MercurialGeeklog / file revision
summary | shortlog | changelog | graph | tags | bookmarks | branches | files | changeset | file | latest | revisions | annotate | diff | raw | help
public_html/admin/group.php
author Dirk Haun <dirk@haun-online.de>
Wed, 04 Nov 2009 13:00:40 +0100
branchHEAD
changeset 7437 37aac60623c4
parent 7413 5db714583481
child 7569 71d23a6a8f11
permissions -rw-r--r--
Fixed a bug in the Group Editor that didn't let you add groups to other groups unless your $_TABLES['groups'] happened to be called "groups" (bug #0000998) 
     1 <?php

     2 

     3 /* Reminder: always indent with 4 spaces (no tabs). */

     4 // +---------------------------------------------------------------------------+

     5 // | Geeklog 1.6                                                               |

     6 // +---------------------------------------------------------------------------+

     7 // | group.php                                                                 |

     8 // |                                                                           |

     9 // | Geeklog group administration page.                                        |

    10 // +---------------------------------------------------------------------------+

    11 // | Copyright (C) 2000-2009 by the following authors:                         |

    12 // |                                                                           |

    13 // | Authors: Tony Bibbs        - tony AT tonybibbs DOT com                    |

    14 // |          Mark Limburg      - mlimburg AT users DOT sourceforge DOT net    |

    15 // |          Jason Whittenburg - jwhitten AT securitygeeks DOT com            |

    16 // |          Dirk Haun         - dirk AT haun-online DOT de                   |

    17 // +---------------------------------------------------------------------------+

    18 // |                                                                           |

    19 // | This program is free software; you can redistribute it and/or             |

    20 // | modify it under the terms of the GNU General Public License               |

    21 // | as published by the Free Software Foundation; either version 2            |

    22 // | of the License, or (at your option) any later version.                    |

    23 // |                                                                           |

    24 // | This program is distributed in the hope that it will be useful,           |

    25 // | but WITHOUT ANY WARRANTY; without even the implied warranty of            |

    26 // | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the             |

    27 // | GNU General Public License for more details.                              |

    28 // |                                                                           |

    29 // | You should have received a copy of the GNU General Public License         |

    30 // | along with this program; if not, write to the Free Software Foundation,   |

    31 // | Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.           |

    32 // |                                                                           |

    33 // +---------------------------------------------------------------------------+

    34 

    35 /**

    36 * This file is the Geeklog Group administration page

    37 *

    38 * @author   Tony Bibbs, tony AT tonybibbs DOT com

    39 *

    40 */

    41 

    42 /**

    43 * Geeklog common function library

    44 */

    45 require_once '../lib-common.php';

    46 

    47 /**

    48 * Security check to ensure user even belongs on this page

    49 */

    50 require_once 'auth.inc.php';

    51 

    52 // Uncomment the line below if you need to debug the HTTP variables being passed

    53 // to the script.  This will sometimes cause errors but it will allow you to see

    54 // the data being passed in a POST operation

    55 // echo COM_debug($_POST);

    56 

    57 $display = '';

    58 

    59 // Make sure user has rights to access this page

    60 if (!SEC_hasRights('group.edit')) {

    61     $display .= COM_siteHeader('menu', $MESSAGE[30])

    62              . COM_showMessageText($MESSAGE[29], $MESSAGE[30])

    63              . COM_siteFooter();

    64     COM_accessLog("User {$_USER['username']} tried to illegally access the group administration screen.");

    65     COM_output($display);

    66     exit;

    67 }

    68 

    69 /**

    70 * Shows the group editor form

    71 *

    72 * @param    string      $grp_id     ID of group to edit

    73 * @return   string      HTML for group editor

    74 *

    75 */

    76 function editgroup($grp_id = '')

    77 {

    78     global $_TABLES, $_CONF, $_USER, $LANG_ACCESS, $LANG_ADMIN, $MESSAGE,

    79            $LANG28, $VERBOSE;

    80 

    81     require_once $_CONF['path_system'] . 'lib-admin.php';

    82 

    83     $retval = '';

    84 

    85     $thisUsersGroups = SEC_getUserGroups();

    86     if (! empty($grp_id) &&

    87         ($grp_id > 0) &&

    88         !in_array($grp_id, $thisUsersGroups) &&

    89         !SEC_groupIsRemoteUserAndHaveAccess($grp_id, $thisUsersGroups)) {

    90         $retval .= COM_startBlock($LANG_ACCESS['groupeditor'], '',

    91                            COM_getBlockTemplate('_msg_block', 'header'));

    92         if (!SEC_inGroup('Root') && (DB_getItem($_TABLES['groups'],

    93                 'grp_name', "grp_id = $grp_id") == 'Root')) {

    94             $retval .= $LANG_ACCESS['canteditroot'];

    95             COM_accessLog("User {$_USER['username']} tried to edit the Root group with insufficient privileges.");

    96         } else {

    97             $retval .= $LANG_ACCESS['canteditgroup'];

    98         }

    99         $retval .= COM_endBlock(COM_getBlockTemplate('_msg_block', 'footer'));

   100 

   101         return $retval;

   102     }

   103 

   104     $group_templates = new Template($_CONF['path_layout'] . 'admin/group');

   105     $group_templates->set_file('editor', 'groupeditor.thtml');

   106     $group_templates->set_var('site_url', $_CONF['site_url']);

   107     $group_templates->set_var('site_admin_url', $_CONF['site_admin_url']);

   108     $group_templates->set_var('layout_url', $_CONF['layout_url']);

   109     $group_templates->set_var('lang_save', $LANG_ADMIN['save']);

   110     $group_templates->set_var('lang_cancel', $LANG_ADMIN['cancel']);

   111     $group_templates->set_var('lang_admingroup', $LANG28[49]);

   112     $group_templates->set_var('lang_admingrp_msg', $LANG28[50]);

   113     $group_templates->set_var('xhtml', XHTML);

   114     $showall = 0;

   115     if (isset($_REQUEST['chk_showall']) && ($_REQUEST['chk_showall'] == 1)) {

   116         $showall = 1;

   117     }

   118     $group_templates->set_var('show_all', $showall);

   119 

   120     if (! empty($grp_id)) {

   121         $result = DB_query("SELECT grp_id,grp_name,grp_descr,grp_gl_core FROM {$_TABLES['groups']} WHERE grp_id ='$grp_id'");

   122         $A = DB_fetchArray($result);

   123         if ($A['grp_gl_core'] > 0) {

   124             $group_templates->set_var('chk_adminuse', 'checked="checked"');

   125         }

   126     } else {

   127         // new group, so it's obviously not a core group

   128         $A['grp_gl_core'] = 0;

   129     }

   130 

   131     $token = SEC_createToken();

   132     $retval .= COM_startBlock($LANG_ACCESS['groupeditor'], '',

   133                               COM_getBlockTemplate('_admin_block', 'header'));

   134     $retval .= SEC_getTokenExpiryNotice($token);

