maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

fix deleting of Certificates as admin with customer_see_all flag

Browse Source 
Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
This commit is contained in:
Michael Kaufmann
2018-12-16 09:27:31 +01:00
parent efe54d8b56
commit aa90747089
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
lib/classes/api/commands/class.Certificates.php
View File

@@ -214,7 +214,6 @@ class Certificates extends ApiCommand implements ResourceEntity
{ {
$id = $this->getParam('id'); $id = $this->getParam('id');
$chk = ($this->isAdmin() && $this->getUserDetail('customers_see_all') == '1') ? true : false;
if ($this->isAdmin() == false) { if ($this->isAdmin() == false) {
$chk_stmt = Database::prepare(" $chk_stmt = Database::prepare("
SELECT d.domain FROM `" . TABLE_PANEL_DOMAINS . "` d SELECT d.domain FROM `" . TABLE_PANEL_DOMAINS . "` d
@@ -225,16 +224,18 @@ class Certificates extends ApiCommand implements ResourceEntity
'id' => $id, 'id' => $id,
'cid' => $this->getUserDetail('customerid') 'cid' => $this->getUserDetail('customerid')
)); ));
} elseif ($this->isAdmin() && $this->getUserDetail('customers_see_all') == '0') { } elseif ($this->isAdmin()) {
$chk_stmt = Database::prepare(" $chk_stmt = Database::prepare("
SELECT d.domain FROM `" . TABLE_PANEL_DOMAINS . "` d SELECT d.domain FROM `" . TABLE_PANEL_DOMAINS . "` d
LEFT JOIN `" . TABLE_PANEL_DOMAIN_SSL_SETTINGS . "` s ON s.domainid = d.id LEFT JOIN `" . TABLE_PANEL_DOMAIN_SSL_SETTINGS . "` s ON s.domainid = d.id
WHERE s.`id` = :id AND d.`adminid` = :aid WHERE s.`id` = :id" . ($this->getUserDetail('customers_see_all') == '0' ? " AND d.`adminid` = :aid" : ""));
"); $params = array(
$chk = Database::pexecute_first($chk_stmt, array( 'id' => $id
'id' => $id, );
'aid' => $this->getUserDetail('adminid') if ($this->getUserDetail('customers_see_all') == '0') {
)); $params['aid'] = $this->getUserDetail('adminid');
}
$chk = Database::pexecute_first($chk_stmt, $params);
} }
if ($chk !== false) { if ($chk !== false) {
// additional access check by trying to get the certificate // additional access check by trying to get the certificate