PHP user_permissions_get函数代码示例

 function execute()
 {
     /*
     	Define form structure
     */
     $this->obj_form = new form_input();
     $this->obj_form->formname = "support_ticket_add";
     $this->obj_form->language = $_SESSION["user"]["lang"];
     $this->obj_form->action = "support/edit-process.php";
     $this->obj_form->method = "post";
     // general
     $structure = NULL;
     $structure["fieldname"] = "title";
     $structure["type"] = "input";
     $structure["options"]["req"] = "yes";
     $this->obj_form->add_input($structure);
     $structure = NULL;
     $structure["fieldname"] = "date_start";
     $structure["type"] = "date";
     $structure["defaultvalue"] = date("Y-m-d");
     $structure["options"]["req"] = "yes";
     $this->obj_form->add_input($structure);
     $structure = NULL;
     $structure["fieldname"] = "date_end";
     $structure["type"] = "date";
     $this->obj_form->add_input($structure);
     $structure = NULL;
     $structure["fieldname"] = "details";
     $structure["type"] = "textarea";
     $structure["options"]["width"] = "600";
     $structure["options"]["height"] = "100";
     $this->obj_form->add_input($structure);
     // status + priority
     $structure = form_helper_prepare_dropdownfromdb("status", "SELECT id, value as label FROM support_tickets_status");
     $structure["options"]["req"] = "yes";
     $this->obj_form->add_input($structure);
     $structure = form_helper_prepare_dropdownfromdb("priority", "SELECT id, value as label FROM support_tickets_priority");
     $this->obj_form->add_input($structure);
     // customer/product/project/service ID
     // submit section
     if (user_permissions_get("support_write")) {
         $structure = NULL;
         $structure["fieldname"] = "submit";
         $structure["type"] = "submit";
         $structure["defaultvalue"] = "Save Changes";
         $this->obj_form->add_input($structure);
     } else {
         $structure = NULL;
         $structure["fieldname"] = "submit";
         $structure["type"] = "message";
         $structure["defaultvalue"] = "<p><i>Sorry, you don't have permissions to make changes to support_ticket records.</i></p>";
         $this->obj_form->add_input($structure);
     }
     // define subforms
     $this->obj_form->subforms["support_ticket_details"] = array("title", "priority", "details");
     $this->obj_form->subforms["support_ticket_status"] = array("status", "date_start", "date_end");
     $this->obj_form->subforms["submit"] = array("submit");
     // fetch the form data
     $this->obj_form->load_data_error();
 }

 function check_permissions()
 {
     // only allow namedadmins group members to have access
     if (user_permissions_get("namedadmins")) {
         return 1;
     } else {
         log_write("error", "page_output", "You do not have permissions to access this interface, request your administrator to assign you to the namedadmins group");
         return 0;
     }
 }

 function check_permissions()
 {
     if (!user_permissions_get("admin")) {
         return 0;
     }
     if ($GLOBALS["config"]["AUTH_METHOD"] != "sql") {
         log_write("error", "page", "User options can only be configured when using local user authentication");
         return 0;
     }
     return 1;
 }

 function execute()
 {
     // define basic form details
     $this->obj_form = new form_input();
     $this->obj_form->formname = "traffic_types_edit";
     $this->obj_form->language = $_SESSION["user"]["lang"];
     $this->obj_form->action = "services/traffic-types-edit-process.php";
     $this->obj_form->method = "post";
     // general
     $structure = NULL;
     $structure["fieldname"] = "type_name";
     $structure["type"] = "input";
     $structure["options"]["req"] = "yes";
     $this->obj_form->add_input($structure);
     $structure = NULL;
     $structure["fieldname"] = "type_label";
     $structure["type"] = "input";
     $this->obj_form->add_input($structure);
     $structure = NULL;
     $structure["fieldname"] = "type_description";
     $structure["type"] = "input";
     $this->obj_form->add_input($structure);
     // hidden fields
     $structure = NULL;
     $structure["fieldname"] = "id";
     $structure["type"] = "hidden";
     $structure["defaultvalue"] = $this->obj_traffic_type->id;
     $this->obj_form->add_input($structure);
     // submit button
     $structure = NULL;
     $structure["fieldname"] = "submit";
     $structure["type"] = "submit";
     $structure["defaultvalue"] = "submit";
     $this->obj_form->add_input($structure);
     // define subforms
     $this->obj_form->subforms["traffic_type_view"] = array("type_name", "type_label", "type_description");
     $this->obj_form->subforms["hidden"] = array("id");
     if (user_permissions_get("services_write") && !$this->locked) {
         $this->obj_form->subforms["submit"] = array("submit");
     } else {
         $this->obj_form->subforms["submit"] = array();
     }
     // load data
     if (error_check()) {
         $this->obj_form->load_data_error();
     } else {
         $this->obj_traffic_type->load_data();
         $this->obj_form->structure["type_name"]["defaultvalue"] = $this->obj_traffic_type->data["type_name"];
         $this->obj_form->structure["type_label"]["defaultvalue"] = $this->obj_traffic_type->data["type_label"];
         $this->obj_form->structure["type_description"]["defaultvalue"] = $this->obj_traffic_type->data["type_description"];
     }
 }

