Skip to content

Commit d712ea4

Browse files
author
Till Brehm
committed
Fixed #5146 disabled reseller still may login
Fixed typo in SQL query.
1 parent 20bc613 commit d712ea4

File tree

1 file changed

+119
-1
lines changed

1 file changed

+119
-1
lines changed

‎interface/web/client/reseller_edit.php‎

Lines changed: 119 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,7 @@ function onAfterInsert() {
222222
$password = crypt(stripslashes($password), $salt);
223223

224224
// Create the controlpaneluser for the reseller
225-
$sql = "INSERT INTO sys_user (`username`,`passwort`,`modules`,`startmodule`,`app_theme`,`typ,active`,`language`,`groups`,`default_group`,`client_id`)
225+
$sql = "INSERT INTO sys_user (`username`,`passwort`,`modules`,`startmodule`,`app_theme`,`typ`, `active`,`language`,`groups`,`default_group`,`client_id`)
226226
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
227227
$app->db->query($sql, $username, $password, $modules, $startmodule, $usertheme, $type, $active, $language, $groups, $groupid, $this->id);
228228

@@ -368,6 +368,124 @@ function onAfterUpdate() {
368368
$app->uses('client_templates');
369369
$app->client_templates->update_client_templates($this->id, $this->_template_additional);
370370
}
371+
372+
if(!isset($this->dataRecord['locked'])) $this->dataRecord['locked'] = 'n';
373+
if(isset($conf['demo_mode']) && $conf['demo_mode'] != true && $this->dataRecord["locked"] != $this->oldDataRecord['locked']) {
374+
/** lock all the things like web, mail etc. - easy to extend */
375+
376+
377+
// get tmp_data of client
378+
$client_data = $app->db->queryOneRecord('SELECT `tmp_data` FROM `client` WHERE `client_id` = ?', $this->id);
379+
380+
if($client_data['tmp_data'] == '') $tmp_data = array();
381+
else $tmp_data = unserialize($client_data['tmp_data']);
382+
383+
if(!is_array($tmp_data)) $tmp_data = array();
384+
385+
// database tables with their primary key columns
386+
$to_disable = array('cron' => 'id',
387+
'ftp_user' => 'ftp_user_id',
388+
'mail_domain' => 'domain_id',
389+
'mail_user' => 'mailuser_id',
390+
'mail_user_smtp' => 'mailuser_id',
391+
'mail_forwarding' => 'forwarding_id',
392+
'mail_get' => 'mailget_id',
393+
'openvz_vm' => 'vm_id',
394+
'shell_user' => 'shell_user_id',
395+
'webdav_user' => 'webdav_user_id',
396+
'web_database' => 'database_id',
397+
'web_domain' => 'domain_id',
398+
'web_folder' => 'web_folder_id',
399+
'web_folder_user' => 'web_folder_user_id'
400+
);
401+
402+
$udata = $app->db->queryOneRecord('SELECT `userid` FROM `sys_user` WHERE `client_id` = ?', $this->id);
403+
$gdata = $app->db->queryOneRecord('SELECT `groupid` FROM `sys_group` WHERE `client_id` = ?', $this->id);
404+
$sys_groupid = $gdata['groupid'];
405+
$sys_userid = $udata['userid'];
406+
407+
$entries = array();
408+
if($this->dataRecord['locked'] == 'y') {
409+
$prev_active = array();
410+
$prev_sysuser = array();
411+
foreach($to_disable as $current => $keycolumn) {
412+
$active_col = 'active';
413+
$reverse = false;
414+
if($current == 'mail_user') {
415+
$active_col = 'postfix';
416+
} elseif($current == 'mail_user_smtp') {
417+
$current = 'mail_user';
418+
$active_col = 'disablesmtp';
419+
$reverse = true;
420+
}
421+
422+
if(!isset($prev_active[$current])) $prev_active[$current] = array();
423+
if(!isset($prev_sysuser[$current])) $prev_sysuser[$current] = array();
424+
425+
