From b8e265bfd41bb292dc7d92fe8fa14602697a4380 Mon Sep 17 00:00:00 2001 From: x2003bruneau Date: Sat, 9 Dec 2006 19:16:05 +0000 Subject: [PATCH] #594: Group admins can temporarily try the site without privileges git-svn-id: svn+ssh://murphy/home/svn/platal/trunk@1264 839d8a87-29fc-0310-9880-83ba4fa771e5 --- ChangeLog | 1 + include/xnet/page.inc.php | 5 ---- include/xnet/session.inc.php | 68 +++++++++++++++++++++++++++++++++++--------- modules/xnet.php | 10 ++----- modules/xnetgrp.php | 29 +++++++++++++++++++ 5 files changed, 88 insertions(+), 25 deletions(-) diff --git a/ChangeLog b/ChangeLog index 56912f0..286ad0b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -44,6 +44,7 @@ Bug/Wish: - #570: Fix geoloc skin. -FRU - #589: Can attach a file when sending an email -FRU - #592: Can unsubscribe -FRU + - #594: Group admins can view the site without privileges -FRU From 0.9.12 branch: diff --git a/include/xnet/page.inc.php b/include/xnet/page.inc.php index b52d7fc..3341f9c 100644 --- a/include/xnet/page.inc.php +++ b/include/xnet/page.inc.php @@ -133,11 +133,6 @@ function list_all_my_groups($params) INNER JOIN groupex.membres AS m ON m.asso_id = a.id WHERE m.uid={?}", S::v('uid')); $links = 'déconnexion'; - if (S::has('suid')) { - $links = 'reprendre les droits d\'admin'; - } elseif (S::has_perms()) { - $links = 'perdre les droits d\'admin|' . $links; - } $html = '
Mes groupes (' . $links . ') :
'; while (list($nom, $mini) = $res->next()) { $html .= "• $nom"; diff --git a/include/xnet/session.inc.php b/include/xnet/session.inc.php index ce1ec8c..8ef9aac 100644 --- a/include/xnet/session.inc.php +++ b/include/xnet/session.inc.php @@ -118,37 +118,79 @@ class XnetSession // }}} } +// {{{ doSelfSuid + +function doSelfSuid() +{ + if (!S::has('suid')) { + $_SESSION['suid'] = $_SESSION; + } + $_SESSION['perms'] = 'user'; +} + +// }}} +// {{{ killSuid + +function killSuid() +{ + if (!S::has('suid')) { + return; + } + $suid = S::v('suid'); + S::kill('suid'); + S::kill('may_update'); + S::kill('is_member'); + $_SESSION['perms'] = $suid['perms']; +} + +// }}} // {{{ may_update -function may_update() { +function may_update($force = false, $lose = false) +{ + if (!isset($_SESSION['may_update'])) { + $_SESSION['may_update'] = array(); + } + $may_update =& $_SESSION['may_update']; + global $globals; - if (!$globals->asso('id')) { return false; } - if (S::has_perms()) { return true; } - $res = XDB::query( - "SELECT perms - FROM groupex.membres - WHERE uid={?} AND asso_id={?}", S::v('uid'), $globals->asso('id')); - return $res->fetchOneCell() == 'admin'; + $asso_id = $globals->asso('id'); + if (!$asso_id) { return false; } + if (S::has_perms() && !$lose) { return true; } + if ((!isset($may_update[$asso_id]) || $force) && !$lose) { + $res = XDB::query("SELECT perms + FROM groupex.membres + WHERE uid={?} AND asso_id={?}", + S::v('uid'), $globals->asso('id')); + $may_update[$asso_id] = ($res->fetchOneCell() == 'admin'); + } elseif ($lose) { + $may_update[$asso_id] = false; + } + return $may_update[$asso_id]; } // }}} // {{{ is_member -function is_member($force = false) +function is_member($force = false, $lose = false) { + if (!isset($_SESSION['is_member'])) { + $_SESSION['is_member'] = array(); + } + $is_member =& $_SESSION['is_member']; + global $globals; $asso_id = $globals->asso('id'); if (!$asso_id) { return false; } - static $is_member; - if (!$is_member) $is_member = array(); - if (!isset($is_member[$asso_id]) || $force) - { + if ((!isset($is_member[$asso_id]) || $force) && !$lose) { $res = XDB::query( "SELECT COUNT(*) FROM groupex.membres WHERE uid={?} AND asso_id={?}", S::v('uid'), $asso_id); $is_member[$asso_id] = $res->fetchOneCell() == 1; + } elseif ($lose) { + $is_member[$asso_id] = false; } return $is_member[$asso_id]; } diff --git a/modules/xnet.php b/modules/xnet.php index 2116744..09f58e9 100644 --- a/modules/xnet.php +++ b/modules/xnet.php @@ -90,14 +90,10 @@ class XnetModule extends PLModule function handler_exit(&$page) { if (S::has('suid')) { - $suid = S::v('suid'); - $_SESSION['perms'] = $suid['perms']; - S::kill('suid'); - } else { - XnetSession::destroy(); - $page->changeTpl('xnet/deconnexion.tpl'); + killSuid(); } - pl_redirect('/'); + XnetSession::destroy(); + $page->changeTpl('xnet/deconnexion.tpl'); } function handler_admin(&$page) diff --git a/modules/xnetgrp.php b/modules/xnetgrp.php index 7adea60..46d3253 100644 --- a/modules/xnetgrp.php +++ b/modules/xnetgrp.php @@ -84,6 +84,8 @@ class XnetGrpModule extends PLModule '%grp/subscribe' => $this->make_hook('subscribe', AUTH_MDP), '%grp/unsubscribe' => $this->make_hook('unsubscribe', AUTH_MDP), + '%grp/change_rights' => $this->make_hook('change_rights', AUTH_MDP), + '%grp/admin/annuaire' => $this->make_hook('admin_annuaire', AUTH_MDP), @@ -567,6 +569,33 @@ class XnetGrpModule extends PLModule } } + function handler_change_rights(&$page) + { + if (Env::has('right') && (may_update() || S::has('suid'))) { + switch (Env::v('right')) { + case 'admin': + killSuid(); + break; + case 'anim': + doSelfSuid(); + may_update(true); + is_member(true); + break; + case 'member': + doSelfSuid(); + may_update(false, true); + is_member(true); + break; + case 'logged': + doSelfSuid(); + may_update(false, true); + is_member(false, true); + break; + } + } + pl_redirect(""); + } + function handler_admin_annuaire(&$page) { global $globals; -- 2.1.4