   135 

   136     if (! empty($grp_id)) {

   137         // Groups tied to Geeklog's functionality shouldn't be deleted

   138         if ($A['grp_gl_core'] != 1) {

   139             $delbutton = '<input type="submit" value="' . $LANG_ADMIN['delete']

   140                        . '" name="mode"%s' . XHTML . '>';

   141             $jsconfirm = ' onclick="return confirm(\'' . $MESSAGE[76] . '\');"';

   142             $group_templates->set_var('delete_option',

   143                                       sprintf($delbutton, $jsconfirm));

   144             $group_templates->set_var('delete_option_no_confirmation',

   145                                       sprintf($delbutton, ''));

   146             $group_templates->set_var('group_core', 0);

   147         } else {

   148             $group_templates->set_var('group_core', 1);

   149         }

   150         $group_templates->set_var('group_id', $A['grp_id']);

   151     } else {

   152         $group_templates->set_var('group_core', 0);

   153     }

   154 

   155     $group_templates->set_var('lang_groupname', $LANG_ACCESS['groupname']);

   156 

   157     if ($A['grp_gl_core'] != 1) {

   158         $group_templates->set_var('groupname_inputtype', 'text');

   159         $group_templates->set_var('groupname_static', '');

   160     } else {

   161         $group_templates->set_var('groupname_inputtype', 'hidden');

   162         $group_templates->set_var('groupname_static', $A['grp_name']);

   163     }

   164     if (isset ($A['grp_name'])) {

   165         $group_templates->set_var('group_name', $A['grp_name']);

   166     } else {

   167         $group_templates->set_var('group_name', '');

   168     }

   169 

   170     $group_templates->set_var('lang_description', $LANG_ACCESS['description']);

   171     if (isset ($A['grp_descr'])) {

   172         $group_templates->set_var('group_description', $A['grp_descr']);

   173     } else {

   174         $group_templates->set_var('group_description', '');

   175     }

   176     $group_templates->set_var('lang_securitygroups', $LANG_ACCESS['securitygroups']);

   177 

   178     $selected = '';

   179     if (! empty($grp_id)) {

   180         $tmp = DB_query("SELECT ug_main_grp_id FROM {$_TABLES['group_assignments']} WHERE ug_grp_id = $grp_id");

   181         $num_groups = DB_numRows($tmp);

   182         for ($x = 0; $x < $num_groups; $x++) {

   183             $G = DB_fetchArray($tmp);

   184             if ($x > 0) {

   185                 $selected .= ' ' . $G['ug_main_grp_id'];

   186             } else {

   187                 $selected .= $G['ug_main_grp_id'];

   188             }

   189         }

   190     }

   191 

   192     $groupoptions = '';

   193     if ($A['grp_gl_core'] == 1) {

   194         $group_templates->set_var('lang_securitygroupmsg',

   195                                   $LANG_ACCESS['coregroupmsg']);

   196         $group_templates->set_var('hide_adminoption',

   197                                   ' style="display:none;"');

   198 

   199         $count = 0;

   200         if (! empty($selected)) {

   201             $inclause = str_replace(' ', ',', $selected);

   202             $result = DB_query("SELECT COUNT(*) AS count FROM {$_TABLES['groups']} WHERE grp_id <> $grp_id AND grp_id IN ($inclause)");

   203             list($count) = DB_fetchArray($result);

   204         }

   205         if ($count == 0) {

   206             // this group doesn't belong to anything...give a friendly message

   207             $groupoptions = '<p class="pluginRow1">'

   208                           . $LANG_ACCESS['nogroupsforcoregroup'] . '</p>';

   209         }

   210     } else {

   211         $group_templates->set_var('lang_securitygroupmsg',

   212                                   $LANG_ACCESS['groupmsg']);

   213         $group_templates->set_var('hide_adminoption', '');

   214     }

   215     if ($VERBOSE) {

   216         COM_errorLog("SELECTED: $selected");

   217     }

   218 

   219     if (empty($groupoptions)) {

   220         // make sure to list only those groups of which the Group Admin

   221         // is a member

   222         $whereGroups = '(grp_id IN (' . implode (',', $thisUsersGroups) . '))';

   223 

   224         $header_arr = array(

   225                         array('text' => $LANG28[86], 'field' => ($A['grp_gl_core'] == 1 ? 'disabled-checkbox' : 'checkbox'), 'sort' => false),

   226                         array('text' => $LANG_ACCESS['groupname'], 'field' => 'grp_name', 'sort' => true),

   227                         array('text' => $LANG_ACCESS['description'], 'field' => 'grp_descr', 'sort' => true)

   228         );

   229 

   230         $defsort_arr = array('field' => 'grp_name', 'direction' => 'asc');

   231 

   232         $form_url = $_CONF['site_admin_url']

   233                   . '/group.php?mode=edit&amp;grp_id=' . $grp_id;

   234         $text_arr = array('has_menu' => false,

   235                           'title' => '', 'instructions' => '',

   236                           'icon' => '', 'form_url' => $form_url,

   237                           'inline' => true);

   238 

   239         if ($A['grp_gl_core'] == 1) {

   240             $inclause = str_replace(' ', ',', $selected);

   241             $sql = "SELECT grp_id, grp_name, grp_descr FROM {$_TABLES['groups']} WHERE grp_id <> $grp_id AND grp_id IN ($inclause)";

   242         } else {

   243             $xsql = '';

   244             if (! empty($grp_id)) {

   245                 $xsql = " AND (grp_id <> $grp_id)";

   246             }

   247             $sql = "SELECT grp_id, grp_name, grp_descr FROM {$_TABLES['groups']} WHERE (grp_name <> 'Root')" . $xsql . ' AND ' . $whereGroups;

   248         }

   249         $query_arr = array('table' => 'groups',

   250                            'sql' => $sql,

   251                            'query_fields' => array('grp_name'),

   252                            'default_filter' => '',

   253                            'query' => '',

   254                            'query_limit' => 0);

   255 

   256         $groupoptions = ADMIN_list('groups', 'ADMIN_getListField_groups',

   257                                    $header_arr, $text_arr, $query_arr,

   258                                    $defsort_arr, '', explode(' ', $selected));

   259     }

   260     $group_templates->set_var('group_options', $groupoptions);

   261     $group_templates->set_var('lang_rights', $LANG_ACCESS['rights']);

   262 

   263     if ($A['grp_gl_core'] == 1) {

   264         $group_templates->set_var('lang_rightsmsg', $LANG_ACCESS['corerightsdescr']);

   265     } else {

   266         $group_templates->set_var('lang_rightsmsg', $LANG_ACCESS['rightsdescr']);

   267     }

   268 

   269     $group_templates->set_var('rights_options',

   270                               printrights($grp_id, $A['grp_gl_core']));

   271     $group_templates->set_var('gltoken_name', CSRF_TOKEN);

   272     $group_templates->set_var('gltoken', $token);

   273     $group_templates->parse('output','editor');

   274     $retval .= $group_templates->finish($group_templates->get_var('output'));

   275     $retval .= COM_endBlock (COM_getBlockTemplate ('_admin_block', 'footer'));

   276 

   277     return $retval;

   278 }

   279 

   280 

   281 /**

   282 * Get the indirect features for a group, i.e. a list of all the features

   283 * that this group inherited from other groups.