$entries = $app->db->queryAllRecords('SELECT ?? as `id`, `sys_userid`, ?? FROM ?? WHERE `sys_groupid` = ?', $keycolumn, $active_col, $current, $sys_groupid);
426+
foreach($entries as $item) {
427+
428+
if($item[$active_col] != 'y' && $reverse == false) $prev_active[$current][$item['id']][$active_col] = 'n';
429+
elseif($item[$active_col] == 'y' && $reverse == true) $prev_active[$current][$item['id']][$active_col] = 'y';
430+
if($item['sys_userid'] != $sys_userid) $prev_sysuser[$current][$item['id']] = $item['sys_userid'];
431+
// we don't have to store these if y, as everything without previous state gets enabled later
432+
433+
$app->db->datalogUpdate($current, array($active_col => ($reverse == true ? 'y' : 'n'), 'sys_userid' => $_SESSION["s"]["user"]["userid"]), $keycolumn, $item['id']);
434+
}
435+
}
436+
437+
$tmp_data['prev_active'] = $prev_active;
438+
$tmp_data['prev_sys_userid'] = $prev_sysuser;
439+
$app->db->query("UPDATE `client` SET `tmp_data` = ? WHERE `client_id` = ?", serialize($tmp_data), $this->id);
440+
unset($prev_active);
441+
unset($prev_sysuser);
442+
} elseif($this->dataRecord['locked'] == 'n') {
443+
foreach($to_disable as $current => $keycolumn) {
444+
$active_col = 'active';
445+
$reverse = false;
446+
if($current == 'mail_user') {
447+
$active_col = 'postfix';
448+
} elseif($current == 'mail_user_smtp') {
449+
$current = 'mail_user';
450+
$active_col = 'disablesmtp';
451+
$reverse = true;
452+
}
453+
454+
$entries = $app->db->queryAllRecords('SELECT ?? as `id` FROM ?? WHERE `sys_groupid` = ?', $keycolumn, $current, $sys_groupid);
455+
foreach($entries as $item) {
456+
$set_active = ($reverse == true ? 'n' : 'y');
457+
$set_inactive = ($reverse == true ? 'y' : 'n');
458+
$set_sysuser = $sys_userid;
459+
if(array_key_exists('prev_active', $tmp_data) == true
460+
&& array_key_exists($current, $tmp_data['prev_active']) == true
461+
&& array_key_exists($item['id'], $tmp_data['prev_active'][$current]) == true
462+
&& $tmp_data['prev_active'][$current][$item['id']][$active_col] == $set_inactive) $set_active = $set_inactive;
463+
if(array_key_exists('prev_sysuser', $tmp_data) == true
464+
&& array_key_exists($current, $tmp_data['prev_sysuser']) == true
465+
&& array_key_exists($item['id'], $tmp_data['prev_sysuser'][$current]) == true
466+
&& $tmp_data['prev_sysuser'][$current][$item['id']] != $sys_userid) $set_sysuser = $tmp_data['prev_sysuser'][$current][$item['id']];
467+
468+
$app->db->datalogUpdate($current, array($active_col => $set_active, 'sys_userid' => $set_sysuser), $keycolumn, $item['id']);
469+
}
470+
}
471+
if(array_key_exists('prev_active', $tmp_data)) unset($tmp_data['prev_active']);
472+
$app->db->query("UPDATE `client` SET `tmp_data` = ? WHERE `client_id` = ?", serialize($tmp_data), $this->id);
473+
}
474+
unset($tmp_data);
475+
unset($entries);
476+
unset($to_disable);
477+
}
478+
479+
if(!isset($this->dataRecord['canceled'])) $this->dataRecord['canceled'] = 'n';
480+
if(isset($conf['demo_mode']) && $conf['demo_mode'] != true && $this->dataRecord["canceled"] != $this->oldDataRecord['canceled']) {
481+
if($this->dataRecord['canceled'] == 'y') {
482+
$sql = "UPDATE sys_user SET active = '0' WHERE client_id = ?";
483+
$app->db->query($sql, $this->id);
484+
} elseif($this->dataRecord['canceled'] == 'n') {
485+
$sql = "UPDATE sys_user SET active = '1' WHERE client_id = ?";
486+
$app->db->query($sql, $this->id);
487+
}
488+
}
371489

372490
parent::onAfterUpdate();
373491
}

0 commit comments

Comments
 (0)