maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

fix deleting of Certificates as admin with customer_see_all flag

Browse Source 
Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
This commit is contained in:
Michael Kaufmann
2018-12-16 09:27:31 +01:00
parent efe54d8b56
commit aa90747089
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
lib/classes/api/commands/class.Certificates.php
View File

@@ -214,7 +214,6 @@ class Certificates extends ApiCommand implements ResourceEntity
{
$id = $this->getParam('id');
$chk = ($this->isAdmin() && $this->getUserDetail('customers_see_all') == '1') ? true : false;
if ($this->isAdmin() == false) {
$chk_stmt = Database::prepare("
SELECT d.domain FROM `" . TABLE_PANEL_DOMAINS . "` d
@@ -225,16 +224,18 @@ class Certificates extends ApiCommand implements ResourceEntity
'id' => $id,
'cid' => $this->getUserDetail('customerid')
));
} elseif ($this->isAdmin() && $this->getUserDetail('customers_see_all') == '0') {
} elseif ($this->isAdmin()) {
$chk_stmt = Database::prepare("
SELECT d.domain FROM `" . TABLE_PANEL_DOMAINS . "` d
LEFT JOIN `" . TABLE_PANEL_DOMAIN_SSL_SETTINGS . "` s ON s.domainid = d.id
WHERE s.`id` = :id AND d.`adminid` = :aid
");
$chk = Database::pexecute_first($chk_stmt, array(
'id' => $id,
'aid' => $this->getUserDetail('adminid')
));
WHERE s.`id` = :id" . ($this->getUserDetail('customers_see_all') == '0' ? " AND d.`adminid` = :aid" : ""));
$params = array(
'id' => $id
);
if ($this->getUserDetail('customers_see_all') == '0') {
$params['aid'] = $this->getUserDetail('adminid');
}
$chk = Database::pexecute_first($chk_stmt, $params);
}
if ($chk !== false) {
// additional access check by trying to get the certificate