PHP hesk_checkPermission函数代码示例

function hesk_initOnline($user_id)
{
    global $hesk_settings, $hesklang;
    /* Set user to online */
    hesk_setOnline($user_id);
    /* Can this user view online staff? */
    if (hesk_checkPermission('can_view_online', 0)) {
        $hesk_settings['users_online'] = hesk_listOnline();
        define('SHOW_ONLINE', 1);
    }
    return true;
}

}
?>
        <li role="presentation" class="active">
            <a href="#"><?php 
echo $hesklang['email_templates'];
?>
 <i class="fa fa-question-circle settingsquestionmark" data-toggle="popover" title="<?php 
echo $hesklang['email_templates'];
?>
" data-content="<?php 
echo $hesklang['email_templates_intro'];
?>
"></i></a>
        </li>
        <?php 
if (hesk_checkPermission('can_man_ticket_statuses', 0)) {
    echo '
            <li role="presentation">
                <a title="' . $hesklang['statuses'] . '" href="manage_statuses.php">' . $hesklang['statuses'] . '</a>
            </li>
            ';
}
?>
    </ul>
    <div class="tab-content summaryList tabPadding">
        <?php 
if ($showEditPanel) {
    ?>
        <div class="row">
            <div class="col-md-12">
                <div class="panel panel-default">

*  https://www.hesk.com/buy.php
*******************************************************************************/
define('IN_SCRIPT', 1);
define('HESK_PATH', '../');
/* Get all the required files and functions */
require HESK_PATH . 'hesk_settings.inc.php';
require HESK_PATH . 'inc/common.inc.php';
require HESK_PATH . 'inc/admin_functions.inc.php';
hesk_load_database_functions();
hesk_session_start();
hesk_dbConnect();
hesk_isLoggedIn();
/* Check permissions */
$can_view_tickets = hesk_checkPermission('can_view_tickets', 0);
$can_reply_tickets = hesk_checkPermission('can_reply_tickets', 0);
$can_view_unassigned = hesk_checkPermission('can_view_unassigned', 0);
/* Update profile? */
if (!empty($_POST['action'])) {
    // Demo mode
    if (defined('HESK_DEMO')) {
        hesk_process_messages($hesklang['sdemo'], 'profile.php', 'NOTICE');
    }
    // Update profile
    update_profile();
} else {
    $res = hesk_dbQuery('SELECT * FROM `' . hesk_dbEscape($hesk_settings['db_pfix']) . "users` WHERE `id` = '" . intval($_SESSION['id']) . "' LIMIT 1");
    $tmp = hesk_dbFetchAssoc($res);
    foreach ($tmp as $k => $v) {
        if ($k == 'pass') {
            if ($v == '499d74967b28a841c98bb4baaabaad699ff3c079') {
                define('WARN_PASSWORD', true);

*  https://www.hesk.com/buy.php
*******************************************************************************/
define('IN_SCRIPT', 1);
define('HESK_PATH', '../');
/* Get all the required files and functions */
require HESK_PATH . 'hesk_settings.inc.php';
require HESK_PATH . 'inc/common.inc.php';
require HESK_PATH . 'inc/admin_functions.inc.php';
hesk_load_database_functions();
hesk_session_start();
hesk_dbConnect();
hesk_isLoggedIn();
/* Check permissions for this feature */
hesk_checkPermission('can_view_tickets');
hesk_checkPermission('can_reply_tickets');
hesk_checkPermission('can_edit_tickets');
/* A security check */
hesk_token_check();
/* Ticket ID */
$trackingID = hesk_cleanID() or die($hesklang['int_error'] . ': ' . $hesklang['no_trackID']);
/* New archived status */
if (empty($_GET['locked'])) {
    $status = 0;
    $tmp = $hesklang['tunlock'];
    $revision = sprintf($hesklang['thist6'], hesk_date(), $_SESSION['name'] . ' (' . $_SESSION['user'] . ')');
} else {
    $status = 1;
    $tmp = $hesklang['tlock'];
    $revision = sprintf($hesklang['thist5'], hesk_date(), $_SESSION['name'] . ' (' . $_SESSION['user'] . ')');
}
/* Update database */

