kenken999/php

1<?php2@ini_set("display_errors","1");3@ini_set("display_startup_errors","1");4 5require_once("include/dbcommon.php");6header("Expires: Thu, 01 Jan 1970 00:00:01 GMT"); 7 8//	CSRF protection9if( !isPostRequest() )10	return;11 12if(!isLogged())13{ 14	return;15}16if( !Security::isAdmin() )17{18	return;19}20$nonAdminTablesArr = array();21$nonAdminTablesArr[] = "chat_history";22$nonAdminTablesArr[] = "chat_users";23$nonAdminTablesArr[] = "chat_settings";24$nonAdminTablesArr[] = "chat_files";25$nonAdminTablesArr[] = "chat_groups";26$nonAdminTablesArr[] = "chat_peopletype";27$nonAdminTablesArr[] = "chat_timezone";28$nonAdminTablesArr[] = "chat126_users1";29$nonAdminTablesArr[] = "chat_agent";30$nonAdminTablesArr[] = "chat_external";31$nonAdminTablesArr[] = "agett_prompt";32 33$ug_connection = $cman->getForUserGroups();34 35$cbxNames = array('add' => array('mask' => 'A', 'rightName' => 'add')36	, 'edt' => array('mask' => 'E', 'rightName' => 'edit')37	, 'del' => array('mask' => 'D', 'rightName' => 'delete')38	, 'lst' => array('mask' => 'S', 'rightName' => 'list')39	, 'exp' => array('mask' => 'P', 'rightName' => 'export')40	, 'imp' => array('mask' => 'I', 'rightName' => 'import')41	, 'adm' => array('mask' => 'M'));42 43$wGroupTableName = $ug_connection->addTableWrappers( "Chat2uggroups" );44	45switch(postvalue("a"))46{47	case "add":48		$sql = "insert into ". $wGroupTableName ." (". $ug_connection->addFieldWrappers( "Label" ) .")"49			." values (". $ug_connection->prepareString( postvalue("name") ). ")";		50		$ug_connection->exec( $sql );51 52		$sql = "select max(". $ug_connection->addFieldWrappers( "GroupID") .") from ". $wGroupTableName;53		$data = $ug_connection->query( $sql )->fetchNumeric();54		55		echo printJSON( array('success' => true, 'id' => $data[0]) );56		break;57		58	case "del":59		$sql = "delete from ". $wGroupTableName ." where ". $ug_connection->addFieldWrappers("GroupID") ."=".(postvalue_number("id"));60		$ug_connection->exec( $sql );61		62		$sql = "delete from ". $ug_connection->addTableWrappers( "Chat2ugrights" ) 63			." where ". $ug_connection->addFieldWrappers( "GroupID" ) ."=".(postvalue_number("id"));64		$ug_connection->exec( $sql );65 66		// delete records from ugmembers table	67		$dataSource = Security::getUgMembersDatasource();68		$dc = new DsCommand();69		$dc->filter = DataCondition::FieldEquals( "GroupID", postvalue_number("id") ); 70		$dataSource->deleteSingle( $dc, false );71		72		echo printJSON( array('success' => true) );73		break;74		75	case "rename":76		$sql = "update ". $wGroupTableName  77			." set ". $ug_connection->addFieldWrappers( "Label" ) ."=". $ug_connection->prepareString( postvalue("name") )78			." where ". $ug_connection->addFieldWrappers( "GroupID" ) ."=".(postvalue_number("id"));79		$ug_connection->exec( $sql );80		81		echo printJSON( array('success' => true) );82		break;83	84	// @deprecated 85	// see ug_rights86	case 'saveRights':87		$error = '';88		if( postvalue('state') )89		{	90			$allRights = array();91			$sql = "select ". $ug_connection->addFieldWrappers( "GroupID" ) 92				.", ". $ug_connection->addFieldWrappers( "TableName" ) 93				.", ". $ug_connection->addFieldWrappers( "AccessMask" ) ." from ". $wGroupTableName;94			95			$qResult = $ug_connection->query( $sql );96			// don't use fetchAssoc! because of ORACLE and PostgreSQL97			while( $rightsRow = $qResult->fetchNumeric() )98			{99				$allRights[] = $rightsRow;100			}101			