diff --git a/app/xml_edit/fileread.php b/app/xml_edit/fileread.php
index 46e74805a4..906c3bc35f 100644
--- a/app/xml_edit/fileread.php
+++ b/app/xml_edit/fileread.php
@@ -36,7 +36,6 @@ else {
$filename = check_str($_POST["file"]);
$filename = str_replace ("\\", "/", $filename);
-
$handle = fopen($filename, "r");
if ($handle) {
while (!feof($handle)) {
diff --git a/core/default_settings/app_config.php b/core/default_settings/app_config.php
index dc3e5a76fd..23b0e8967d 100644
--- a/core/default_settings/app_config.php
+++ b/core/default_settings/app_config.php
@@ -1,7 +1,7 @@
\n";
//prepare to page the results
- $sql = "";
- $sql .= " select count(*) as num_rows from v_default_settings ";
+ $sql = "select count(*) as num_rows from v_default_settings ";
if (strlen($order_by)> 0) { $sql .= "order by $order_by $order "; }
$prep_statement = $db->prepare($sql);
if ($prep_statement) {
@@ -83,16 +82,15 @@ require_once "includes/paging.php";
list($paging_controls, $rows_per_page, $var3) = paging($num_rows, $param, $rows_per_page);
$offset = $rows_per_page * $page;
- //get the domain list
- $sql = "";
- $sql .= " select * from v_default_settings ";
+ //get the list
+ $sql = "select * from v_default_settings ";
if (strlen($order_by) == 0) {
$sql .= "order by default_setting_category, default_setting_subcategory asc ";
}
else {
$sql .= "order by $order_by $order ";
}
- $sql .= " limit $rows_per_page offset $offset ";
+ $sql .= "limit $rows_per_page offset $offset ";
$prep_statement = $db->prepare(check_sql($sql));
$prep_statement->execute();
$result = $prep_statement->fetchAll(PDO::FETCH_NAMED);
@@ -120,7 +118,12 @@ require_once "includes/paging.php";
echo th_order_by('default_setting_enabled', 'Enabled', $order_by, $order);
echo th_order_by('default_setting_description', 'Description', $order_by, $order);
echo "
\n";
- echo " $v_link_label_add\n";
+ if (permission_exists('default_setting_add')) {
+ echo " $v_link_label_add\n";
+ }
+ else {
+ echo " \n";
+ }
echo " | \n";
echo "\n";
}
@@ -133,8 +136,7 @@ require_once "includes/paging.php";
$subcategory = $row['default_setting_subcategory'];
$name = $row['default_setting_name'];
if ($category == "domain" && $subcategory == "menu" && $name == "uuid" ) {
- $sql = "";
- $sql .= "select * from v_menus ";
+ $sql = "select * from v_menus ";
$sql .= "where menu_uuid = '".$row['default_setting_value']."' ";
$sub_prep_statement = $db->prepare(check_sql($sql));
$sub_prep_statement->execute();
@@ -150,8 +152,12 @@ require_once "includes/paging.php";
echo " ".$row['default_setting_enabled']." | \n";
echo " ".$row['default_setting_description']." | \n";
echo " \n";
- echo " $v_link_label_edit\n";
- echo " $v_link_label_delete\n";
+ if (permission_exists('default_setting_edit')) {
+ echo " $v_link_label_edit\n";
+ }
+ if (permission_exists('default_setting_delete')) {
+ echo " $v_link_label_delete\n";
+ }
echo " | \n";
echo "\n";
$previous_category = $row['default_setting_category'];
@@ -167,7 +173,12 @@ require_once "includes/paging.php";
echo " | \n";
echo " $paging_controls | \n";
echo " \n";
- echo " $v_link_label_add\n";
+ if (permission_exists('default_setting_add')) {
+ echo " $v_link_label_add\n";
+ }
+ else {
+ echo " \n";
+ }
echo " | \n";
echo " \n";
echo " \n";
diff --git a/core/default_settings/default_settings_delete.php b/core/default_settings/default_settings_delete.php
index 3fc3a2f08b..e8ef0e5ca5 100644
--- a/core/default_settings/default_settings_delete.php
+++ b/core/default_settings/default_settings_delete.php
@@ -26,7 +26,7 @@
require_once "root.php";
require_once "includes/require.php";
require_once "includes/checkauth.php";
-if (if_group("admin") || if_group("superadmin")) {
+if (permission_exists('default_setting_delete')) {
//access granted
}
else {
@@ -39,6 +39,7 @@ if (count($_GET)>0) {
}
if (strlen($id)>0) {
+ //delete default_setting
$sql = "delete from v_default_settings ";
$sql .= "where default_setting_uuid = '$id' ";
$prep_statement = $db->prepare(check_sql($sql));
@@ -46,12 +47,13 @@ if (strlen($id)>0) {
unset($sql);
}
-require_once "includes/header.php";
-echo "\n";
-echo "\n";
-echo "Delete Complete\n";
-echo "
\n";
-require_once "includes/footer.php";
-return;
+//redirect the user
+ require_once "includes/header.php";
+ echo "\n";
+ echo "\n";
+ echo "Delete Complete\n";
+ echo "
\n";
+ require_once "includes/footer.php";
+ return;
?>
\ No newline at end of file
diff --git a/core/default_settings/default_settings_edit.php b/core/default_settings/default_settings_edit.php
index 22e68c0868..42d33acfd5 100644
--- a/core/default_settings/default_settings_edit.php
+++ b/core/default_settings/default_settings_edit.php
@@ -26,7 +26,7 @@
require_once "root.php";
require_once "includes/require.php";
require_once "includes/checkauth.php";
-if (if_group("admin") || if_group("superadmin")) {
+if (permission_exists('default_setting_add') || permission_exists('default_setting_edit')) {
//access granted
}
else {
@@ -82,7 +82,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