function output_user_dropdown($catId, $selectId, $userArray)
{
    global $hesklang;
    if (!hesk_checkPermission('can_set_manager', 0)) {
        foreach ($userArray as $user) {
            if ($user['id'] == $selectId) {
                return '<p>' . $user['name'] . '</p>';
            }
        }
        return '<p>' . $hesklang['no_manager'] . '</p>';
    } else {
        $dropdownMarkup = '<select class="form-control input-sm" name="managerid">
                <option value="0">' . $hesklang['no_manager'] . '</option>';
        foreach ($userArray as $user) {
            $select = $selectId == $user['id'] ? 'selected' : '';
            $dropdownMarkup .= '<option value="' . $user['id'] . '" ' . $select . '>' . $user['name'] . '</option>';
        }
        $dropdownMarkup .= '</select>';
        return '<form role="form" id="manager_form_' . $catId . '" action="manage_categories.php" method="post" class="form-inline" onchange="document.getElementById(\'manager_form_' . $catId . '\').submit();">
                <input type="hidden" name="a" value="manager">
                <input type="hidden" name="catid" value="' . $catId . '">
                ' . $dropdownMarkup . '
            </form>';
    }
}

if (isset($flush_me)) {
    if ($tickets_exported > 0) {
        hesk_show_success($flush_me);
    } else {
        hesk_show_notice($hesklang['n2ex']);
    }
}
?>

<!-- TABS -->
<div id="tab1" class="tabberlive" style="margin-top:0px">

	<ul class="tabbernav">
		<?php 
// Show a link to reports.php if user has permission to do so
if (hesk_checkPermission('can_run_reports', 0)) {
    echo '<li class=""><a title="' . $hesklang['reports_tab'] . '" href="reports.php">' . $hesklang['reports_tab'] . ' [+]</a></li>';
}
?>
		<li class="tabberactive"><a title="<?php 
echo $hesklang['export'];
?>
" href="javascript:void(null);" onclick="javascript:alert('<?php 
echo $hesklang['export_intro'];
?>
')"><?php 
echo $hesklang['export'];
?>
 [?]</a></li>
	</ul>

/* Print main manage users page */
require_once HESK_PATH . 'inc/show_admin_nav.inc.php';
?>

</td>
</tr>
<tr>
<td>

<!-- TABS -->
<div id="tab1" class="tabberlive" style="margin-top:0px">

	<ul class="tabbernav">
		<?php 
// Show a link to manage_ticket_templates.php if user has permission to do so
if (hesk_checkPermission('can_man_canned', 0)) {
    echo '<li class=""><a title="' . $hesklang['manage_saved'] . '" href="manage_canned.php">' . $hesklang['manage_saved'] . '</a></li>';
}
?>
		<li class="tabberactive"><a title="<?php 
echo $hesklang['ticket_tpl'];
?>
" href="javascript:void(null);" onclick="javascript:alert('<?php 
echo hesk_makeJsString($hesklang['ticket_tpl_intro']);
?>
')"><?php 
echo $hesklang['ticket_tpl'];
?>
 [?]</a></li>
	</ul>

*  https://www.hesk.com/buy.php
*******************************************************************************/
define('IN_SCRIPT', 1);
define('HESK_PATH', '../');
/* Get all the required files and functions */
require HESK_PATH . 'hesk_settings.inc.php';
require HESK_PATH . 'inc/common.inc.php';
require HESK_PATH . 'inc/admin_functions.inc.php';
hesk_load_database_functions();
hesk_session_start();
hesk_dbConnect();
hesk_isLoggedIn();
define('CALENDAR', 1);
$_SESSION['hide']['ticket_list'] = true;
/* Check permissions for this feature */
hesk_checkPermission('can_view_tickets');
$_SERVER['PHP_SELF'] = './admin_main.php';
/* Print header */
require_once HESK_PATH . 'inc/header.inc.php';
/* Print admin navigation */
require_once HESK_PATH . 'inc/show_admin_nav.inc.php';
?>

