Changeset 1684 for trunk/expressoAdmin1_2/inc

Timestamp:

11/20/09 08:28:07 (14 years ago)

Author:

niltonneto

Message:

Ticket #773 - Correção de problema crítico no acesso indevido aos links do Admin.

Location:

trunk/expressoAdmin1_2/inc

Files:

• class.uimanagers.inc.php (modified) (4 diffs)
• class.uisectors.inc.php (modified) (1 diff)

trunk/expressoAdmin1_2/inc/class.uimanagers.inc.php

@@ -53 +53 @@
                 {
                         // Caso nao seja admin, sai.
-                        if ($GLOBALS['phpgw']->acl->check('group_access',1,'admin'))
+                        if (!$GLOBALS['phpgw']->acl->check('run',1,'admin'))
                         {
                                 $GLOBALS['phpgw']->redirect($GLOBALS['phpgw']->link('/admin/index.php'));
@@ -129 +129 @@
                 {
                         // Caso nao seja admin, sai.
-                        if ($GLOBALS['phpgw']->acl->check('group_access',1,'admin'))
+                        if (!$GLOBALS['phpgw']->acl->check('run',1,'admin'))
                         {
                                 $GLOBALS['phpgw']->redirect($GLOBALS['phpgw']->link('/admin/index.php'));
@@ -207 +207 @@
                 function delete_managers()
                 {
+                        if (!$GLOBALS['phpgw']->acl->check('run',1,'admin'))
+                        {
+                                $GLOBALS['phpgw']->redirect($GLOBALS['phpgw']->link('/admin/index.php'));
+                        }
                         // Criar uma verificação e jogar a query para o BO.
                         $context = $_GET['context'];
@@ -232 +236 @@
                 {
                         // Caso nao seja admin, sai.
-                        if ($GLOBALS['phpgw']->acl->check('group_access',1,'admin'))
+                        if (!$GLOBALS['phpgw']->acl->check('run',1,'admin'))
                         {
                                 $GLOBALS['phpgw']->redirect($GLOBALS['phpgw']->link('/admin/index.php'));

trunk/expressoAdmin1_2/inc/class.uisectors.inc.php

@@ -136 +136 @@
                         );
                         $p->set_var($var);
-
-                        if (! $GLOBALS['phpgw']->acl->check('group_access',4,'admin'))
-                        {
-                                $p->set_var('input_add','<input type="submit" value="' . lang('Add Sectors') . '">');
-                        }
+                        $p->set_var('input_add','<input type="submit" value="' . lang('Add Sectors') . '">');
                         
                         $p->parse('rows','row_empty',True);