From 7ee3c819f01d28606e91c7da42c42ae930effa54 Mon Sep 17 00:00:00 2001
From: ftimme <ft@falkotimme.com>
Date: Wed, 14 Aug 2013 14:49:05 -0400
Subject: [PATCH] - Make sure clients can get only the PHP versions they are allowed to get even if the website is created by admin or a reseller.
---
interface/web/sites/ajax_get_json.php | 10 ++++++++--
1 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/interface/web/sites/ajax_get_json.php b/interface/web/sites/ajax_get_json.php
index c1c0336..9da4513 100644
--- a/interface/web/sites/ajax_get_json.php
+++ b/interface/web/sites/ajax_get_json.php
@@ -78,12 +78,18 @@
//* Reseller: If the logged in user is not admin and has sub clients (is a reseller)
} elseif ($_SESSION["s"]["user"]["typ"] != 'admin' && $app->auth->has_clients($_SESSION['s']['user']['userid'])) {
$client = $app->db->queryOneRecord("SELECT client_id FROM sys_group WHERE groupid = $client_group_id");
- $sql_where = " AND (client_id = 0 OR client_id = ".$_SESSION["s"]["user"]["client_id"];
+ //$sql_where = " AND (client_id = 0 OR client_id = ".$_SESSION["s"]["user"]["client_id"];
+ $sql_where = " AND (client_id = 0";
if($app->functions->intval($client['client_id']) > 0) $sql_where .= " OR client_id = ".$app->functions->intval($client['client_id']);
$sql_where .= ")";
//* Admin: If the logged in user is admin
} else {
- $sql_where = '';
+ //$sql_where = '';
+ $client = $app->db->queryOneRecord("SELECT client_id FROM sys_group WHERE groupid = $client_group_id");
+ //$sql_where = " AND (client_id = 0 OR client_id = ".$_SESSION["s"]["user"]["client_id"];
+ $sql_where = " AND (client_id = 0";
+ if($app->functions->intval($client['client_id']) > 0) $sql_where .= " OR client_id = ".$app->functions->intval($client['client_id']);
+ $sql_where .= ")";
}
if($php_type == 'php-fpm'){
--
Gitblit v1.9.1