</td>
</tr>
<tr>
<td>

<div class="container tickets-found"><?php 
echo $hesklang['tickets_found'];
?>

/* A list of all categories */
$hesk_settings['categories'] = array();
$res = hesk_dbQuery('SELECT `id`,`name` FROM `' . hesk_dbEscape($hesk_settings['db_pfix']) . 'categories` ORDER BY `cat_order` ASC');
while ($row = hesk_dbFetchAssoc($res)) {
    if (hesk_okCategory($row['id'], 0)) {
        $hesk_settings['categories'][$row['id']] = $row['name'];
    }
}
/* Non-admin users may not create users with more permissions than they have */
if (!$_SESSION['isadmin']) {
    /* Can't create admin users */
    $_POST['isadmin'] = 0;
    /* Can only add features he/she has access to */
    $hesk_settings['features'] = array_intersect(explode(',', $_SESSION['heskprivileges']), $hesk_settings['features']);
    /* Can user modify auto-assign setting? */
    if ($hesk_settings['autoassign'] && (!hesk_checkPermission('can_assign_self', 0) || !hesk_checkPermission('can_assign_others', 0))) {
        $hesk_settings['autoassign'] = 0;
    }
}
/* Use any set values, default otherwise */
foreach ($default_userdata as $k => $v) {
    if (!isset($_SESSION['userdata'][$k])) {
        $_SESSION['userdata'][$k] = $v;
    }
}
$_SESSION['userdata'] = hesk_stripArray($_SESSION['userdata']);
/* What should we do? */
if ($action = hesk_REQUEST('a')) {
    if ($action == 'reset_form') {
        $_SESSION['edit_userdata'] = TRUE;
        header('Location: ./manage_users.php');

// Note ID
$noteID = intval(hesk_REQUEST('note')) or die($hesklang['int_error'] . ': ' . $hesklang['mis_note']);
// Get ticket info
$result = hesk_dbQuery("SELECT `id` FROM `" . hesk_dbEscape($hesk_settings['db_pfix']) . "tickets` WHERE `trackid`='" . hesk_dbEscape($trackingID) . "' LIMIT 1");
if (hesk_dbNumRows($result) != 1) {
    hesk_error($hesklang['ticket_not_found']);
}
$ticket = hesk_dbFetchAssoc($result);
// Get note info
$result = hesk_dbQuery("SELECT * FROM `" . hesk_dbEscape($hesk_settings['db_pfix']) . "notes` WHERE `id`={$noteID}");
if (hesk_dbNumRows($result) != 1) {
    hesk_error($hesklang['no_note']);
}
$note = hesk_dbFetchAssoc($result);
// Make sure the note matches the ticket and the user has permission to edit it
if ($note['ticket'] != $ticket['id'] || !hesk_checkPermission('can_del_notes', 0) && $note['who'] != $_SESSION['id']) {
    hesk_error($hesklang['perm_deny']);
}
// Save changes?
if (isset($_POST['save'])) {
    // A security check
    hesk_token_check('POST');
    // Get message
    $tmpvar['message'] = nl2br(hesk_makeURL(hesk_input(hesk_POST('message'))));
    // If we have message or attachments do the update
    if (strlen($tmpvar['message']) || strlen($note['attachments'])) {
        hesk_dbQuery("UPDATE `" . hesk_dbEscape($hesk_settings['db_pfix']) . "notes` SET `message`='" . hesk_dbEscape($tmpvar['message']) . "' WHERE `id`={$noteID}");
        hesk_process_messages($hesklang['ednote2'], 'admin_ticket.php?track=' . $trackingID . '&Refresh=' . mt_rand(10000, 99999), 'SUCCESS');
    } else {
        hesk_dbQuery("DELETE FROM `" . hesk_dbEscape($hesk_settings['db_pfix']) . "notes` WHERE `id`={$noteID}");
        header('Location: admin_ticket.php?track=' . $trackingID . '&Refresh=' . mt_rand(10000, 99999));

    // Is this person allowed access to this attachment?
    $res = hesk_dbQuery("SELECT `t1`.`type` as `cat_type`, `t2`.`type` as `art_type`\r\n\t\t\t\t\t\tFROM `" . hesk_dbEscape($hesk_settings['db_pfix']) . "kb_articles` AS `t2`\r\n                        JOIN `" . hesk_dbEscape($hesk_settings['db_pfix']) . "kb_categories` AS `t1`\r\n                        ON `t2`.`catid` = `t1`.`id`\r\n                        WHERE (`t2`.`attachments` LIKE '{$att_id}#%' OR `t2`.`attachments` LIKE '%,{$att_id}#%' )\r\n                        LIMIT 1");
    // If no attachment found, throw an error
    if (hesk_dbNumRows($res) != 1) {
        hesk_error($hesklang['id_not_valid'] . ' (no_art)');
    }
    $row = hesk_dbFetchAssoc($res);
    // Private or draft article or category?
    if ($row['cat_type'] || $row['art_type']) {
        if (empty($_SESSION['id'])) {
            // This is a staff-only attachment
            hesk_error($hesklang['attpri']);
        } elseif ($row['art_type'] == 2) {
            // Need permission to manage KB to access draft attachments
            require HESK_PATH . 'inc/admin_functions.inc.php';
            hesk_checkPermission('can_man_kb');
        }
    }
} else {
    // Attachmend ID and ticket tracking ID
    $att_id = intval(hesk_GET('att_id', 0)) or die($hesklang['id_not_valid']);
    $tic_id = hesk_cleanID() or die("{$hesklang['int_error']}: {$hesklang['no_trackID']}");
    // Connect to database
    hesk_dbConnect();
    // Get attachment info
    $res = hesk_dbQuery("SELECT * FROM `" . hesk_dbEscape($hesk_settings['db_pfix']) . "attachments` WHERE `att_id`='{$att_id}' LIMIT 1");
    if (hesk_dbNumRows($res) != 1) {
        hesk_error($hesklang['id_not_valid'] . ' (att_id)');
    }
    $file = hesk_dbFetchAssoc($res);
    // Is ticket ID valid for this attachment?

