return $groups;
}
- // getUser function is used to manage users in group and returns user details.
+ // getUserDetails function is used to manage users in group and returns user details.
// At the moment, the function is used for user edits and deletes.
- function getUser($user_id) {
+ function getUserDetails($user_id) {
if (!$this->can('manage_users')) return false;
$mdb2 = getConnection();
$group_id = $this->getGroup();
$org_id = $this->org_id;
+ // Determine max rank. If we are searching in on behalf group
+ // then rank restriction does not apply.
+ $max_rank = $this->behalfGroup ? MAX_RANK : $this->rank;
+
$sql = "select u.id, u.name, u.login, u.role_id, u.client_id, u.status, u.rate, u.email from tt_users u".
" left join tt_roles r on (u.role_id = r.id)".
" where u.id = $user_id and u.group_id = $group_id and u.org_id = $org_id and u.status is not null".
- " and (r.rank < $this->rank or (r.rank = $this->rank and u.id = $this->id))"; // Users with lesser roles or self.
+ " and (r.rank < $max_rank or (r.rank = $max_rank and u.id = $this->id))"; // Users with lesser roles or self.
$res = $mdb2->query($sql);
if (!is_a($res, 'PEAR_Error')) {
$val = $res->fetchRow();
return false;
// Make sure we operate on a legit user.
- $user_details = $this->getUser($user_id);
+ $user_details = $this->getUserDetails($user_id);
if (!$user_details) return false;
$mdb2 = getConnection();
function isUserValid($user_id) {
if ($user_id == $this->id)
return true;
-
- $user_details = $this->getUser($user_id); // TODO: this will probably not work for higher ranks.
- // In this case we'll need another function.
- // Or adjust getUser for max rank.
- if (!$user_details)
- return false;
-
- return true;
+ return ($this->getUserDetails($user_id) != null);
}
// isGroupValid determines if a group is valid for user.
<br>
<table cellspacing="0" cellpadding="4" width="100%" border="0">
<tr>
- <td align="center"> Anuko Time Tracker 1.18.28.4529 | Copyright © <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |
+ <td align="center"> Anuko Time Tracker 1.18.28.4530 | Copyright © <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |
<a href="https://www.anuko.com/lp/tt_4.htm" target="_blank">{$i18n.footer.credits}</a> |
<a href="https://www.anuko.com/lp/tt_5.htm" target="_blank">{$i18n.footer.license}</a> |
<a href="https://www.anuko.com/lp/tt_7.htm" target="_blank">{$i18n.footer.improve}</a>
}
$userChanged = $request->getParameter('user_changed'); // Reused in multiple places below.
if ($userChanged && !($user->can('track_time') && $user->isUserValid($request->getParameter('user')))) {
- header('Location: access_denied.php'); // Group changed, but no rght or wrong group id.
+ header('Location: access_denied.php'); // Group changed, but no rght or wrong user id.
exit();
}
}