 function render_html()
 {
     // Title + Summary
     print "<h3>SERVICE JOURNAL</h3><br>";
     print "<p>The journal is a place where you can put your own notes, files and view the history of this service.</p>";
     if (user_permissions_get("services_write")) {
         print "<p><a class=\"button\" href=\"index.php?page=services/journal-edit.php&type=text&id=" . $this->id . "\">Add new journal entry</a> <a class=\"button\" href=\"index.php?page=services/journal-edit.php&type=file&id=" . $this->id . "\">Upload File</a></p>";
     }
     // display options form
     $this->obj_journal->render_options_form();
     // display journal
     $this->obj_journal->render_journal();
 }

 function check_permissions()
 {
     if (user_permissions_get("projects_timegroup")) {
         // accept user if they have access to all staff
         if (user_permissions_get("timekeeping_all_view")) {
             return 1;
         }
         // select the IDs that the user does have access to
         if ($this->access_staff_ids = user_permissions_staff_getarray("timereg_view")) {
             return 1;
         }
     }
 }

 function render_html()
 {
     // Title + Summapy
     print "<h3>INVOICE JOURNAL</h3><br>";
     print "<p>The journal is a place where you can put your own notes, files and view the history of this invoice.</p>";
     if (user_permissions_get("accounts_ap_write")) {
         print "<p><a class=\"button\" href=\"index.php?page=accounts/ap/journal-edit.php&type=text&id=" . $this->id . "\">Add new journal entry</a> <a class=\"button\" href=\"index.php?page=accounts/ap/journal-edit.php&type=file&id=" . $this->id . "\">Upload File</a></p>";
     } else {
         format_msgbox("locked", "<p>Note: your permissions limit you to read-only access to the journal</p>");
     }
     // display options form
     $this->obj_journal->render_options_form();
     // display the journal
     $this->obj_journal->render_journal();
 }

 function check_permissions()
 {
     if (user_permissions_get("projects_view")) {
         // accept user if they have access to all staff
         if (user_permissions_get("timekeeping_all_view")) {
             return 1;
         }
         // select the IDs that the user does have access to
         if ($this->access_staff_ids = user_permissions_staff_getarray("timereg_view")) {
             return 1;
         } else {
             log_render("error", "page", "Before you can view project hours, your administrator must configure the staff accounts you may access, or set the timekeeping_all_view permission.");
         }
     }
 }

 function set_usage_record($collector, $id_service_customer, $date, $usage1, $usage2 = NULL)
 {
     log_debug("services_usage", "Executing set_usage_record");
     if (user_permissions_get("services_write_usage")) {
         // sanitise input
         $data["collector"] = @security_script_input_predefined("any", $collector);
         $data["id_service_customer"] = @security_script_input_predefined("int", $id_service_customer);
         $data["date"] = @security_script_input_predefined("date", $date);
         $data["usage1"] = @security_script_input_predefined("int", $usage1);
         $data["usage2"] = @security_script_input_predefined("int", $usage2);
         foreach (array_keys($data) as $key) {
             if ($data[$key] == "error") {
                 throw new SoapFault("Sender", "INVALID_INPUT");
             }
         }
         /*
         	Verify that id_service_customer exists - this may seem unnessacary, but should be done
         	to prevent data being inserted to IDs that don't yet belong - but may do in future.
         	
         	Would be nasty to have a lot of data sitting in the table waiting for a new customer to
         	appear whom the ID matches too.
         
         	Of course, this check does nothing to prevent data for one customer being accidently filed
         	against another customer due to an incorrect ID.
         */
         $sql_obj = new sql_query();
         $sql_obj->string = "SELECT id FROM services_customers WHERE id='" . $data["id_service_customer"] . "' LIMIT 1";
         $sql_obj->execute();
         if (!$sql_obj->num_rows()) {
             throw new SoapFault("Sender", "INVALID_SERVICES_CUSTOMERS_ID");
         }
         unset($sql_obj);
         // add new row to DB
         $sql_obj = new sql_query();
         $sql_obj->string = "INSERT INTO service_usage_records (" . "id_service_customer, " . "date, " . "usage1, " . "usage2" . ") VALUES (" . "'" . $data["id_service_customer"] . "', " . "'" . $data["date"] . "', " . "'" . $data["usage1"] . "', " . "'" . $data["usage2"] . "'" . ")";
         if (!$sql_obj->execute()) {
             throw new SoapFault("Sender", "UNEXPECTED_DB_ERROR");
         }
         return 1;
     } else {
         throw new SoapFault("Sender", "ACCESS_DENIED");
     }
 }