function hesk_getAdminButtons($reply = 0, $white = 1)
{
    global $hesk_settings, $hesklang, $ticket, $reply, $trackingID, $can_edit, $can_archive, $can_delete;
    $options = '';
    /* Style and mousover/mousout */
    $tmp = $white ? 'White' : 'Blue';
    $style = 'class="option' . $tmp . 'OFF" onmouseover="this.className=\'option' . $tmp . 'ON\'" onmouseout="this.className=\'option' . $tmp . 'OFF\'"';
    /* Lock ticket button */
    if ($can_edit) {
        if ($ticket['locked']) {
            $des = $hesklang['tul'] . ' - ' . $hesklang['isloc'];
            $options .= '<a href="lock.php?track=' . $trackingID . '&amp;locked=0&amp;Refresh=' . mt_rand(10000, 99999) . '&amp;token=' . hesk_token_echo(0) . '"><img src="../img/unlock.png" width="16" height="16" alt="' . $des . '" title="' . $des . '" ' . $style . ' /></a> ';
        } else {
            $des = $hesklang['tlo'] . ' - ' . $hesklang['isloc'];
            $options .= '<a href="lock.php?track=' . $trackingID . '&amp;locked=1&amp;Refresh=' . mt_rand(10000, 99999) . '&amp;token=' . hesk_token_echo(0) . '"><img src="../img/lock.png" width="16" height="16" alt="' . $des . '" title="' . $des . '" ' . $style . ' /></a> ';
        }
    }
    /* Tag ticket button */
    if ($can_archive) {
        if ($ticket['archive']) {
            $options .= '<a href="archive.php?track=' . $trackingID . '&amp;archived=0&amp;Refresh=' . mt_rand(10000, 99999) . '&amp;token=' . hesk_token_echo(0) . '"><img src="../img/tag.png" width="16" height="16" alt="' . $hesklang['remove_archive'] . '" title="' . $hesklang['remove_archive'] . '" ' . $style . ' /></a> ';
        } else {
            $options .= '<a href="archive.php?track=' . $trackingID . '&amp;archived=1&amp;Refresh=' . mt_rand(10000, 99999) . '&amp;token=' . hesk_token_echo(0) . '"><img src="../img/tag_off.png" width="16" height="16" alt="' . $hesklang['add_archive'] . '" title="' . $hesklang['add_archive'] . '" ' . $style . ' /></a> ';
        }
    }
    /* Import to knowledgebase button */
    if ($hesk_settings['kb_enable'] && hesk_checkPermission('can_man_kb', 0)) {
        $options .= '<a href="manage_knowledgebase.php?a=import_article&amp;track=' . $trackingID . '"><img src="../img/import_kb.png" width="16" height="16" alt="' . $hesklang['import_kb'] . '" title="' . $hesklang['import_kb'] . '" ' . $style . ' /></a> ';
    }
    /* Print ticket button */
    $options .= '<a href="../print.php?track=' . $trackingID . '"><img src="../img/print.png" width="16" height="16" alt="' . $hesklang['printer_friendly'] . '" title="' . $hesklang['printer_friendly'] . '" ' . $style . ' /></a> ';
    /* Edit post */
    if ($can_edit) {
        $tmp = $reply ? '&amp;reply=' . $reply['id'] : '';
        $options .= '<a href="edit_post.php?track=' . $trackingID . $tmp . '"><img src="../img/edit.png" width="16" height="16" alt="' . $hesklang['edtt'] . '" title="' . $hesklang['edtt'] . '" ' . $style . ' /></a> ';
    }
    /* Delete ticket */
    if ($can_delete) {
        if ($reply) {
            $url = 'admin_ticket.php';
            $tmp = 'delete_post=' . $reply['id'];
            $img = 'delete.png';
            $txt = $hesklang['delt'];
        } else {
            $url = 'delete_tickets.php';
            $tmp = 'delete_ticket=1';
            $img = 'delete_ticket.png';
            $txt = $hesklang['dele'];
        }
        $options .= '<a href="' . $url . '?track=' . $trackingID . '&amp;' . $tmp . '&amp;Refresh=' . mt_rand(10000, 99999) . '&amp;token=' . hesk_token_echo(0) . '" onclick="return hesk_confirmExecute(\'' . hesk_makeJsString($txt) . '?\');"><img src="../img/' . $img . '" width="16" height="16" alt="' . $txt . '" title="' . $txt . '" ' . $style . ' /></a> ';
    }
    /* Return generated HTML */
    return $options;
}

