}
return $user_list;
}
+
+ // checkBehalfId checks whether behalf_id is appropriate.
+ // On behalf user must be active and have lower rank.
+ function checkBehalfId() {
+ $options = array('status'=>ACTIVE,'max_rank'=>$this->rank-1);
+ $users = $this->getUsers($options);
+ foreach($users as $one_user) {
+ if ($one_user['id'] == $this->behalf_id)
+ return true;
+ }
+
+ return false;
+ }
+
+ // adjustBehalfId attempts to adjust behalf_id and behalf_name to a first found
+ // aapropriate user.
+ //
+ // Needed for situations when use does not have do_own_something right.
+ // Example: has view_charts but does not have view_own_charts.
+ // In this case we still allow access to charts, but set behalf_id to someone else.
+ function adjustBehalfId() {
+ $options = array('status'=>ACTIVE,'max_rank'=>$this->rank-1);
+ $users = $this->getUsers($options);
+ foreach($users as $one_user) {
+ // Fake loop to access first element.
+ $this->behalf_id = $one_user['id'];
+ $this->behalf_name = $one_user['name'];
+ $_SESSION['behalf_id'] = $this->behalf_id;
+ $_SESSION['behalf_name'] = $this->behalf_name;
+ return true;
+ }
+ return false;
+ }
}
<br>
<table cellspacing="0" cellpadding="4" width="100%" border="0">
<tr>
- <td align="center"> Anuko Time Tracker 1.17.71.4163 | Copyright © <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |
+ <td align="center"> Anuko Time Tracker 1.17.71.4164 | Copyright © <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |
<a href="https://www.anuko.com/lp/tt_4.htm" target="_blank">{$i18n.footer.credits}</a> |
<a href="https://www.anuko.com/lp/tt_5.htm" target="_blank">{$i18n.footer.license}</a> |
<a href="https://www.anuko.com/lp/tt_7.htm" target="_blank">{$i18n.footer.improve}</a>
header('Location: feature_disabled.php');
exit();
}
+if ($user->behalf_id && (!$user->can('view_charts') || !$user->checkBehalfId())) {
+ header('Location: access_denied.php'); // Trying on behalf, but no right or wrong user.
+ exit();
+}
+if (!$user->behalf_id && !$user->can('view_own_charts') && !$user->adjustBehalfId()) {
+ header('Location: access_denied.php'); // Trying as self, but no right for self, and noone to view on behalf.
+ exit();
+}
// Initialize and store date in session.
$cl_date = $request->getParameter('date', @$_SESSION['date']);