Improved getUserDetails to not return info for deleted users.

diff --git a/WEB-INF/lib/ttUserHelper.class.php b/WEB-INF/lib/ttUserHelper.class.php
index e4591ea43e63970c6b3a9328ac0ce6e09ff2a4a7..583049bd75d3270d3cad4a4595f14dd9950e048a 100644 (file)
--- a/WEB-INF/lib/ttUserHelper.class.php
+++ b/WEB-INF/lib/ttUserHelper.class.php
@@ -36,7 +36,7 @@ class ttUserHelper {
     global $user;
     $mdb2 = getConnection();
 
     global $user;
     $mdb2 = getConnection();
 

-    $sql =  "select u.*, r.rank from tt_users u left join tt_roles r on (u.role_id = r.id) where u.id = $user_id and u.team_id = $user->team_id";
+    $sql =  "select u.*, r.rank from tt_users u left join tt_roles r on (u.role_id = r.id) where u.id = $user_id and u.team_id = $user->team_id and u.status is not null";

     $res = $mdb2->query($sql);
 
     if (!is_a($res, 'PEAR_Error')) {
     $res = $mdb2->query($sql);
 
     if (!is_a($res, 'PEAR_Error')) {

diff --git a/WEB-INF/templates/footer.tpl b/WEB-INF/templates/footer.tpl
index 7239c138424b4c98f4c42624b8a7cb10d340d4d9..77e160e9b226eca8ff5bbaf66213144daa0a1294 100644 (file)
--- a/WEB-INF/templates/footer.tpl
+++ b/WEB-INF/templates/footer.tpl
@@ -12,7 +12,7 @@
       <br>
       <table cellspacing="0" cellpadding="4" width="100%" border="0">
         <tr>
       <br>
       <table cellspacing="0" cellpadding="4" width="100%" border="0">
         <tr>

-          <td align="center">&nbsp;Anuko Time Tracker 1.17.72.4170 | Copyright &copy; <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |
+          <td align="center">&nbsp;Anuko Time Tracker 1.17.72.4171 | Copyright &copy; <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |

             <a href="https://www.anuko.com/lp/tt_4.htm" target="_blank">{$i18n.footer.credits}</a> |
             <a href="https://www.anuko.com/lp/tt_5.htm" target="_blank">{$i18n.footer.license}</a> |
             <a href="https://www.anuko.com/lp/tt_7.htm" target="_blank">{$i18n.footer.improve}</a>
             <a href="https://www.anuko.com/lp/tt_4.htm" target="_blank">{$i18n.footer.credits}</a> |
             <a href="https://www.anuko.com/lp/tt_5.htm" target="_blank">{$i18n.footer.license}</a> |
             <a href="https://www.anuko.com/lp/tt_7.htm" target="_blank">{$i18n.footer.improve}</a>

diff --git a/mobile/user_delete.php b/mobile/user_delete.php
index d8400456a99ba6f167f4d1ec2a0823199d47b745..0e045d018cce25297bea52e67cb449b5332c5e70 100644 (file)
--- a/mobile/user_delete.php
+++ b/mobile/user_delete.php
@@ -45,7 +45,6 @@ $user_details = ttUserHelper::getUserDetails($user_id);
 
 // Security checks.
 if (!$user_details || // No details.
 
 // Security checks.
 if (!$user_details || // No details.

-     $user_details['team_id'] <> $user->team_id || // User not in team.

      $user_details['rank'] > $user->rank || // User has a bigger rank.
      ($user_details['rank'] == $user->rank && $user_details['id'] <> $user->id) // Same rank but not us.
    ) {
      $user_details['rank'] > $user->rank || // User has a bigger rank.
      ($user_details['rank'] == $user->rank && $user_details['id'] <> $user->id) // Same rank but not us.
    ) {

diff --git a/mobile/user_edit.php b/mobile/user_edit.php
index 285c3442b30cb6bd43fcb001af2872378c68f379..49781226175593655bbef6229f64fa66ba5c36f1 100644 (file)
--- a/mobile/user_edit.php
+++ b/mobile/user_edit.php
@@ -47,7 +47,6 @@ $user_details = ttUserHelper::getUserDetails($user_id);
 
 // Security checks.
 if (!$user_details || // No details.
 
 // Security checks.
 if (!$user_details || // No details.

-     $user_details['team_id'] <> $user->team_id || // User not in team.