102			$wRightsTableName = $ug_connection->addTableWrappers( "Chat2ugrights" );103			104			$delGroupId = 0;105			$state = my_json_decode( postvalue('state') );106			// delete all extra permissions from db107			foreach($allRights as $i => $rightValue)108			{109				$groupIDInt = (int) $rightValue[0];110				111				if($groupIDInt == $delGroupId)112					continue;113					114				//delete all extra permissions for group115				if( !array_key_exists($groupIDInt, $state) )116				{117					$sql = "delete from ". $wRightsTableName 118						." where ". $ug_connection->addFieldWrappers( "GroupID" ) ."=". $groupIDInt;119					$ug_connection->exec( $sql );120				}121				//delete all extra permissions for table in group122				else if(!array_key_exists(GetTableId($data[1]), $state[$groupIDInt]))123				{124					$sql = "delete from ". $wRightsTableName 125						." where ". $ug_connection->addFieldWrappers( "GroupID" ) ."=". $groupIDInt 126						." and ". $ug_connection->addFieldWrappers( "TableName" ) ."=".$ug_connection->prepareString( html_special_decode($data[1]) );				127					$ug_connection->exec( $sql );128				}129			}130			131			$realTables = GetRealValues();132			foreach ($state as $groupId => $groupRights)133			{134				foreach ($groupRights as $table => $mask)135				{136					if( !array_key_exists($table, $realTables) )137						continue;138					139					$ins = true;140					foreach($allRights as $i => $rightValue)141					{	142						if($rightValue[0] == $groupId && $rightValue[1] == $realTables[$table])	143						{144							$ins = false;145							if($data[2]!= $mask)146							{147								$sql ="update". $wRightsTableName 148									." set ". $ug_connection->addFieldWrappers( "AccessMask" ) ."=". $ug_connection->prepareString( $mask )149									." where ". $ug_connection->addFieldWrappers( "GroupID" ) ."=". $groupId 150									." and ". $ug_connection->addFieldWrappers( "TableName" ) ."=". $ug_connection->prepareString( html_special_decode($realTables[$table]) );151								$ug_connection->exec( $sql );152							}153						}154					}155					if($ins)156					{157						$sql = "insert into ". $wRightsTableName158							." (". $ug_connection->addFieldWrappers( "TableName" ) 159							.", ". $ug_connection->addFieldWrappers( "GroupID" ) 160							.", ". $ug_connection->addFieldWrappers( "AccessMask" ) .") " 161							."values (". $ug_connection->prepareString(html_special_decode($realTables[$table])) .", ". $groupId .", ". $ug_connection->prepareString($mask)  .")";162						$ug_connection->exec( $sql );163					}164					165					$error = $ug_connection->lastError();166				}167			}168		}169		170		getJSONResult($error);171		break;172}173 174function GetTableId($name)175{176	$tbls = GetRealValues();177	for($i = 0;$i < count($tbls); $i++)178	{179		if($tbls[$i] == $name)180			return $i;181	}182	return -1;183}184 185/**186 * GetRealValues187 * Form array with real users or tables names188 * @return {array} array of reaf names189 */190function GetRealValues()191{192	$result = array();193	if(postvalue('realValues'))194		$realValues = my_json_decode(postvalue('realValues'));195		foreach ($realValues as $key =>$value)196			$result[$key] = $value;197	return $result;198}199 200/**201 * getJSONResult202 * Form result as a JSON object according of errors203 * @param {string} list of errors204 */205function getJSONResult($error)206{207	$result['success'] = $error == '';208	$result['error'] = $error;	209	echo printJSON($result);210}