//add or update the database
if ($_POST["persistformvar"] != "true") {
- if ($action == "add") {
+ if ($action == "add" && permission_exists('default_setting_add')) {
$sql = "insert into v_default_settings ";
$sql .= "(";
$sql .= "default_setting_uuid, ";
@@ -115,7 +115,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
return;
} //if ($action == "add")
- if ($action == "update") {
+ if ($action == "update" && permission_exists('default_setting_edit')) {
$sql = "update v_default_settings set ";
$sql .= "default_setting_category = '$default_setting_category', ";
$sql .= "default_setting_subcategory = '$default_setting_subcategory', ";
@@ -140,7 +140,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
//pre-populate the form
if (count($_GET)>0 && $_POST["persistformvar"] != "true") {
- $default_setting_uuid = $_GET["id"];
+ $default_setting_uuid = check_str($_GET["id"]);
$sql = "select * from v_default_settings ";
$sql .= "where default_setting_uuid = '$default_setting_uuid' ";
$prep_statement = $db->prepare(check_sql($sql));
@@ -166,7 +166,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
echo "\n";
echo "\n";
echo " \n";
- echo " ";
+ echo " ";
echo " |
\n";
}
@@ -149,8 +153,12 @@ require_once "includes/paging.php";
echo " ".$row['domain_setting_enabled']." | \n";
echo " ".$row['domain_setting_description']." | \n";
echo " \n";
+ if (permission_exists('domain_setting_edit')) {
echo " $v_link_label_edit\n";
+ }
+ if (permission_exists('domain_setting_delete')) {
echo " $v_link_label_delete\n";
+ }
echo " | \n";
echo "\n";
$previous_category = $row['domain_setting_category'];
@@ -166,7 +174,12 @@ require_once "includes/paging.php";
echo " | \n";
echo " $paging_controls | \n";
echo " \n";
- echo " $v_link_label_add\n";
+ if (permission_exists('domain_setting_add')) {
+ echo " $v_link_label_add\n";
+ }
+ else {
+ echo " \n";
+ }
echo " | \n";
echo " \n";
echo "
\n";
diff --git a/core/domains/domain_settings_delete.php b/core/domains/domain_settings_delete.php
index eeee263f8d..82a3d81ac7 100644
--- a/core/domains/domain_settings_delete.php
+++ b/core/domains/domain_settings_delete.php
@@ -26,7 +26,7 @@
require_once "root.php";
require_once "includes/require.php";
require_once "includes/checkauth.php";
-if (if_group("admin") || if_group("superadmin")) {
+if (permission_exists('domain_setting_delete')) {
//access granted
}
else {
@@ -40,21 +40,22 @@ if (count($_GET)>0) {
}
if (strlen($id)>0) {
- $sql = "";
- $sql .= "delete from v_domain_settings ";
- $sql .= "where domain_uuid = '$domain_uuid' ";
- $sql .= "and domain_setting_uuid = '$id' ";
- $prep_statement = $db->prepare(check_sql($sql));
- $prep_statement->execute();
- unset($sql);
+ //delete domain_setting
+ $sql = "delete from v_domain_settings ";
+ $sql .= "where domain_uuid = '$domain_uuid' ";
+ $sql .= "and domain_setting_uuid = '$id' ";
+ $prep_statement = $db->prepare(check_sql($sql));
+ $prep_statement->execute();
+ unset($sql);
}
-require_once "includes/header.php";
-echo "\n";
-echo "\n";
-echo "Delete Complete\n";
-echo "
\n";
-require_once "includes/footer.php";
-return;
+//redirect the user
+ require_once "includes/header.php";
+ echo "\n";
+ echo "\n";
+ echo "Delete Complete\n";
+ echo "
\n";
+ require_once "includes/footer.php";
+ return;
?>
\ No newline at end of file
diff --git a/core/domains/domain_settings_edit.php b/core/domains/domain_settings_edit.php
index 8606e3e591..c21bdad129 100644
--- a/core/domains/domain_settings_edit.php
+++ b/core/domains/domain_settings_edit.php
@@ -26,7 +26,7 @@
require_once "root.php";
require_once "includes/require.php";
require_once "includes/checkauth.php";
-if (if_group("admin") || if_group("superadmin")) {
+if (permission_exists('domain_setting_add') || permission_exists('domain_setting_edit')) {
//access granted
}
else {
@@ -87,7 +87,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
//add or update the database
if ($_POST["persistformvar"] != "true") {
- if ($action == "add") {
+ if ($action == "add" && permission_exists('domain_setting_add')) {
$sql = "insert into v_domain_settings ";
$sql .= "(";
$sql .= "domain_uuid, ";
@@ -122,7 +122,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
return;
} //if ($action == "add")
- if ($action == "update") {
+ if ($action == "update" && permission_exists('domain_setting_edit')) {
$sql = "update v_domain_settings set ";
$sql .= "domain_setting_category = '$domain_setting_category', ";
$sql .= "domain_setting_subcategory = '$domain_setting_subcategory', ";
@@ -148,7 +148,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
//pre-populate the form
if (count($_GET)>0 && $_POST["persistformvar"] != "true") {
- $domain_setting_uuid = $_GET["id"];
+ $domain_setting_uuid = check_str($_GET["id"]);
$sql = "select * from v_domain_settings ";
$sql .= "where domain_uuid = '$domain_uuid' ";
$sql .= "and domain_setting_uuid = '$domain_setting_uuid' ";
@@ -175,7 +175,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
echo "\n";
echo "\n";
echo " \n";
- echo " ";
+ echo " ";
echo " |