      $user_details['rank'] > $user->rank || // User has a bigger rank.
      ($user_details['rank'] == $user->rank && $user_details['id'] <> $user->id) // Same rank but not us.
    ) {
      $user_details['rank'] > $user->rank || // User has a bigger rank.
      ($user_details['rank'] == $user->rank && $user_details['id'] <> $user->id) // Same rank but not us.
    ) {

diff --git a/user_delete.php b/user_delete.php
index a88454bf98425418fa0d2e7d0bc02867a29caeba..b8ec5e9add3fafd9d02eab22684bc414455d1711 100644 (file)
--- a/user_delete.php
+++ b/user_delete.php
@@ -30,27 +30,24 @@ require_once('initialize.php');
 import('form.Form');
 import('ttUserHelper');
 
 import('form.Form');
 import('ttUserHelper');
 

-// Access check.
+// Access checks.

 if (!ttAccessAllowed('manage_users')) {
   header('Location: access_denied.php');
   exit();
 }
 if (!ttAccessAllowed('manage_users')) {
   header('Location: access_denied.php');
   exit();
 }

-
-// Get user id we are deleting from the request.
+// Get user id we are deleting.

 // A cast to int is for safety against manipulation of request parameter (sql injection). 
 $user_id = (int) $request->getParameter('id');
 // We need user name and login to display.
 $user_details = ttUserHelper::getUserDetails($user_id);
 // A cast to int is for safety against manipulation of request parameter (sql injection). 
 $user_id = (int) $request->getParameter('id');
 // We need user name and login to display.
 $user_details = ttUserHelper::getUserDetails($user_id);

-
-// Security checks.

 if (!$user_details || // No details.
 if (!$user_details || // No details.

-     $user_details['team_id'] <> $user->team_id || // User not in team.

      $user_details['rank'] > $user->rank || // User has a bigger rank.
      ($user_details['rank'] == $user->rank && $user_details['id'] <> $user->id) // Same rank but not us.
    ) {
   header('Location: access_denied.php');
   exit();
 }
      $user_details['rank'] > $user->rank || // User has a bigger rank.
      ($user_details['rank'] == $user->rank && $user_details['id'] <> $user->id) // Same rank but not us.
    ) {
   header('Location: access_denied.php');
   exit();
 }

+// End of access checks.

 
 $smarty->assign('user_to_delete', $user_details['name']." (".$user_details['login'].")");
 
 
 $smarty->assign('user_to_delete', $user_details['name']." (".$user_details['login'].")");
 

diff --git a/user_edit.php b/user_edit.php
index 75d89e5064d5d007e43bb32e2e9f91f6bd7f7119..5ceac373e91140f876568345a0f50b3db10e6c97 100644 (file)
--- a/user_edit.php
+++ b/user_edit.php
@@ -35,26 +35,23 @@ import('form.Table');
 import('form.TableColumn');
 import('ttRoleHelper');
 
 import('form.TableColumn');
 import('ttRoleHelper');
 

-// Access check.
+// Access checks.

 if (!ttAccessAllowed('manage_users')) {
   header('Location: access_denied.php');
   exit();
 }
 if (!ttAccessAllowed('manage_users')) {
   header('Location: access_denied.php');
   exit();
 }

-

 // Get user id we are editing from the request.
 $user_id = (int) $request->getParameter('id');
 // Get user details.
 $user_details = ttUserHelper::getUserDetails($user_id);
 // Get user id we are editing from the request.
 $user_id = (int) $request->getParameter('id');
 // Get user details.
 $user_details = ttUserHelper::getUserDetails($user_id);

-
-// Security checks.

 if (!$user_details || // No details.
 if (!$user_details || // No details.

-     $user_details['team_id'] <> $user->team_id || // User not in team.

      $user_details['rank'] > $user->rank || // User has a bigger rank.
      ($user_details['rank'] == $user->rank && $user_details['id'] <> $user->id) // Same rank but not us.
    ) {
   header('Location: access_denied.php');
   exit();
 }
      $user_details['rank'] > $user->rank || // User has a bigger rank.
      ($user_details['rank'] == $user->rank && $user_details['id'] <> $user->id) // Same rank but not us.
    ) {
   header('Location: access_denied.php');
   exit();
 }

+// End of access checks.

 
 if ($user->isPluginEnabled('cl'))
   $clients = ttTeamHelper::getActiveClients($user->team_id);
 
 if ($user->isPluginEnabled('cl'))
   $clients = ttTeamHelper::getActiveClients($user->team_id);