   284 *

   285 * @param    int      $grp_id   ID of group

   286 * @return   string   comma-separated list of feature names

   287 *

   288 */

   289 function getIndirectFeatures ($grp_id)

   290 {

   291     global $_TABLES;

   292 

   293     $checked = array ();

   294     $tocheck = array ($grp_id);

   295 

   296     do {

   297         $grp = array_pop ($tocheck);

   298 

   299         $result = DB_query ("SELECT ug_main_grp_id FROM {$_TABLES['group_assignments']} WHERE ug_grp_id = $grp AND ug_uid IS NULL");

   300         $numrows = DB_numRows ($result);

   301 

   302         $checked[] = $grp;

   303 

   304         for ($j = 0; $j < $numrows; $j++) {

   305             $A = DB_fetchArray ($result);

   306             if (!in_array ($A['ug_main_grp_id'], $checked) &&

   307                 !in_array ($A['ug_main_grp_id'], $tocheck)) {

   308                 $tocheck[] = $A['ug_main_grp_id'];

   309             }

   310         }

   311     }

   312     while (count($tocheck) > 0);

   313 

   314     // get features for all groups in $checked

   315     $glist = join (',', $checked);

   316     $result = DB_query("SELECT DISTINCT ft_name FROM {$_TABLES['access']},{$_TABLES['features']} WHERE ft_id = acc_ft_id AND acc_grp_id IN ($glist)");

   317     $nrows = DB_numRows ($result);

   318 

   319     $retval = '';

   320     for ($j = 1; $j <= $nrows; $j++) {

   321         $A = DB_fetchArray ($result);

   322         $retval .= $A['ft_name'];

   323         if ($j < $nrows) {

   324             $retval .= ',';

   325         }

   326     }

   327 

   328     return $retval;

   329 }

   330 

   331 /**

   332 * Prints the features a group has access.  Please follow the comments in the

   333 * code closely if you need to modify this function. Also right is synonymous

   334 * with feature.

   335 *

   336 * @param    mixed       $grp_id     ID to print rights for

   337 * @param    boolean     $core       indicates if group is a core Geeklog group

   338 * @return   string      HTML for rights

   339 *

   340 */

   341 function printrights($grp_id = '', $core = 0)

   342 {

   343     global $_TABLES, $_USER, $LANG_ACCESS, $VERBOSE;

   344 

   345     // $VERBOSE = true;

   346     // this gets a bit complicated so bear with the comments

   347 

   348     // get a list of all the features that the current user (i.e. Group Admin)

   349     // has access to, so we only include these features in the list below

   350     if (!SEC_inGroup('Root')) {

   351         $GroupAdminFeatures = SEC_getUserPermissions ();

   352         $availableFeatures = explode (',', $GroupAdminFeatures);

   353         $GroupAdminFeatures = "'" . implode ("','", $availableFeatures) . "'";

   354         $ftWhere = ' WHERE ft_name IN (' . $GroupAdminFeatures . ')';

   355     } else {

   356         $ftWhere = '';

   357     }

   358 

   359     // now query for all available features

   360     $features = DB_query ("SELECT ft_id,ft_name,ft_descr FROM {$_TABLES['features']}{$ftWhere} ORDER BY ft_name");

   361     $nfeatures = DB_numRows($features);

   362 

   363     $grpftarray = array ();

   364     if (!empty($grp_id)) {

   365         // now get all the feature this group gets directly

   366          $directfeatures = DB_query("SELECT acc_ft_id,ft_name FROM {$_TABLES['access']},{$_TABLES['features']} WHERE ft_id = acc_ft_id AND acc_grp_id = $grp_id",1);

   367 

   368         // now in many cases the features will be given to this user indirectly

   369         // via membership to another group.  These are not editable and must,

   370         // instead, be removed from that group directly

   371         $indirectfeatures = getIndirectFeatures ($grp_id);

   372         $indirectfeatures = explode (',', $indirectfeatures);

   373 

   374         // Build an array of indirect features

   375         for ($i = 0; $i < count($indirectfeatures); $i++) {

   376             $grpftarray[current($indirectfeatures)] = 'indirect';

   377             next($indirectfeatures);

   378         }

   379 

   380         // Build an arrray of direct features

   381         $grpftarray1 = array ();

   382         $ndirect = DB_numRows($directfeatures);

   383         for ($i = 0; $i < $ndirect; $i++) {

   384             $A = DB_fetchArray($directfeatures);

   385             $grpftarray1[$A['ft_name']] = 'direct';

   386         }

   387 

   388         // Now merge the two arrays

   389         $grpftarray = array_merge ($grpftarray, $grpftarray1);

   390         if ($VERBOSE) {

   391             // this is for debugging purposes

   392             for ($i = 1; $i < count($grpftarray); $i++) {

   393                 COM_errorLog("element $i is feature " . key($grpftarray) . " and is " . current($grpftarray),1);

   394                 next($grpftarray);

   395             }

   396         }

   397     }

   398 

   399     // OK, now loop through and print all the features giving edit rights

   400     // to only the ones that are direct features

   401     $ftcount = 0;

   402     $retval = '<tr>';

   403     for ($i = 0; $i < $nfeatures; $i++) {

   404         $A = DB_fetchArray($features);

   405 

   406         if ((empty($grpftarray[$A['ft_name']]) OR ($grpftarray[$A['ft_name']] == 'direct')) AND ($core != 1)) {

   407             if (($ftcount > 0) && ($ftcount % 3 == 0)) {

   408                 $retval .= '</tr>' . LB . '<tr>';

   409             }

   410             $pluginRow = sprintf('pluginRow%d', ($ftcount % 2) + 1);

   411             $ftcount++;

   412 

   413             $retval .= '<td class="' . $pluginRow . '">'

   414                     . '<input type="checkbox" name="features[]" value="'

   415                     . $A['ft_id'] . '"';

   416             if (!empty($grpftarray[$A['ft_name']])) {

   417                 if ($grpftarray[$A['ft_name']] == 'direct') {

   418                     $retval .= ' checked="checked"';

   419                 }

   420             }

   421             $retval .= XHTML . '><span title="' . $A['ft_descr'] . '">'

   422                     . $A['ft_name'] . '</span></td>';

   423         } else {

   424             // either this is an indirect right OR this is a core feature

   425             if ((($core == 1) AND (isset($grpftarray[$A['ft_name']]) AND (($grpftarray[$A['ft_name']] == 'indirect') OR ($grpftarray[$A['ft_name']] == 'direct')))) OR ($core != 1)) {

   426                 if (($ftcount > 0) && ($ftcount % 3 == 0)) {

   427                     $retval .= '</tr>' . LB . '<tr>';

   428                 }

   429                 $pluginRow = sprintf('pluginRow%d', ($ftcount % 2) + 1);

   430                 $ftcount++;

   431 

   432                 $retval .= '<td class="' . $pluginRow . '">'

   433                         . '<input type="checkbox" checked="checked" '

