webinterface.git

@@ -6,6 +6,18 @@ require_once('inc/debug.php');

 function config($key)

 {

   global $config;

+

+  if ($key == 'modules' && isset($_SESSION['restrict_modules']))

+  {

+    $modules = array();

+    foreach ($config['modules'] as $mod)

+    {

+      if (in_array($mod, $_SESSION['restrict_modules']))

+        $modules[] = $mod;

+    }

+    return $modules;

+  }

+

   if (array_key_exists($key, $config))

     return $config[$key];

@@ -114,7 +114,11 @@ $userinfo = '';

 $role = $_SESSION['role'];

 if ($role != ROLE_ANONYMOUS) {

   $userinfo .= '<p class="userinfo">Angemeldet als:<br />';

-  if ($role & ROLE_SYSTEMUSER) {

+  if ($role & ROLE_SYSTEMUSER && isset($_SESSION['subuser'])) {

+    $userinfo .= '<strong>'.$_SESSION['subuser'].'</strong>';

+    $userinfo .= '<br />Mitbenutzer von '.$_SESSION['userinfo']['username'];

+  }

+  elseif ($role & ROLE_SYSTEMUSER) {

     $userinfo .= '<strong>'.$_SESSION['userinfo']['username'].'</strong>';

     $userinfo .= '<br />'.$_SESSION['userinfo']['name'];

     $userinfo .= '<br />(Benutzer'.(($role & ROLE_CUSTOMER) ? ', Kunde' : '').')';

@@ -27,6 +27,9 @@ case ROLE_MAILACCOUNT:

 case ROLE_SYSTEMUSER:

   $role = "{$_SESSION['userinfo']['name']}, angemeldet als Benutzer";

   break;

+case ROLE_SYSTEMUSER | ROLE_SUBUSER:

+  $role = "{$_SESSION['subuser']}, Unternutzer von {$_SESSION['userinfo']['username']}";

+  break;

 case ROLE_CUSTOMER:

   $role = "{$_SESSION['customerinfo']['name']}, angemeldet als Kunde";

   break;

@@ -6,9 +6,9 @@ if ($role == ROLE_ANONYMOUS) {

   $menu["index_login"] = array("label" => "Login", "file" => "index", "weight" => 0);

   $menu["certlogin"] = array("label" => "Client-Zertifikat", "file" => "certinfo", "weight" => 10);

 } else {

-  if ($role & ROLE_SYSTEMUSER)

+  if ($role & ROLE_SYSTEMUSER && ! ($role & ROLE_SUBUSER))

     $menu["index_cert"] = array("label" => "Client-Zertifikat", "file" => "cert", "weight" => 10, "submenu" => "index_index");

-  if ($role & (ROLE_SYSTEMUSER | ROLE_CUSTOMER)) {

+  if ($role & (ROLE_SYSTEMUSER | ROLE_CUSTOMER) && ! $role & ROLE_SUBUSER) {

     $menu["index_chpass"] = array("label" => "Passwort ändern", "file" => "chpass", "weight" => 98);

   }

@@ -12,6 +12,7 @@ define('ROLE_VMAIL_ACCOUNT', 2);

 define('ROLE_SYSTEMUSER', 4);

 define('ROLE_CUSTOMER', 8);

 define('ROLE_SYSADMIN', 16);

+define('ROLE_SUBUSER', 32);

 // Gibt die Rolle aus, wenn das Passwort stimmt

@@ -92,6 +93,15 @@ function find_role($login, $password, $i_am_admin = False)

   }

+  // Sub-User

+

+  $result = db_query("SELECT uid FROM system.subusers WHERE username='{$login}' AND password=SHA1('{$password}')");

+  if (@mysql_num_rows($result) > 0)

+  {

+    // FIXME: Admin-Su-Anmeldung geht damit nicht

+    return ROLE_SUBUSER;

+  }

+

   // Nothing?

   return NULL;

@@ -129,6 +139,21 @@ function get_customer_info($customer)

 }

+function get_subuser_info($username)

+{

+  $result = db_query("SELECT uid, modules FROM system.subusers WHERE username='{$username}'");

+  if (mysql_num_rows($result) < 1)

+  {

+    logger(LOG_ERR, "session/checkuser", "login", "error reading subuser's data: »{$username}«");

+    system_failure('Das Auslesen Ihrer Benutzerdaten ist fehlgeschlagen. Bitte melden Sie dies einem Administrator');

+  }

+  $data = mysql_fetch_assoc($result);

+  $userinfo = get_user_info($data['uid']);

+  $userinfo['modules'] = $data['modules'];

+  return $userinfo;

+}

+

+

 function get_user_info($username)

 {

   $username = mysql_real_escape_string($username);

@@ -194,6 +219,16 @@ function setup_session($role, $useridentity)

 {

   session_regenerate_id();

   $_SESSION['role'] = $role;

+  if ($role & ROLE_SUBUSER)

+  {

+    DEBUG("We are a sub-user");

+    $info = get_subuser_info($useridentity);

+    $_SESSION['userinfo'] = $info;

+    $_SESSION['subuser'] = $useridentity;

+    $_SESSION['role'] = ROLE_SYSTEMUSER | ROLE_SUBUSER;

+    $_SESSION['restrict_modules'] = explode(',', $info['modules']);

+    logger(LOG_INFO, "session/start", "login", "logged in user »{$info['username']}«");

+  }

   if ($role & ROLE_SYSTEMUSER)

   {

     DEBUG("We are system user");