Changeset 1684

Timestamp:

11/20/09 08:28:07 (14 years ago)

Author:

niltonneto

Message:

Ticket #773 - Correção de problema crítico no acesso indevido aos links do Admin.

Location:

trunk

Files:

• admin/inc/hook_admin.inc.php (modified) (1 diff)
• admin/inc/hook_sidebox_menu.inc.php (modified) (1 diff)
• calendar/inc/class.uicustom_fields.inc.php (modified) (1 diff)
• calendar/inc/class.uigroup_access.inc.php (modified) (1 diff)
• calendar/inc/class.uiholiday.inc.php (modified) (1 diff)
• expressoAdmin1_2/inc/class.uimanagers.inc.php (modified) (4 diffs)
• expressoAdmin1_2/inc/class.uisectors.inc.php (modified) (1 diff)
• jabberit_messenger/inc/class.uiconforganization.inc.php (modified) (1 diff)
• jabberit_messenger/inc/class.uigroupslocked.inc.php (modified) (1 diff)
• jabberit_messenger/inc/class.uihostsjabber.inc.php (modified) (1 diff)
• jabberit_messenger/inc/class.uimodule.inc.php (modified) (1 diff)

trunk/admin/inc/hook_admin.inc.php

@@ -21 +21 @@
                 $file['Peer Servers']               = $GLOBALS['phpgw']->link('/index.php','menuaction=admin.uiserver.list_servers');
         }
-*/
-        /*if (! $GLOBALS['phpgw']->acl->check('account_access',1,'admin'))
-        {
-                $file['User Accounts']              = $GLOBALS['phpgw']->link('/index.php','menuaction=admin.uiaccounts.list_users');
-        }
-
-        if (! $GLOBALS['phpgw']->acl->check('group_access',1,'admin'))
-        {
-                $file['User Groups']                = $GLOBALS['phpgw']->link('/index.php','menuaction=admin.uiaccounts.list_groups');
-        }*/
-
+*/      
         if (! $GLOBALS['phpgw']->acl->check('applications_access',1,'admin'))
         {

trunk/admin/inc/hook_sidebox_menu.inc.php

@@ -30 +30 @@
                         $file['Site Configuration']         = $GLOBALS['phpgw']->link('/index.php','menuaction=admin.uiconfig.index&appname=admin');
                 }
-/*
+/*              
                 if (! $GLOBALS['phpgw']->acl->check('peer_server_access',1,'admin'))
                 {
                         $file['Peer Servers']               = $GLOBALS['phpgw']->link('/index.php','menuaction=admin.uiserver.list_servers');
-                }
-                if (! $GLOBALS['phpgw']->acl->check('account_access',1,'admin'))
-                {
-                        $file['User Accounts']              = $GLOBALS['phpgw']->link('/index.php','menuaction=admin.uiaccounts.list_users');
-                }
-
-                if (! $GLOBALS['phpgw']->acl->check('group_access',1,'admin'))
-                {
-                        $file['User Groups']                = $GLOBALS['phpgw']->link('/index.php','menuaction=admin.uiaccounts.list_groups');
                 }
 */

trunk/calendar/inc/class.uicustom_fields.inc.php

@@ -40 +40 @@
                 function index($error='')
                 {
+                        if (!$GLOBALS['phpgw']->acl->check('run',1,'admin'))
+                        {
+                              $GLOBALS['phpgw']->redirect($GLOBALS['phpgw']->link('/admin/index.php'));
+                        }
                         unset($GLOBALS['phpgw_info']['flags']['noheader']);
                         unset($GLOBALS['phpgw_info']['flags']['nonavbar']);

trunk/calendar/inc/class.uigroup_access.inc.php

@@ -33 +33 @@
         function index(){
                 
+                if (!$GLOBALS['phpgw']->acl->check('run',1,'admin'))
+                {
+                      $GLOBALS['phpgw']->redirect($GLOBALS['phpgw']->link('/admin/index.php'));
+                }
+
                 $GLOBALS['phpgw_info']['flags'] = array(
                                         'currentapp' => 'calendar',

trunk/calendar/inc/class.uiholiday.inc.php

@@ -48 +48 @@
                 function admin()
                 {
+                        if (!$GLOBALS['phpgw']->acl->check('run',1,'admin'))
+                        {
+                              $GLOBALS['phpgw']->redirect($GLOBALS['phpgw']->link('/admin/index.php'));
+                        }
                         unset($GLOBALS['phpgw_info']['flags']['noheader']);
                         unset($GLOBALS['phpgw_info']['flags']['nonavbar']);