   434                         . 'disabled="disabled"' . XHTML . '>'

   435                         . '<input type="hidden" name="features[]" value="'

   436                         . $A['ft_id'] . '"' . XHTML . '>'

   437                         . '(<i title="' . $A['ft_descr'] . '">' . $A['ft_name']

   438                         . '</i>)</td>';

   439             }

   440         }

   441     }

   442     if ($ftcount == 0) {

   443         // This group doesn't have rights to any features

   444         $retval .= '<td colspan="3" class="pluginRow1">'

   445                 . $LANG_ACCESS['grouphasnorights'] . '</td>';

   446     }

   447 

   448     $retval .= '</tr>' . LB;

   449 

   450     return $retval;

   451 }

   452 

   453 /**

   454 * Save a group to the database

   455 *

   456 * @param    string  $grp_id         ID of group to save

   457 * @param    string  $grp_name       Group Name

   458 * @param    string  $grp_descr      Description of group

   459 * @param    boolean $grp_admin      Flag that indicates this is an admin use group

   460 * @param    boolean $grp_gl_core    Flag that indicates if this is a core Geeklog group

   461 * @param    array   $features       Features the group has access to

   462 * @param    array   $groups         Groups this group will belong to

   463 * @return   string                  HTML refresh or error message

   464 *

   465 */

   466 function savegroup($grp_id, $grp_name, $grp_descr, $grp_admin, $grp_gl_core, $features, $groups)

   467 {

   468     global $_CONF, $_TABLES, $_USER, $LANG_ACCESS, $VERBOSE;

   469 

   470     $retval = '';

   471     if (!empty($grp_name) && !empty($grp_descr)) {

   472         $GroupAdminGroups = SEC_getUserGroups();

   473         if (!empty ($grp_id) &&

   474             ($grp_id > 0) &&

   475             !in_array ($grp_id, $GroupAdminGroups) &&

   476             !SEC_groupIsRemoteUserAndHaveAccess($grp_id, $GroupAdminGroups)) {

   477             COM_accessLog ("User {$_USER['username']} tried to edit group '$grp_name' ($grp_id) with insufficient privileges.");

   478 

   479             return COM_refresh ($_CONF['site_admin_url'] . '/group.php');

   480         }

   481 

   482         if ($grp_gl_core == 1 AND !is_array ($features)) {

   483             COM_errorLog ("Sorry, no valid features were passed to this core group ($grp_id) and saving could cause problem...bailing.");

   484 

   485             return COM_refresh ($_CONF['site_admin_url'] . '/group.php');

   486         }

   487 

   488         // group names have to be unique, so check if this one exists already

   489         $g_id = DB_getItem ($_TABLES['groups'], 'grp_id',

   490                             "grp_name = '$grp_name'");

   491         if ($g_id > 0) {

   492             if (empty ($grp_id) || ($grp_id != $g_id)) {

   493                 // there already is a group with that name - complain

   494                 $retval .= COM_siteHeader ('menu', $LANG_ACCESS['groupeditor']);

   495                 $retval .= COM_startBlock ($LANG_ACCESS['groupexists'], '',

   496                            COM_getBlockTemplate ('_msg_block', 'header'));

   497                 $retval .= $LANG_ACCESS['groupexistsmsg'];

   498                 $retval .= COM_endBlock (COM_getBlockTemplate ('_msg_block', 'footer'));

   499                 $retval .= editgroup ($grp_id);

   500                 $retval .= COM_siteFooter ();

   501 

   502                 return $retval;

   503             }

   504         }

   505 

   506         $grp_descr = COM_stripslashes ($grp_descr);

   507         $grp_descr = addslashes ($grp_descr);

   508 

   509         if (empty ($grp_id)) {

   510             DB_save ($_TABLES['groups'], 'grp_name,grp_descr,grp_gl_core',

   511                      "'$grp_name','$grp_descr',$grp_gl_core");

   512             $grp_id = DB_getItem ($_TABLES['groups'], 'grp_id',

   513                                   "grp_name = '$grp_name'");

   514             $new_group = true;

   515         } else {

   516             DB_save ($_TABLES['groups'],

   517                      'grp_id,grp_name,grp_descr,grp_gl_core',

   518                      "$grp_id,'$grp_name','$grp_descr',$grp_gl_core");

   519             $new_group = false;

   520         }

   521 

   522         if (empty($grp_id) || ($grp_id < 1)) {

   523             // "this shouldn't happen"

   524             COM_errorLog("Internal error: invalid group id");

   525             $retval .= COM_siteHeader('menu', $LANG_ACCESS['groupeditor']);

   526             $retval .= COM_showMessage(95);

   527             $retval .= COM_siteFooter();

   528 

   529             return $retval;

   530         }

   531 

   532         // Use the field grp_gl_core to indicate if this is non-core GL Group is an Admin related group

   533         if (($grp_gl_core != 1) AND ($grp_id > 1)) {

   534             if ($grp_admin == 1) {

   535                 DB_query("UPDATE {$_TABLES['groups']} SET grp_gl_core=2 WHERE grp_id=$grp_id");

   536             } else {

   537                 DB_query("UPDATE {$_TABLES['groups']} SET grp_gl_core=0 WHERE grp_id=$grp_id");

   538             }

   539         }

   540 

   541         // now save the features

   542         DB_delete($_TABLES['access'], 'acc_grp_id', $grp_id);

   543         $num_features = count($features);

   544         if (SEC_inGroup('Root')) {

   545             foreach ($features as $f) {

   546                 DB_query ("INSERT INTO {$_TABLES['access']} (acc_ft_id,acc_grp_id) VALUES ($f,$grp_id)");

   547             }

   548         } else {

   549             $GroupAdminFeatures = SEC_getUserPermissions();

   550             $availableFeatures = explode(',', $GroupAdminFeatures);

   551             foreach ($features as $f) {

   552                 if (in_array($f, $availableFeatures)) {

   553                     DB_query("INSERT INTO {$_TABLES['access']} (acc_ft_id,acc_grp_id) VALUES ($f,$grp_id)");

   554                 }

   555             }

   556         }

   557         if ($VERBOSE) {

   558             COM_errorLog('groups = ' . $groups);

   559             COM_errorLog("deleting all group_assignments for group $grp_id/$grp_name",1);

   560         }

   561 

   562         DB_delete($_TABLES['group_assignments'], 'ug_grp_id', $grp_id);

   563         if (! empty($groups)) {

   564             foreach ($groups as $g) {

   565                 if (in_array($g, $GroupAdminGroups)) {

   566                     if ($VERBOSE) COM_errorLog("adding group_assignment $g for $grp_name",1);

   567                     $sql = "INSERT INTO {$_TABLES['group_assignments']} (ug_main_grp_id, ug_grp_id) VALUES ($g,$grp_id)";

