From ec09b18c9c44f85ceb6d9e7588a03a221cd1193f Mon Sep 17 00:00:00 2001
From: tbrehm <t.brehm@ispconfig.org>
Date: Fri, 12 Dec 2008 05:47:05 -0500
Subject: [PATCH] Disallow server changes for existing records in mail_domain_edit.php
---
interface/web/client/client_edit.php | 49 ++++++++++++++++++++++++++++++++-----------------
1 files changed, 32 insertions(+), 17 deletions(-)
diff --git a/interface/web/client/client_edit.php b/interface/web/client/client_edit.php
index 473de4b..23e445f 100644
--- a/interface/web/client/client_edit.php
+++ b/interface/web/client/client_edit.php
@@ -41,11 +41,8 @@
require_once('../../lib/config.inc.php');
require_once('../../lib/app.inc.php');
-// Checking module permissions
-if(!stristr($_SESSION["s"]["user"]["modules"],$_SESSION["s"]["module"]["name"])) {
- header("Location: ../index.php");
- exit;
-}
+//* Check permissions for module
+$app->auth->check_module_permissions('client');
// Loading classes
$app->uses('tpl,tform,tform_actions');
@@ -60,23 +57,34 @@
function onAfterInsert() {
global $app;
// Create the group for the client
- $sql = "INSERT INTO sys_group (name,description,client_id) VALUES ('".addslashes($this->dataRecord["username"])."','',".$this->id.")";
+ $sql = "INSERT INTO sys_group (name,description,client_id) VALUES ('".mysql_real_escape_string($this->dataRecord["username"])."','',".$this->id.")";
$app->db->query($sql);
$groupid = $app->db->insertID();
+ $groups = $groupid;
- $username = addslashes($this->dataRecord["username"]);
- $password = addslashes($this->dataRecord["password"]);
- $modules = 'mail,sites,dns';
+ $username = mysql_real_escape_string($this->dataRecord["username"]);
+ $password = mysql_real_escape_string($this->dataRecord["password"]);
+ $modules = ISPC_INTERFACE_MODULES_ENABLED;
+ if($this->dataRecord["limit_client"] > 0) $modules .= ',client';
$startmodule = 'mail';
- $usertheme = addslashes($this->dataRecord["usertheme"]);
+ $usertheme = mysql_real_escape_string($this->dataRecord["usertheme"]);
$type = 'user';
$active = 1;
- $language = addslashes($this->dataRecord["language"]);
+ $language = mysql_real_escape_string($this->dataRecord["language"]);
// Create the controlpaneluser for the client
$sql = "INSERT INTO sys_user (username,passwort,modules,startmodule,app_theme,typ,active,language,groups,default_group,client_id)
- VALUES ('$username',md5('$password'),'$modules','$startmodule','$usertheme','$type','$active','$language',$groupid,$groupid,".$this->id.")";
+ VALUES ('$username',md5('$password'),'$modules','$startmodule','$usertheme','$type','$active','$language',$groups,$groupid,".$this->id.")";
$app->db->query($sql);
+
+ //* If the user who inserted the client is a reseller (not admin), we will have to add this new client group
+ //* to his groups, so he can administrate the records of this client.
+ if($_SESSION['s']['user']['typ'] == 'user') {
+ $app->auth->add_group_to_user($_SESSION['s']['user']['userid'],$groupid);
+ $app->db->query("UPDATE client SET parent_client_id = ".intval($_SESSION['s']['user']['client_id'])." WHERE client_id = ".$this->id);
+ }
+
+
}
@@ -89,7 +97,7 @@
// username changed
if(isset($app->tform->diffrec['username'])) {
- $username = addslashes($this->dataRecord["username"]);
+ $username = mysql_real_escape_string($this->dataRecord["username"]);
$client_id = $this->id;
$sql = "UPDATE sys_user SET username = '$username' WHERE client_id = $client_id";
$app->db->query($sql);
@@ -98,15 +106,22 @@
}
// password changed
- if($this->dataRecord["password"] != '') {
- $password = addslashes($this->dataRecord["password"]);
+ if(isset($this->dataRecord["password"]) && $this->dataRecord["password"] != '') {
+ $password = mysql_real_escape_string($this->dataRecord["password"]);
$client_id = $this->id;
$sql = "UPDATE sys_user SET passwort = md5('$password') WHERE client_id = $client_id";
$app->db->query($sql);
}
-
-
+ // reseller status changed
+ if(isset($this->dataRecord["limit_client"])) {
+ $modules = ISPC_INTERFACE_MODULES_ENABLED;
+ if($this->dataRecord["limit_client"] > 0) $modules .= ',client';
+ $modules = mysql_real_escape_string($modules);
+ $client_id = $this->id;
+ $sql = "UPDATE sys_user SET modules = '$modules' WHERE client_id = $client_id";
+ $app->db->query($sql);
+ }
}
--
Gitblit v1.9.1