trunk/expressoAdmin1_2/inc/class.uimanagers.inc.php

@@ -53 +53 @@
                 {
                         // Caso nao seja admin, sai.
-                        if ($GLOBALS['phpgw']->acl->check('group_access',1,'admin'))
+                        if (!$GLOBALS['phpgw']->acl->check('run',1,'admin'))
                         {
                                 $GLOBALS['phpgw']->redirect($GLOBALS['phpgw']->link('/admin/index.php'));
@@ -129 +129 @@
                 {
                         // Caso nao seja admin, sai.
-                        if ($GLOBALS['phpgw']->acl->check('group_access',1,'admin'))
+                        if (!$GLOBALS['phpgw']->acl->check('run',1,'admin'))
                         {
                                 $GLOBALS['phpgw']->redirect($GLOBALS['phpgw']->link('/admin/index.php'));
@@ -207 +207 @@
                 function delete_managers()
                 {
+                        if (!$GLOBALS['phpgw']->acl->check('run',1,'admin'))
+                        {
+                                $GLOBALS['phpgw']->redirect($GLOBALS['phpgw']->link('/admin/index.php'));
+                        }
                         // Criar uma verificação e jogar a query para o BO.
                         $context = $_GET['context'];
@@ -232 +236 @@
                 {
                         // Caso nao seja admin, sai.
-                        if ($GLOBALS['phpgw']->acl->check('group_access',1,'admin'))
+                        if (!$GLOBALS['phpgw']->acl->check('run',1,'admin'))
                         {
                                 $GLOBALS['phpgw']->redirect($GLOBALS['phpgw']->link('/admin/index.php'));

trunk/expressoAdmin1_2/inc/class.uisectors.inc.php

@@ -136 +136 @@
                         );
                         $p->set_var($var);
-
-                        if (! $GLOBALS['phpgw']->acl->check('group_access',4,'admin'))
-                        {
-                                $p->set_var('input_add','<input type="submit" value="' . lang('Add Sectors') . '">');
-                        }
+                        $p->set_var('input_add','<input type="submit" value="' . lang('Add Sectors') . '">');
                         
                         $p->parse('rows','row_empty',True);

trunk/jabberit_messenger/inc/class.uiconforganization.inc.php

@@ -90 +90 @@
         public final function backPage()
         {
-                if($GLOBALS['phpgw']->acl->check('applications_access',1,'admin'))
+                if( !$GLOBALS['phpgw']->acl->check('run',1,'admin') )
                 {
-                        $GLOBALS['phpgw']->redirect_link('/index.php');
+                        $GLOBALS['phpgw']->redirect_link('/admin/index.php');
                 }               
                 

trunk/jabberit_messenger/inc/class.uigroupslocked.inc.php

@@ -112 +112 @@
         public final function add()
         {
-                if($GLOBALS['phpgw']->acl->check('applications_access',1,'admin'))
+                if( !$GLOBALS['phpgw']->acl->check('run',1,'admin') )
                 {
-                        $GLOBALS['phpgw']->redirect_link('/index.php');
+                        $GLOBALS['phpgw']->redirect_link('/admin/index.php');
                 }               
                 

trunk/jabberit_messenger/inc/class.uihostsjabber.inc.php

@@ -97 +97 @@
         public final function backPage()
         {
-                if($GLOBALS['phpgw']->acl->check('applications_access',1,'admin'))
+                if( !$GLOBALS['phpgw']->acl->check('run',1,'admin') )
                 {
-                        $GLOBALS['phpgw']->redirect_link('/index.php');
+                        $GLOBALS['phpgw']->redirect_link('/admin/index.php');
                 }               
                 

trunk/jabberit_messenger/inc/class.uimodule.inc.php

@@ -89 +89 @@
         public final function add()
         {
-                if($GLOBALS['phpgw']->acl->check('applications_access',1,'admin'))
+                if( !$GLOBALS['phpgw']->acl->check('run',1,'admin') )
                 {
-                        $GLOBALS['phpgw']->redirect_link('/index.php');
+                        $GLOBALS['phpgw']->redirect_link('/admin/index.php');
                 }