   568                     DB_query($sql);

   569                 }

   570             }

   571         }

   572 

   573         // Make sure Root group belongs to any new group

   574         if (DB_getItem ($_TABLES['group_assignments'], 'COUNT(*)',

   575                 "ug_main_grp_id = $grp_id AND ug_grp_id = 1") == 0) {

   576             DB_query("INSERT INTO {$_TABLES['group_assignments']} (ug_main_grp_id, ug_grp_id) VALUES ($grp_id, 1)");

   577         }

   578 

   579         // make sure this Group Admin belongs to the new group

   580         if (!SEC_inGroup ('Root')) {

   581             if (DB_count ($_TABLES['group_assignments'], 'ug_uid',

   582             "(ug_uid = {$_USER['uid']}) AND (ug_main_grp_id = $grp_id)") == 0) {

   583                 DB_query ("INSERT INTO {$_TABLES['group_assignments']} (ug_main_grp_id, ug_uid) VALUES ($grp_id,{$_USER['uid']})");

   584             }

   585         }

   586 

   587         if ($new_group) {

   588             PLG_groupChanged ($grp_id, 'new');

   589         } else {

   590             PLG_groupChanged ($grp_id, 'edit');

   591         }

   592         if (isset($_REQUEST['chk_showall']) && ($_REQUEST['chk_showall'] == 1)) {

   593             echo COM_refresh($_CONF['site_admin_url'] . '/group.php?msg=49&chk_showall=1');

   594         } else {

   595             echo COM_refresh($_CONF['site_admin_url'] . '/group.php?msg=49');

   596         }

   597     } else {

   598         $retval .= COM_siteHeader ('menu', $LANG_ACCESS['groupeditor']);

   599         $retval .= COM_startBlock ($LANG_ACCESS['missingfields'], '',

   600                            COM_getBlockTemplate ('_msg_block', 'header'));

   601         $retval .= $LANG_ACCESS['missingfieldsmsg'];

   602         $retval .= COM_endBlock (COM_getBlockTemplate ('_msg_block', 'footer'));

   603         $retval .= editgroup ($grp_id);

   604         $retval .= COM_siteFooter ();

   605 

   606         return $retval;

   607     }

   608 }

   609 

   610 /**

   611 * Get a list (actually an array) of all groups this group belongs to.

   612 *

   613 * @param    int     $basegroup  id of group

   614 * @return   array               array of all groups $basegroup belongs to

   615 *

   616 */

   617 function getGroupList($basegroup)

   618 {

   619     global $_TABLES;

   620 

   621     $to_check = array ();

   622     array_push ($to_check, $basegroup);

   623 

   624     $checked = array ();

   625 

   626     while (count($to_check) > 0) {

   627         $thisgroup = array_pop ($to_check);

   628         if ($thisgroup > 0) {

   629             $result = DB_query ("SELECT ug_grp_id FROM {$_TABLES['group_assignments']} WHERE ug_main_grp_id = $thisgroup");

   630             $numGroups = DB_numRows ($result);

   631             for ($i = 0; $i < $numGroups; $i++) {

   632                 $A = DB_fetchArray ($result);

   633                 if (!in_array ($A['ug_grp_id'], $checked)) {

   634                     if (!in_array ($A['ug_grp_id'], $to_check)) {

   635                         array_push ($to_check, $A['ug_grp_id']);

   636                     }

   637                 }

   638             }

   639             $checked[] = $thisgroup;

   640         }

   641     }

   642 

   643     return $checked;

   644 }

   645 

   646 /**

   647 * Display a list of all users in a given group.

   648 *

   649 * @param   int      $grp_id     group id

   650 * @return  string               HTML for user listing

   651 *

   652 */

   653 function listusers ($grp_id)

   654 {

   655     global $_CONF, $_TABLES, $LANG28, $LANG_ACCESS, $LANG_ADMIN, $_IMAGE_TYPE;

   656 

   657     require_once $_CONF['path_system'] . 'lib-admin.php';

   658 

   659     $retval = '';

   660 

   661     $thisUsersGroups = SEC_getUserGroups ();

   662     if (!empty ($grp_id) &&

   663         ($grp_id > 0) &&

   664         !in_array ($grp_id, $thisUsersGroups) &&

   665         !SEC_groupIsRemoteUserAndHaveAccess( $grp_id, $thisUsersGroups)) {

   666         $retval .= COM_startBlock ($LANG_ACCESS['usergroupadmin'], '',

   667                            COM_getBlockTemplate ('_msg_block', 'header'));

   668         $retval .= $LANG_ACCESS['cantlistgroup'];

   669         $retval .= COM_endBlock (COM_getBlockTemplate ('_msg_block', 'footer'));

   670 

   671         return $retval;

   672     }

   673 

   674     if ($_CONF['lastlogin']) {

   675         $login_text = $LANG28[41];

   676         $login_field = 'lastlogin';

   677     } else {

   678         $login_text = $LANG28[40];

   679         $login_field = 'regdate';

   680     }

   681 

   682     $header_arr = array (

   683         array('text' => $LANG_ADMIN['edit'], 'field' => 'edit', 'sort' => false),

   684         array('text' => $LANG28[37], 'field' => 'uid', 'sort' => true),

   685         array('text' => $LANG28[3], 'field' => 'username', 'sort' => true),

   686         array('text' => $LANG28[4], 'field' => 'fullname', 'sort' => true),

   687         array('text' => $login_text, 'field' => $login_field, 'sort' => true),

   688         array('text' => $LANG28[7], 'field' => 'email', 'sort' => true)

   689     );

   690 

   691     $defsort_arr = array ('field'     => 'username',

   692                           'direction' => 'asc'

   693     );

   694 

   695     $form_url = $_CONF['site_admin_url'] . '/group.php?mode=listusers&amp;grp_id='.$grp_id;

   696     if (isset($_REQUEST['chk_showall']) && ($_REQUEST['chk_showall'] == 1)) {

   697         $form_url .= '&amp;chk_showall=1';

   698     }

   699 

   700     $groupname = DB_getItem ($_TABLES['groups'], 'grp_name',

   701                              "grp_id = '$grp_id'");

   702     $headline = sprintf ($LANG_ACCESS['usersingroup'], $groupname);

   703 

   704     $url = $_CONF['site_admin_url'] . '/group.php';

   705     if (isset($_REQUEST['chk_showall']) && ($_REQUEST['chk_showall'] == 1)) {

   706         $url .= '?chk_showall=1';

   707     }

   708     $menu_arr = array (

   709                     array('url'  => $url,

   710                           'text' => $LANG28[38]),

   711                     array('url'  => $_CONF['site_admin_url'],

   712                           'text' => $LANG_ADMIN['admin_home']));

   713 

   714     $retval .= COM_startBlock($headline, '',

   715                               COM_getBlockTemplate('_admin_block', 'header'));

   716 

   717     $retval .= ADMIN_createMenu(

   718         $menu_arr,

   719         '&nbsp;',

   720         $_CONF['layout_url'] . '/images/icons/group.' . $_IMAGE_TYPE

   721     );

   722 

   723     $text_arr = array (

   724         'has_extras' => true,

   725         'form_url'   => $form_url,

   726         'help_url'   => ''

   727     );

   728 

   729     $join_userinfo = '';

   730     $select_userinfo = '';

