@@ -2,14 +2,11 @@

 /*

 This file belongs to the Webinterface of schokokeks.org Hosting

-Written 2008-2018 by schokokeks.org Hosting, namely

+Written by schokokeks.org Hosting, namely

   Bernd Wurst <bernd@schokokeks.org>

   Hanno Böck <hanno@schokokeks.org>

-To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.

-

-You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see

-http://creativecommons.org/publicdomain/zero/1.0/

+This code is published under a 0BSD license.

 Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

 */

@@ -16,7 +16,6 @@ Nevertheless, in case you use a significant part of this code, we ask (but not r

 require_once('inc/base.php');

 require_once('inc/security.php');

-require_once('inc/debug.php');

 require_once('session/start.php');

 require_once('su.php');

@@ -37,7 +36,7 @@ if (isset($_GET['do'])) {

 $search = null;

 if (isset($_POST['query'])) {

     check_form_token('su_su');

-    $id = filter_input_general($_POST['query']);

+    $id = $_POST['query'];

     if (! su(null, $id)) {

         $search = $_POST['query'];

     }

@@ -48,11 +47,6 @@ title("Benutzer wechseln");

 output('<p>Hiermit können Sie (als Admin) das Webinterface mit den Rechten eines beliebigen anderen Benutzers benutzen.</p>

 ');

-$debug = '';

-if ($debugmode) {

-    $debug = 'debug&';

-}

-

 require_once('inc/jquery.php');

 // lädt die JS-Datei mit gleichem basename

 javascript();

@@ -63,6 +57,6 @@ output(html_form('su_su', '', '', '<p><label for="query"><strong>Suchtext:</stro

 if ($search) {

     $allentries = build_results($search);

     foreach ($allentries as $entry) {

-        output("  <p><a href=\"?do=".filter_input_general($entry['id'])."\">".filter_input_general($entry['value'])."</a></p>");

+        output("  <p><a href=\"?do=".filter_output_html($entry['id'])."\">".filter_output_html($entry['value'])."</a></p>");

     }

 }

@@ -8,7 +8,7 @@ Written 2008-2018 by schokokeks.org Hosting, namely

 To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.

-You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see 

+You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see

 http://creativecommons.org/publicdomain/zero/1.0/

 Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

@@ -25,24 +25,22 @@ require_role(ROLE_SYSADMIN);

-if (isset($_GET['do']))

-{

-  if ($_SESSION['su_ajax_timestamp'] < time() - 30) {

-    system_failure("Die su-Auswahl ist schon abgelaufen!");

-  }

-  $type = $_GET['do'][0];

-  $id = (int) substr($_GET['do'], 1);

-  su($type, $id);

+if (isset($_GET['do'])) {

+    if ($_SESSION['su_ajax_timestamp'] < time() - 30) {

+        system_failure("Die su-Auswahl ist schon abgelaufen!");

+    }

+    $type = $_GET['do'][0];

+    $id = (int) substr($_GET['do'], 1);

+    su($type, $id);

 }

-$search = NULL;

-if (isset($_POST['query']))

-{

-  check_form_token('su_su');

-  $id = filter_input_general($_POST['query']);

-  if (! su(NULL, $id)) {

-    $search = $_POST['query'];

-  }

+$search = null;

+if (isset($_POST['query'])) {

+    check_form_token('su_su');

+    $id = filter_input_general($_POST['query']);

+    if (! su(null, $id)) {

+        $search = $_POST['query'];

+    }

 }

 title("Benutzer wechseln");

@@ -51,8 +49,9 @@ output('<p>Hiermit können Sie (als Admin) das Webinterface mit den Rechten eine

 ');

 $debug = '';

-if ($debugmode)

-  $debug = 'debug&';

+if ($debugmode) {

+    $debug = 'debug&';

+}

 require_once('inc/jquery.php');

 // lädt die JS-Datei mit gleichem basename

@@ -62,9 +61,8 @@ output(html_form('su_su', '', '', '<p><label for="query"><strong>Suchtext:</stro

 '));

 if ($search) {

-  $allentries = build_results($search);

-  foreach ($allentries as $entry) {

-    output("  <p><a href=\"?do=".filter_input_general($entry['id'])."\">".filter_input_general($entry['value'])."</a></p>");

-  }

+    $allentries = build_results($search);

+    foreach ($allentries as $entry) {

+        output("  <p><a href=\"?do=".filter_input_general($entry['id'])."\">".filter_input_general($entry['value'])."</a></p>");

+    }

 }

-

@@ -2,7 +2,7 @@

 /*

 This file belongs to the Webinterface of schokokeks.org Hosting

-Written 2008-2014 by schokokeks.org Hosting, namely

+Written 2008-2018 by schokokeks.org Hosting, namely

   Bernd Wurst <bernd@schokokeks.org>

   Hanno Böck <hanno@schokokeks.org>

@@ -24,34 +24,6 @@ require_once('su.php');

 require_role(ROLE_SYSADMIN);

-function su($type, $id) {

-  $role = NULL;

-  $admin_user = $_SESSION['userinfo']['username'];

-  $_SESSION['admin_user'] = $admin_user;

-  $role = find_role($id, '', True);

-  if (!$role) {

-    unset($_SESSION['admin_user']);

-    return False;

