cl-linkchecker/includes/include.checkperms.php

<?php

/**
 * Project: 
 * Contenido Content Management System
 * 
 * Description: 
 * Checks userrights for cats
 * 
 * Requirements: 
 * @con_php_req 5.0
 * 
 *
 * @package    Contenido Backend plugins
 * @version    1.0.1
 * @author     Mario Diaz
 * @copyright  four for business AG <www.4fb.de>
 * @license    http://www.contenido.org/license/LIZENZ.txt
 * @link       http://www.4fb.de
 * @link       http://www.contenido.org
 * @since      file available since contenido release 4.8.7
 * 
 * {@internal 
 *   created 2006-06-08
 *   modified 2007-11-07, Frederic Schneider, Linkchecker-Edition
 *   modified 2008-02-08, Andreas Lindner, Performance enhancements
 *   modified 2008-07-02, Frederic Schneider, add security fix
 *
 *   $Id: include.checkperms.php 128 2019-07-03 11:58:28Z oldperl $:
 * }}
 * 
 */
if (!defined('CON_FRAMEWORK')) {
    die('Illegal call');
}

function cCatPerm($widcat, $db = null) {
    global $cfg, $sess, $auth, $group_id, $_arrCatIDs_cCP;

    if (strpos($auth->auth['perm'], 'admin') !== FALSE) {
        return true;
    }

    if (is_null($db) || !is_object($db)) {
        $db = new DB_ConLite;
    }

    $group_ids = getGroupIDs($db);
    $group_ids[] = Contenido_Security::escapeDB($auth->auth['uid'], $db);

    if (!is_array($_arrCatIDs_cCP)) {
        $_arrCatIDs_cCP = array();

        $sql_inc = " user_id='";
        $sql_inc .= implode("' OR user_id='", $group_ids) . "' ";
        $sql = "SELECT idcat FROM " . $cfg['tab']['rights'] . "
				WHERE idarea=6 AND idaction=359 AND ($sql_inc)";

        $db->query($sql);

        while ($db->next_record()) {
            $_arrCatIDs_cCP[$db->f('idcat')] = '';
        }
    }

    return array_key_exists($widcat, $_arrCatIDs_cCP);
}

function getGroupIDs(&$db) {
    global $cfg, $sess, $auth, $group_id, $_arrGroupIDs_gGI;

    if (is_array($_arrGroupIDs_gGI)) {
        return $_arrGroupIDs_gGI;
    }

    $sql = "SELECT group_id FROM " . $cfg["tab"]["groupmembers"] . " WHERE user_id='" . Contenido_Security::escapeDB($auth->auth["uid"], $db) . "'";
    $db->query($sql);

    $_arrGroupIDs_gGI = array();

    while ($db->next_record())
        $_arrGroupIDs_gGI[] = $db->f('group_id');

    return $_arrGroupIDs_gGI;
}

?>