   731     if ($_CONF['lastlogin']) {

   732         $join_userinfo = "LEFT JOIN {$_TABLES['userinfo']} ON {$_TABLES['users']}.uid={$_TABLES['userinfo']}.uid ";

   733         $select_userinfo = ",lastlogin ";

   734     }

   735 

   736     $groups = getGroupList ($grp_id);

   737     $groupList = implode (',', $groups);

   738 

   739     $sql = "SELECT DISTINCT {$_TABLES['users']}.uid,username,fullname,email,photo,regdate$select_userinfo "

   740           ."FROM {$_TABLES['group_assignments']},{$_TABLES['users']} $join_userinfo "

   741           ."WHERE {$_TABLES['users']}.uid > 1 "

   742           ."AND {$_TABLES['users']}.uid = {$_TABLES['group_assignments']}.ug_uid "

   743           ."AND ({$_TABLES['group_assignments']}.ug_main_grp_id IN ({$groupList}))";

   744 

   745     $query_arr = array ('table' => 'users',

   746                         'sql' => $sql,

   747                         'query_fields' => array('username', 'email', 'fullname'),

   748                         'default_filter' => "AND {$_TABLES['users']}.uid > 1"

   749     );

   750 

   751     $retval .= ADMIN_list('user', 'ADMIN_getListField_users', $header_arr,

   752                           $text_arr, $query_arr, $defsort_arr);

   753     $retval .= COM_endBlock(COM_getBlockTemplate('_admin_block', 'footer'));

   754 

   755     return $retval;

   756 }

   757 

   758 /**

   759 * Display a list of (all) groups

   760 *

   761 * @param    boolean     $show_all_groups    include admin groups if true

   762 * @return   string                          HTML of the group list

   763 *

   764 */

   765 function listgroups($show_all_groups = false)

   766 {

   767     global $_CONF, $_TABLES, $LANG_ADMIN, $LANG_ACCESS, $LANG28, $_IMAGE_TYPE;

   768 

   769     require_once $_CONF['path_system'] . 'lib-admin.php';

   770 

   771     $retval = '';

   772 

   773     $header_arr = array(      // display 'text' and use table field 'field'

   774         array('text' => $LANG_ADMIN['edit'], 'field' => 'edit', 'sort' => false),

   775         array('text' => $LANG_ACCESS['groupname'], 'field' => 'grp_name', 'sort' => true),

   776         array('text' => $LANG_ACCESS['description'], 'field' => 'grp_descr', 'sort' => true),

   777         array('text' => $LANG_ACCESS['coregroup'], 'field' => 'grp_gl_core', 'sort' => true),

   778         array('text' => $LANG_ACCESS['listusers'], 'field' => 'list', 'sort' => false)

   779     );

   780 

   781     $defsort_arr = array('field' => 'grp_name', 'direction' => 'asc');

   782 

   783     $form_url = $_CONF['site_admin_url'] . '/group.php';

   784     if ($show_all_groups) {

   785         $form_url .= '?chk_showall=1';

   786     }

   787 

   788     $menu_arr = array (

   789         array('url' => $_CONF['site_admin_url'] . '/group.php?mode=edit',

   790               'text' => $LANG_ADMIN['create_new']),

   791         array('url' => $_CONF['site_admin_url'],

   792               'text' => $LANG_ADMIN['admin_home'])

   793     );

   794 

   795     $retval .= COM_startBlock($LANG_ACCESS['groupmanager'], '',

   796                               COM_getBlockTemplate('_admin_block', 'header'));

   797 

   798     $retval .= ADMIN_createMenu(

   799         $menu_arr,

   800         $LANG_ACCESS['newgroupmsg'],

   801         $_CONF['layout_url'] . '/images/icons/group.' . $_IMAGE_TYPE

   802     );

   803 

   804     $text_arr = array(

   805         'has_extras' => true,

   806         'form_url'   => $form_url

   807     );

   808 

   809     $filter = '<span style="padding-right:20px;">';

   810 

   811     $checked ='';

   812     if ($show_all_groups) {

   813         $checked = ' checked="checked"';

   814     }

   815 

   816     if (SEC_inGroup('Root')) {

   817         $grpFilter = '';

   818     } else {

   819         $thisUsersGroups = SEC_getUserGroups ();

   820         $grpFilter = 'AND (grp_id IN (' . implode (',', $thisUsersGroups) . '))';

   821     }

   822 

   823     if ($show_all_groups) {

   824         $filter .= '<label for="chk_showall"><input id="chk_showall" type="checkbox" name="chk_showall" value="1" checked="checked"' . XHTML . '>';

   825         $query_arr = array(

   826             'table' => 'groups',

   827             'sql' => "SELECT * FROM {$_TABLES['groups']} WHERE 1=1",

   828             'query_fields' => array('grp_name', 'grp_descr'),

   829             'default_filter' => $grpFilter);

   830     } else {

   831         $filter .= '<label for="chk_showall"><input id="chk_showall" type="checkbox" name="chk_showall" value="1"' . $checked . XHTML . '>';

   832         $query_arr = array(

   833             'table' => 'groups',

   834             'sql' => "SELECT * FROM {$_TABLES['groups']} WHERE (grp_gl_core = 0 OR grp_name IN ('All Users','Logged-in Users'))",

   835             'query_fields' => array('grp_name', 'grp_descr'),

   836             'default_filter' => $grpFilter);

   837     }

   838     $filter .= $LANG28[48] . '</label></span>';

   839 

   840     $retval .= ADMIN_list('groups', 'ADMIN_getListField_groups', $header_arr,

   841                           $text_arr, $query_arr, $defsort_arr, $filter);

   842     $retval .= COM_endBlock(COM_getBlockTemplate('_admin_block', 'footer'));

   843 

   844     return $retval;

   845 }

   846 

   847 /**

   848 * Get list of users in a given group

   849 *

   850 * Effectively, this function is used twice: To get a list of all users currently

   851 * in the given group and to get all list of all users NOT in that group.

   852 *

   853 * @param    int     $group_id   group id

   854 * @param    boolean $allusers   true: return users not in the group

   855 * @return   string              option list containing uids and user names

   856 *

   857 */

   858 function grp_selectUsers($group_id, $allusers = false)

   859 {

   860     global $_TABLES, $_USER;

   861 

   862     $retval = '';

   863 

   864     // Get a list of users in the Root Group and the selected group

   865     $sql  = "SELECT DISTINCT uid FROM {$_TABLES['users']} LEFT JOIN {$_TABLES['group_assignments']} ";

   866     $sql .= "ON {$_TABLES['group_assignments']}.ug_uid = uid WHERE uid > 1 AND ";

   867     $sql .= "({$_TABLES['group_assignments']}.ug_main_grp_id = 1 OR {$_TABLES['group_assignments']}.ug_main_grp_id = $group_id)";

   868     $result = DB_query ($sql);

   869     $filteredusers = array();

   870     while ($A = DB_fetchArray($result)) {

   871         $filteredusers[] = $A['uid'];

   872     }

   873 

   874     $groups = getGroupList ($group_id);

   875     $grouplist = '(' . implode (',', $groups) . ')';