 function check_permissions()
 {
     if (user_permissions_get("timekeeping")) {
         // check if user has permissions to view the selected employee
         if ($this->employeeid) {
             if (!user_permissions_staff_get("timereg_view", $this->employeeid)) {
                 log_write("error", "page_output", "Sorry, you do not have permissions to view the timesheet for the selected employee");
                 // we unset the session variable, this prevents issues when the admin has disabled access to an employee
                 // for a specific user, and the session keeping the older user number stuck in memory forces
                 // the user to have to logout.
                 $_SESSION["form"]["timereg"]["employeeid"] = 0;
                 return 0;
             }
         }
         // accept user if they have access to all staff
         if (user_permissions_get("timekeeping_all_view")) {
             return 1;
         }
         // select the IDs that the user does have access to
         if ($this->access_staff_ids = user_permissions_staff_getarray("timereg_view")) {
             return 1;
         }
     }
 }

<?php

/*
	projects/phase-edit-process.php

	access: projects_write

	Allows new phases to be added to projects, or existing phases to be modified
*/
// includes
include_once "../include/config.php";
include_once "../include/amberphplib/main.php";
if (user_permissions_get('projects_write')) {
    /////////////////////////
    $projectid = @security_form_input_predefined("int", "projectid", 1, "");
    $phaseid = @security_form_input_predefined("int", "phaseid", 0, "");
    $data["name_phase"] = @security_form_input_predefined("any", "name_phase", 1, "You must set a phase name.");
    $data["description"] = @security_form_input_predefined("any", "description", 0, "");
    //// VERIFY PROJECT/PHASE IDS /////////////
    // check that the specified project actually exists
    $sql_obj = new sql_query();
    $sql_obj->string = "SELECT id FROM `projects` WHERE id='{$projectid}' LIMIT 1";
    $sql_obj->execute();
    if (!$sql_obj->num_rows()) {
        log_write("error", "process", "The project you have attempted to edit - {$projectid} - does not exist in this system.");
    } else {
        if ($phaseid) {
            $mode = "edit";
            // are we editing an existing phase? make sure it exists and belongs to this project
            $sql_obj = new sql_query();
            $sql_obj->string = "SELECT projectid FROM `project_phases` WHERE id='{$phaseid}' LIMIT 1";

 function check_permissions()
 {
     return user_permissions_get("admin");
 }

 function render_html()
 {
     // title
     print "<h3>CUSTOMER PORTAL OPTIONS</h3><br>";
     print "<p>There are various options for the customer portal which can be configured and defined here, such as the customer's login password.</p>";
     // display the form
     $this->obj_form->render_form();
     if (!user_permissions_get("customers_write")) {
         format_msgbox("locked", "<p>Sorry, you do not have permission to edit this customer</p>");
     }
 }

 $sql_obj->string = "INSERT INTO users_options (userid, name, value) VALUES ({$id}, 'default_employeeid', '" . $data["option_default_employeeid"] . "')";
 $sql_obj->execute();
 //themes
 $sql_obj->string = "INSERT INTO users_options (userid, name, value) VALUES ({$id}, 'theme', '" . $data["option_theme"] . "')";
 $sql_obj->execute();
 // administrator-only options
 if (user_permissions_get("admin")) {
     // debugging
     $sql_obj->string = "INSERT INTO users_options (userid, name, value) VALUES ({$id}, 'debug', '" . $data["option_debug"] . "')";
     $sql_obj->execute();
     // concurrent logins
     $sql_obj->string = "INSERT INTO users_options (userid, name, value) VALUES ({$id}, 'concurrent_logins', '" . $data["option_concurrent_logins"] . "')";
     $sql_obj->execute();
 }
 //translate options
 if (user_permissions_get("devel_translate")) {
     $sql_obj->string = "INSERT INTO users_options (userid, name, value) VALUES ({$id}, 'translation', '" . $data["option_translation"] . "')";
     $sql_obj->execute();
 }
 /*
 	Complete
 */
 if (!$_SESSION["error"]["message"]) {
     $sql_obj->trans_commit();
     log_write("notification", "process", "Account changes applied successfully.");
     journal_quickadd_event("users", $id, "User changed account options");
     /*
     	Apply changes to active session
     */
     $sql_obj->string = "SELECT name, value FROM users_options WHERE userid='{$id}'";
     $sql_obj->execute();