*  a license for this script. For more information on how to obtain
*  a license please visit the page below:
*  https://www.hesk.com/buy.php
*******************************************************************************/
define('IN_SCRIPT', 1);
define('HESK_PATH', '../');
/* Get all the required files and functions */
require HESK_PATH . 'hesk_settings.inc.php';
require HESK_PATH . 'inc/common.inc.php';
require HESK_PATH . 'inc/admin_functions.inc.php';
hesk_load_database_functions();
hesk_session_start();
hesk_dbConnect();
hesk_isLoggedIn();
/* Check permissions for this feature */
hesk_checkPermission('can_man_ticket_tpl');
// Define required constants
define('LOAD_TABS', 1);
/* What should we do? */
if ($action = hesk_REQUEST('a')) {
    if (defined('HESK_DEMO')) {
        hesk_process_messages($hesklang['ddemo'], 'manage_ticket_templates.php', 'NOTICE');
    } elseif ($action == 'new') {
        new_saved();
    } elseif ($action == 'edit') {
        edit_saved();
    } elseif ($action == 'remove') {
        remove();
    } elseif ($action == 'order') {
        order_saved();
    }

echo $hesklang['banemail'];
?>
" href="#b-email" onclick="javascript:alert('<?php 
echo hesk_makeJsString($hesklang['banemail_intro']);
?>
')"><?php 
echo $hesklang['banemail'];
?>
 [?]</a></li>
		<?php 
// Show a link to banned_ips.php if user has permission to do so
if (hesk_checkPermission('can_ban_ips', 0)) {
    echo '<li id="banned-ips"><a title="' . $hesklang['banip'] . '" href="banned_ips.php">' . $hesklang['banip'] . '</a></li> ';
}
// Show a link to status_message.php if user has permission to do so
if (hesk_checkPermission('can_service_msg', 0)) {
    echo '<li id="service-msg-tools"><a title="' . $hesklang['sm_title'] . '" href="service_messages.php">' . $hesklang['sm_title'] . '</a></li> ';
}
?>
	</ul>

<script language="javascript" type="text/javascript"><!--
function confirm_delete()
{
if (confirm('<?php 
echo hesk_makeJsString($hesklang['delban_confirm']);
?>
')) {return true;}
else {return false;}
}
//-->

*  a license please visit the page below:
*  https://www.hesk.com/buy.php
*******************************************************************************/
define('IN_SCRIPT', 1);
define('HESK_PATH', '../');
/* Get all the required files and functions */
require HESK_PATH . 'hesk_settings.inc.php';
require HESK_PATH . 'inc/common.inc.php';
require HESK_PATH . 'inc/admin_functions.inc.php';
hesk_load_database_functions();
hesk_session_start();
hesk_dbConnect();
hesk_isLoggedIn();
/* Check permissions for this feature */
hesk_checkPermission('can_view_tickets');
hesk_checkPermission('can_add_archive');
/* A security check */
hesk_token_check();
/* Ticket ID */
$trackingID = hesk_cleanID() or die($hesklang['int_error'] . ': ' . $hesklang['no_trackID']);
/* New archived status */
if (empty($_GET['archived'])) {
    $status = 0;
    $tmp = $hesklang['removedfromarchive'];
} else {
    $status = 1;
    $tmp = $hesklang['added2archive'];
}
/* Update database */
hesk_dbQuery("UPDATE `" . hesk_dbEscape($hesk_settings['db_pfix']) . "tickets` SET `archive`='{$status}' WHERE `trackid`='" . hesk_dbEscape($trackingID) . "' LIMIT 1");
/* Back to ticket page and show a success message */