'>\n";
echo " <tr>\n";
echo " <td width='50%' align='left' nowrap='nowrap'><b>".$text['title-access_controls']."</b></td>\n";
echo " <td width='50%' align='right'>&nbsp;</td>\n";
echo " </tr>\n";
echo " <tr>\n";
echo " <td align='left' colspan='2'>\n";
echo " ".$text['description-access_control']."<br /><br />\n";
echo " </td>\n";
echo " </tr>\n";
echo "</table>\n";
//prepare to page the results
$sql = "select count(*) as num_rows from v_access_controls "; $sql = "select count(*) as num_rows from v_access_controls ";
if (strlen($order_by)> 0) { $sql .= "order by $order_by $order "; } if (strlen($order_by)> 0) { $sql .= "order by $order_by $order "; }
$prep_statement = $db->prepare($sql); $prep_statement = $db->prepare($sql);
@@ -50,7 +41,7 @@ else {
} }
} }
//prepare to page the results //prepare to page the results
$rows_per_page = ($_SESSION['domain']['paging']['numeric'] != '') ? $_SESSION['domain']['paging']['numeric'] : 50; $rows_per_page = ($_SESSION['domain']['paging']['numeric'] != '') ? $_SESSION['domain']['paging']['numeric'] : 50;
$param = ""; $param = "";
$page = $_GET['page']; $page = $_GET['page'];
@@ -58,20 +49,33 @@ else {
list($paging_controls, $rows_per_page, $var3) = paging($num_rows, $param, $rows_per_page); list($paging_controls, $rows_per_page, $var3) = paging($num_rows, $param, $rows_per_page);
$offset = $rows_per_page * $page; $offset = $rows_per_page * $page;
//get the list //get the list
$sql = "select * from v_access_controls "; $sql = "select * from v_access_controls ";
if (strlen($order_by)> 0) { $sql .= "order by $order_by $order "; } if (strlen($order_by)> 0) { $sql .= "order by $order_by $order "; }
$sql .= "limit $rows_per_page offset $offset "; $sql .= "limit $rows_per_page offset $offset ";
$prep_statement = $db->prepare(check_sql($sql)); $prep_statement = $db->prepare(check_sql($sql));
$prep_statement->execute(); $prep_statement->execute();
$result = $prep_statement->fetchAll(PDO::FETCH_NAMED); $result = $prep_statement->fetchAll(PDO::FETCH_NAMED);
$result_count = count($result);
unset ($prep_statement, $sql); unset ($prep_statement, $sql);
//alternate the row style
$c = 0; $c = 0;
$row_style["0"] = "row_style0"; $row_style["0"] = "row_style0";
$row_style["1"] = "row_style1"; $row_style["1"] = "row_style1";
//show the content
echo "<table width='100%' border='0'>\n";
echo " <tr>\n";
echo " <td width='50%' align='left' nowrap='nowrap'><b>".$text['title-access_controls']."</b></td>\n";
echo " <td width='50%' align='right'>&nbsp;</td>\n";
echo " </tr>\n";
echo " <tr>\n";
echo " <td align='left' colspan='2'>\n";
echo " ".$text['description-access_control']."<br /><br />\n";
echo " </td>\n";
echo " </tr>\n";
echo "</table>\n";
echo "<table class='tr_hover' width='100%' border='0' cellpadding='0' cellspacing='0'>\n"; echo "<table class='tr_hover' width='100%' border='0' cellpadding='0' cellspacing='0'>\n";
echo "<tr>\n"; echo "<tr>\n";
echo th_order_by('access_control_name', $text['label-access_control_name'], $order_by, $order); echo th_order_by('access_control_name', $text['label-access_control_name'], $order_by, $order);
@@ -87,7 +91,7 @@ else {
echo "</td>\n"; echo "</td>\n";
echo "<tr>\n"; echo "<tr>\n";
if ($result_count > 0) { if (is_array($result)) {
foreach($result as $row) { foreach($result as $row) {
if (permission_exists('access_control_edit')) { if (permission_exists('access_control_edit')) {
$tr_link = "href='access_control_edit.php?id=".$row['access_control_uuid']."'"; $tr_link = "href='access_control_edit.php?id=".$row['access_control_uuid']."'";
@@ -125,8 +129,7 @@ else {
} }
echo " </td>\n"; echo " </td>\n";
echo " </tr>\n"; echo " </tr>\n";
echo "</table>\n"; echo " </table>\n";
echo "</td>\n"; echo "</td>\n";
echo "</tr>\n"; echo "</tr>\n";
echo "</table>"; echo "</table>";
@@ -134,4 +137,5 @@ else {
//include the footer //include the footer
require_once "resources/footer.php"; require_once "resources/footer.php";
?> ?>