 function render_html()
 {
     // calcuate next/previous week/year
     if ($this->date_selected_weekofyear == 1) {
         $date_option_previousyear = $this->date_selected_year - 1;
         $date_option_previousweek = 52;
         $date_option_nextyear = $this->date_selected_year;
         $date_option_nextweek = 2;
     } elseif ($this->date_selected_weekofyear == 52) {
         $date_option_previousyear = $this->date_selected_year;
         $date_option_previousweek = 51;
         $date_option_nextyear = $this->date_selected_year + 1;
         $date_option_nextweek = 1;
     } else {
         $date_option_previousyear = $this->date_selected_year;
         $date_option_previousweek = $this->date_selected_weekofyear - 1;
         $date_option_nextyear = $this->date_selected_year;
         $date_option_nextweek = $this->date_selected_weekofyear + 1;
     }
     // Week view header
     print "<h3>TIME REGISTRATION</h3><br><br>";
     /*
     	Unbilled Time
     */
     if (user_permissions_get("projects_timegroup")) {
         /*
         	Create an array of all unbilled time records. We need to do the following to create this list:
         	1. Exclude any internal_only projects.
         	2. Include time which belongs to a time_group, but ONLY if the time group has not been added to an invoice.
         */
         $unbilled_ids = array();
         // select non-internal projects
         $sql_projects_obj = new sql_query();
         $sql_projects_obj->string = "SELECT projects.id as projectid, project_phases.id as phaseid FROM project_phases LEFT JOIN projects ON projects.id = project_phases.projectid WHERE projects.internal_only='0'";
         $sql_projects_obj->execute();
         if ($sql_projects_obj->num_rows()) {
             $sql_projects_obj->fetch_array();
             foreach ($sql_projects_obj->data as $project_data) {
                 // select non-group time records
                 $sql_obj = new sql_query();
                 $sql_obj->string = "SELECT id FROM timereg WHERE groupid='0' AND phaseid='" . $project_data["phaseid"] . "'";
                 $sql_obj->execute();
                 if ($sql_obj->num_rows()) {
                     $sql_obj->fetch_array();
                     foreach ($sql_obj->data as $data_tmp) {
                         // we store the ID inside an array key, since they are unique
                         // and this will prevent us needed to check for the existance of
                         // the ID already.
                         $unbilled_ids[$data_tmp["id"]] = "on";
                     }
                 }
                 unset($sql_obj);
                 // select unpaid group IDs
                 $sql_obj = new sql_query();
                 $sql_obj->string = "SELECT id FROM time_groups WHERE projectid='" . $project_data["projectid"] . "' AND invoiceid='0'";
                 $sql_obj->execute();
                 if ($sql_obj->num_rows()) {
                     $sql_obj->fetch_array();
                     foreach ($sql_obj->data as $data_group) {
                         // fetch all the time reg IDs belonging this group, but only select time entries marked as billable - we
                         // don't want to report a timegroup with unbillable time as being billed!
                         $sql_reg_obj = new sql_query();
                         $sql_reg_obj->string = "SELECT id FROM timereg WHERE groupid='" . $data_group["id"] . "' AND billable='1'";
                         $sql_reg_obj->execute();
                         if ($sql_reg_obj->num_rows()) {
                             $sql_reg_obj->fetch_array();
                             foreach ($sql_reg_obj->data as $data_tmp) {
                                 // we store the ID inside an array key, since they are unique
                                 // and this will prevent us needed to check for the existance of
                                 // the ID already.
                                 $unbilled_ids[$data_tmp["id"]] = "on";
                             }
                         }
                         unset($sql_reg_obj);
                     }
                 }
                 unset($sql_obj);
             }
         }
         // fetch amount of unbilled time
         $sql_obj = new sql_query();
         $sql_obj->prepare_sql_settable("timereg");
         $sql_obj->prepare_sql_addfield("timebooked", "SUM(timereg.time_booked)");
         if ($this->access_staff_ids) {
             $sql_obj->prepare_sql_addwhere("employeeid IN (" . format_arraytocommastring($this->access_staff_ids) . ")");
         }
         $sql_obj->prepare_sql_addjoin("LEFT JOIN time_groups ON timereg.groupid = time_groups.id");
         // provide list of valid IDs
         $unbilled_ids_keys = array_keys($unbilled_ids);
         $unbilled_ids_count = count($unbilled_ids_keys);
         $unbilled_ids_sql = "";
         if ($unbilled_ids_count) {
             $i = 0;
             foreach ($unbilled_ids_keys as $id) {
                 $i++;
                 if ($i == $unbilled_ids_count) {
                     $unbilled_ids_sql .= "timereg.id='{$id}' ";
                 } else {
                     $unbilled_ids_sql .= "timereg.id='{$id}' OR ";
                 }
//.........这里部分代码省略.........