   876     $sql = "SELECT DISTINCT uid,username FROM {$_TABLES['users']} LEFT JOIN {$_TABLES['group_assignments']} ";

   877     $sql .= "ON {$_TABLES['group_assignments']}.ug_uid = uid WHERE uid > 1 AND ";

   878     $sql .= "{$_TABLES['group_assignments']}.ug_main_grp_id ";

   879     if ($allusers) {

   880         $sql .= 'NOT ';

   881     }

   882     $sql .= "IN {$grouplist} ";

   883     // Filter out the users that will be in the selected group

   884     if ($allusers) {

   885         $filteredusers = implode(',',$filteredusers);

   886         $sql .= " AND uid NOT IN ($filteredusers) ";

   887     }

   888     $sql .= "ORDER BY username";

   889     $result = DB_query ($sql);

   890     $numUsers = DB_numRows ($result);

   891     for ($i = 0; $i < $numUsers; $i++) {

   892         list($uid, $username) = DB_fetchArray ($result);

   893         $retval .= '<option value="' . $uid . '">' . $username . '</option>';

   894     }

   895 

   896     return $retval;

   897 }

   898 

   899 /**

   900 * Allow easy addition/removal of users to/from a group

   901 *

   902 * @param    int     $group  Group ID

   903 * @return   string          HTML form

   904 *

   905 */

   906 function editusers($group)

   907 {

   908     global $_CONF, $_TABLES, $_USER, $LANG_ACCESS, $LANG_ADMIN, $LANG28,

   909            $_IMAGE_TYPE;

   910 

   911     require_once $_CONF['path_system'] . 'lib-admin.php';

   912 

   913     $retval = '';

   914 

   915     $grp_name = DB_getItem($_TABLES['groups'], 'grp_name', "grp_id = $group");

   916 

   917     $thisUsersGroups = SEC_getUserGroups();

   918     $groupName = DB_getItem($_TABLES['groups'], 'grp_name', "grp_id='$group'");

   919     if ((!empty($group) && ($group > 0) &&

   920                 !in_array($group, $thisUsersGroups) &&

   921                 !SEC_groupIsRemoteUserAndHaveAccess($group, $thisUsersGroups))

   922             || (($grp_name == 'All Users') ||

   923                 ($grp_name == 'Logged-in Users'))) {

   924         $retval .= COM_startBlock($LANG_ACCESS['usergroupadmin'], '',

   925                                   COM_getBlockTemplate('_msg_block', 'header'));

   926         if (!SEC_inGroup('Root') && ($grp_name == 'Root')) {

   927             $retval .= $LANG_ACCESS['canteditroot'];

   928             COM_accessLog("User {$_USER['username']} tried to edit the Root group with insufficient privileges.");

   929         } else {

   930             $retval .= $LANG_ACCESS['canteditgroup'];

   931         }

   932         $retval .= COM_endBlock(COM_getBlockTemplate('_msg_block', 'footer'));

   933 

   934         return $retval;

   935     }

   936 

   937     $group_listing_url = $_CONF['site_admin_url'] . '/group.php';

   938     $showall = 0;

   939     if (isset($_REQUEST['chk_showall']) && ($_REQUEST['chk_showall'] == 1)) {

   940         $group_listing_url .= '?chk_showall=1';

   941         $showall = 1;

   942     }

   943 

   944     $menu_arr = array(

   945                     array('url'  => $group_listing_url,

   946                           'text' => $LANG28[38]),

   947                     array('url'  => $_CONF['site_admin_url'],

   948                           'text' => $LANG_ADMIN['admin_home'])

   949                 );

   950 

   951     $retval .= COM_startBlock($LANG_ACCESS['usergroupadmin'] . " - $groupName",

   952                         '', COM_getBlockTemplate('_admin_block', 'header'));

   953 

   954     $retval .= ADMIN_createMenu($menu_arr, $LANG_ACCESS['editgroupmsg'],

   955                 $_CONF['layout_url'] . '/images/icons/group.' . $_IMAGE_TYPE);

   956 

   957     $groupmembers = new Template($_CONF['path_layout'] . 'admin/group');

   958     $groupmembers->set_file(array('groupmembers'=>'groupmembers.thtml'));

   959     $groupmembers->set_var('site_url', $_CONF['site_url']);

   960     $groupmembers->set_var('site_admin_url', $_CONF['site_admin_url']);

   961     $groupmembers->set_var('group_listing_url', $group_listing_url);

   962     $groupmembers->set_var('layout_url', $_CONF['layout_url']);

   963     $groupmembers->set_var('phpself', $_CONF['site_admin_url'] . '/group.php');

   964     $groupmembers->set_var('lang_adminhome', $LANG_ACCESS['adminhome']);

   965     $groupmembers->set_var('lang_instructions', $LANG_ACCESS['editgroupmsg']);

   966     $groupmembers->set_var('LANG_sitemembers',$LANG_ACCESS['availmembers']);

   967     $groupmembers->set_var('LANG_grpmembers',$LANG_ACCESS['groupmembers']);

   968     $groupmembers->set_var('sitemembers', grp_selectUsers($group, true));

   969     $groupmembers->set_var('group_list', grp_selectUsers($group));

   970     $groupmembers->set_var('LANG_add',$LANG_ACCESS['add']);

   971     $groupmembers->set_var('LANG_remove',$LANG_ACCESS['remove']);

   972     $groupmembers->set_var('lang_save', $LANG_ADMIN['save']);

   973     $groupmembers->set_var('lang_cancel', $LANG_ADMIN['cancel']);

   974     $groupmembers->set_var('lang_grouplist', $LANG28[38]);

   975     $groupmembers->set_var('show_all', $showall);

   976     $groupmembers->set_var('group_id',$group);

   977     $groupmembers->set_var('xhtml', XHTML);

   978     $groupmembers->set_var('gltoken_name', CSRF_TOKEN);

   979     $groupmembers->set_var('gltoken', SEC_createToken());

   980     $groupmembers->parse('output', 'groupmembers');

   981     $retval .= $groupmembers->finish($groupmembers->get_var('output'));

   982 

   983     $retval .= COM_endBlock(COM_getBlockTemplate('_admin_block', 'footer'));

   984 

   985     return $retval;

   986 }

   987 

   988 /**

   989 * Save changes from the form to add/remove users to/from groups

   990 *

   991 * @param    int     $groupid        id of the group being changed

   992 * @param    string  $groupmembers   list of group members

   993 * @return   string                  HTML redirect

   994 *

   995 */

   996 function savegroupusers($groupid, $groupmembers)

   997 {

   998     global $_CONF, $_TABLES;

   999 

  1000     $retval = '';

  1001 

  1002     // Delete all the current buddy records for this user and add all the selected ones

  1003     $sql = "DELETE FROM {$_TABLES['group_assignments']} WHERE ug_main_grp_id={$groupid} AND ug_uid IS NOT NULL";

  1004     DB_query($sql);

  1005     $adduser = explode('|', $groupmembers);

  1006     for ($i = 0; $i < count($adduser); $i++) {

  1007         $adduser[$i] = COM_applyFilter($adduser[$i], true);

