webinterface.git

@@ -17,7 +17,6 @@ if (! customer_may_have_useraccounts())

 }

 else

 {

-  $primary = primary_useraccount();

   $accounts = list_useraccounts();

   output("<p>Folgende Benutzeraccounts haben Sie bisher:</p>");

   output("<table><tr><th>Benutzername</th><th>Name</th><th>Erstellt am</th><th>Speicherplatz</th></tr>");

@@ -25,7 +24,7 @@ else

   {

     output("<tr><td>");

-    if ($acc->uid == $primary)

+    if (customer_useraccount($acc->uid))

       output($acc->username);

     else

       output(internal_link('edit.php', $acc->username, "uid={$acc->uid}"));

@@ -14,7 +14,7 @@ $account = get_account_details($_GET['uid']);

 output("<h3>Bearbeiten von Benutzer »{$account['username']}«</h3>");

-if ($account['uid'] == primary_useraccount())

+if (customer_useraccount($account['uid']))

   system_failure('Aus Sicherheitsgründen können Sie diesen Account nicht ändern!');

@@ -13,6 +13,12 @@ function customer_may_have_useraccounts()

   return (mysql_num_rows($result) > 0);

 }

+function customer_useraccount($uid) {

+  $uid = (int) $uid;

+  $customerno = (int) $_SESSION['customerinfo']['customerno'];

+  $result = db_query("SELECT 1 FROM system.useraccounts WHERE kunde={$customerno} AND uid={$uid} AND kundenaccount=1");

+  return mysql_num_rows($result) > 0;

+}

 function primary_useraccount()

 {

@@ -34,7 +34,7 @@ elseif ($_GET['action'] == 'edit')

 {

   $error = false;

   check_form_token('systemuser_edit');

-  if ($_POST['uid'] == primary_useraccount())

+  if (customer_useraccount($_POST['uid']))

     system_failure('Aus Sicherheitsgründen können Sie diesen Account nicht ändern!');

   if ($_POST['newpass'] != '')

@@ -23,7 +23,7 @@ function find_role($login, $password, $i_am_admin = False)

   $uid = (int) $login;

   if ($uid == 0)

     $uid = 'NULL';

-  $result = db_query("SELECT passwort AS password, (u.uid = (SELECT min(uid) FROM system.v_useraccounts AS acc WHERE acc.kunde=u.kunde)) AS  `primary`, ((SELECT acc.uid FROM system.v_useraccounts AS acc LEFT JOIN system.gruppenzugehoerigkeit USING (uid) LEFT JOIN system.gruppen AS g ON (g.gid=gruppenzugehoerigkeit.gid) WHERE g.name='admin' AND acc.uid=u.uid) IS NOT NULL) AS admin FROM system.v_useraccounts AS u LEFT JOIN system.passwoerter USING(uid) WHERE u.uid={$uid} OR username='{$login}' LIMIT 1;");

+  $result = db_query("SELECT passwort AS password, kundenaccount AS `primary`, ((SELECT acc.uid FROM system.v_useraccounts AS acc LEFT JOIN system.gruppenzugehoerigkeit USING (uid) LEFT JOIN system.gruppen AS g ON (g.gid=gruppenzugehoerigkeit.gid) WHERE g.name='admin' AND acc.uid=u.uid) IS NOT NULL) AS admin FROM system.v_useraccounts AS u LEFT JOIN system.passwoerter USING(uid) WHERE u.uid={$uid} OR username='{$login}' LIMIT 1;");

   if (@mysql_num_rows($result) > 0)

   {

     $entry = mysql_fetch_object($result);