  1008         DB_query("INSERT INTO {$_TABLES['group_assignments']} (ug_main_grp_id, ug_uid) VALUES ('$groupid', '$adduser[$i]')");

  1009     }

  1010 

  1011     if (isset($_REQUEST['chk_showall']) && ($_REQUEST['chk_showall'] == 1)) {

  1012         $retval = COM_refresh($_CONF['site_admin_url'] . '/group.php?msg=49&chk_showall=1');

  1013     } else {

  1014         $retval = COM_refresh($_CONF['site_admin_url'] . '/group.php?msg=49');

  1015     }

  1016 

  1017     return $retval;

  1018 }

  1019 

  1020 /**

  1021 * Delete a group

  1022 *

  1023 * @param    int     $grp_id     id of group to delete

  1024 * @return   string              HTML redirect

  1025 *

  1026 */

  1027 function deleteGroup ($grp_id)

  1028 {

  1029     global $_CONF, $_TABLES, $_USER;

  1030 

  1031     if (!SEC_inGroup ('Root') && (DB_getItem ($_TABLES['groups'], 'grp_name',

  1032             "grp_id = $grp_id") == 'Root')) {

  1033         COM_accessLog ("User {$_USER['username']} tried to delete the Root group with insufficient privileges.");

  1034 

  1035         return COM_refresh ($_CONF['site_admin_url'] . '/group.php');

  1036     }

  1037 

  1038     $GroupAdminGroups = SEC_getUserGroups ();

  1039     if (!in_array ($grp_id, $GroupAdminGroups) && !SEC_groupIsRemoteUserAndHaveAccess($grp_id, $GroupAdminGroups)) {

  1040         COM_accessLog ("User {$_USER['username']} tried to delete group $grp_id with insufficient privileges.");

  1041 

  1042         return COM_refresh ($_CONF['site_admin_url'] . '/group.php');

  1043     }

  1044 

  1045     DB_delete ($_TABLES['access'], 'acc_grp_id', $grp_id);

  1046     DB_delete ($_TABLES['group_assignments'], 'ug_grp_id', $grp_id);

  1047     DB_delete ($_TABLES['group_assignments'], 'ug_main_grp_id', $grp_id);

  1048     DB_delete ($_TABLES['groups'], 'grp_id', $grp_id);

  1049 

  1050     PLG_groupChanged ($grp_id, 'delete');

  1051     if (isset($_REQUEST['chk_showall']) && ($_REQUEST['chk_showall'] == 1)) {

  1052         return COM_refresh($_CONF['site_admin_url'] . '/group.php?msg=50&chk_showall=1');

  1053     } else {

  1054         return COM_refresh($_CONF['site_admin_url'] . '/group.php?msg=50');

  1055     }

  1056 }

  1057 

  1058 // MAIN

  1059 $mode = '';

  1060 if (isset($_REQUEST['mode'])) {

  1061     $mode = $_REQUEST['mode'];

  1062 }

  1063 

  1064 if (($mode == $LANG_ADMIN['delete']) && !empty ($LANG_ADMIN['delete'])) {

  1065     $grp_id = COM_applyFilter ($_REQUEST['grp_id'], true);

  1066     if (!isset ($grp_id) || empty ($grp_id) || ($grp_id == 0)) {

  1067         COM_errorLog ('Attempted to delete group grp_id=' . $grp_id);

  1068         $display .= COM_refresh ($_CONF['site_admin_url'] . '/group.php');

  1069     } elseif (SEC_checkToken()) {

  1070         $display .= deleteGroup ($grp_id);

  1071     } else {

  1072         COM_accessLog("User {$_USER['username']} tried to illegally delete group $grp_id and failed CSRF checks.");

  1073         echo COM_refresh($_CONF['site_admin_url'] . '/index.php');

  1074     }

  1075 } elseif (($mode == $LANG_ADMIN['save']) && !empty($LANG_ADMIN['save']) && SEC_checkToken()) {

  1076     $grp_gl_core = COM_applyFilter($_POST['grp_gl_core'], true);

  1077     $chk_grpadmin = '';

  1078     if (isset($_POST['chk_grpadmin'])) {

  1079         $chk_grpadmin = COM_applyFilter($_POST['chk_grpadmin']);

  1080     }

  1081     $features = array();

  1082     if (isset($_POST['features'])) {

  1083         $features = $_POST['features'];

  1084     }

  1085     $groups = array();

  1086     if (isset($_POST['groups'])) {

  1087         $groups = $_POST['groups'];

  1088     }

  1089     $display .= savegroup(COM_applyFilter($_POST['grp_id'], true),

  1090                           COM_applyFilter($_POST['grp_name']),

  1091                           $_POST['grp_descr'], $chk_grpadmin, $grp_gl_core,

  1092                           $features, $groups);

  1093 } elseif (($mode == 'savegroupusers') && SEC_checkToken()) {

  1094     $grp_id = COM_applyFilter($_REQUEST['grp_id'], true);

  1095     $display .= savegroupusers($grp_id, $_POST['groupmembers']);

  1096 } elseif ($mode == 'edit') {

  1097     $grp_id = 0;

  1098     if (isset ($_REQUEST['grp_id'])) {

  1099         $grp_id = COM_applyFilter ($_REQUEST['grp_id'], true);

  1100     }

  1101     $display .= COM_siteHeader ('menu', $LANG_ACCESS['groupeditor']);

  1102     $display .= editgroup ($grp_id);

  1103     $display .= COM_siteFooter ();

  1104 } elseif ($mode == 'listusers') {

  1105     $grp_id = COM_applyFilter ($_REQUEST['grp_id'], true);

  1106     $display .= COM_siteHeader ('menu', $LANG_ACCESS['groupmembers']);

  1107     $display .= listusers ($grp_id);

  1108     $display .= COM_siteFooter ();

  1109 } elseif ($mode == 'editusers') {

  1110     $grp_id = COM_applyFilter ($_REQUEST['grp_id'], true);

  1111     $display .= COM_siteHeader ('menu', $LANG_ACCESS['usergroupadmin']);

  1112     $display .= editusers ($grp_id);

  1113     $display .= COM_siteFooter ();

  1114 } else { // 'cancel' or no mode at all

  1115     $show_all_groups = false;

  1116     if (isset($_POST['q'])) {

  1117         // check $_POST only, as $_GET['chk_showall'] may also be set

  1118         if (isset($_POST['chk_showall']) && ($_POST['chk_showall'] == 1)) {

  1119             $show_all_groups = true;

  1120         }

  1121     } elseif (isset($_REQUEST['chk_showall']) &&

  1122             ($_REQUEST['chk_showall'] == 1)) {

  1123         $show_all_groups = true;

  1124     }

  1125     $display .= COM_siteHeader('menu', $LANG28[38]);

  1126     $display .= COM_showMessageFromParameter();

  1127     $display .= listgroups($show_all_groups);

  1128     $display .= COM_siteFooter();

  1129 }

  1130 

  1131 COM_output($display);

  1132 

  1133 ?>
Geeklog