-  }

-  setup_session($role, $id);

-  if ($type == 'c') {

-    if (! (ROLE_CUSTOMER & $_SESSION['role'])) {

-      session_destroy();

-      system_failure('Es wurde ein "su" zu einem Kundenaccount angefordert, das war aber kein Kundenaccount!');

-    }

-  } elseif ($type == 'u') {

-    if (! (ROLE_SYSTEMUSER & $_SESSION['role'])) {

-      session_destroy();

-      system_failure('Es wurde ein "su" zu einem Benutzeraccount angefordert, das war aber kein Benutzeraccount!');

-    }

-  } elseif ($type) {

-    // wenn type leer ist, dann ist es auch egal

-    system_failure('unknown type');

-  }

-

-  redirect('../../go/index/index');

-  die();

-}

 if (isset($_GET['do']))

 {

@@ -2,7 +2,7 @@

 /*

 This file belongs to the Webinterface of schokokeks.org Hosting

-Written 2008-2013 by schokokeks.org Hosting, namely

+Written 2008-2014 by schokokeks.org Hosting, namely

   Bernd Wurst <bernd@schokokeks.org>

   Hanno Böck <hanno@schokokeks.org>

@@ -83,20 +83,11 @@ if ($debugmode)

   $debug = 'debug&';

 require_once('inc/jquery.php');

+// lädt die JS-Datei mit gleichem basename

+javascript();

 output(html_form('su_su', '', '', '<p><label for="query"><strong>Suchtext:</strong></label> <input type="text" name="query" id="query" /> <input type="submit" value="Suchen" /></p>

 '));

-output('

-<script type="text/javascript">

-$("#query").autocomplete({

-    source: "su_ajax",

-    select: function( event, ui ) {

-      if (ui.item) {

-        window.location.href = "?do="+ui.item.id;

-      }

-}

- });

-</script>');

 if ($search) {

   $allentries = build_results($search);

@@ -105,39 +96,3 @@ if ($search) {

   }

 }

-/*

-

-

-$users = list_system_users();

-$options = '';

-foreach ($users as $user)

-{

-  $options .= "  <option value=\"{$user->uid}\">{$user->username} ({$user->uid})</option>\n";

-}

-

-output(html_form('su_su', 'su', '', '<p>Benutzer auswählen:

-<select name="destination" size="1">

-'.$options.'

-</select>

-<input type="submit" name="submit" value="zum Benutzer wechseln" />

-</p>

-'));

-

-$customers = list_customers();

-$options = '';

-foreach ($customers as $customer)

-{

-  $options .= "  <option value=\"{$customer->id}\">{$customer->id} - ".htmlspecialchars($customer->name)."</option>\n";

-}

-

-output(html_form('su_su', 'su', '', '<p>Kunde auswählen:

-<select name="destination" size="1">

-'.$options.'

-</select>

-<input type="submit" name="submit" value="zum Kunden wechseln" />

-</p>

-'));

-

-*/

-

-?>

@@ -82,13 +82,7 @@ $debug = '';

 if ($debugmode)

   $debug = 'debug&';

-$path = config('jquery_ui_path');

-

-html_header('

-<link rel="stylesheet" href="'.$path.'/themes/base/jquery-ui.css" />

-<script type="text/javascript" src="'.$path.'/jquery-1.9.0.js" ></script>

-<script type="text/javascript" src="'.$path.'/ui/jquery-ui.js" ></script>

-');

+require_once('inc/jquery.php');

 output(html_form('su_su', '', '', '<p><label for="query"><strong>Suchtext:</strong></label> <input type="text" name="query" id="query" /> <input type="submit" value="Suchen" /></p>

 '));

@@ -85,15 +85,15 @@ if ($debugmode)

 $path = config('jquery_ui_path');

 html_header('

-<link rel="stylesheet" href="'.$path.'/themes/base/jquery-ui.css">

+<link rel="stylesheet" href="'.$path.'/themes/base/jquery-ui.css" />

 <script type="text/javascript" src="'.$path.'/jquery-1.9.0.js" ></script>

 <script type="text/javascript" src="'.$path.'/ui/jquery-ui.js" ></script>

 ');

-output(html_form('su_su', '', '', '<label for="query"><strong>Suchtext:</strong></label> <input autocomplete="off" type="text" name="query" id="query" />

+output(html_form('su_su', '', '', '<p><label for="query"><strong>Suchtext:</strong></label> <input type="text" name="query" id="query" /> <input type="submit" value="Suchen" /></p>

 '));

 output('

-<script>

+<script type="text/javascript">

 $("#query").autocomplete({

     source: "su_ajax",

     select: function( event, ui ) {

@@ -15,6 +15,7 @@ Nevertheless, in case you use a significant part of this code, we ask (but not r

 */

 require_once('inc/base.php');

+require_once('inc/security.php');

 require_once('inc/debug.php');

 require_once('session/start.php');

@@ -30,7 +31,7 @@ function su($type, $id) {

   $role = find_role($id, '', True);

   if (!$role) {

     unset($_SESSION['admin_user']);

-    return;

+    return False;

   }

   setup_session($role, $id);

   if ($type == 'c') {

@@ -62,11 +63,14 @@ if (isset($_GET['do']))

   su($type, $id);

 }

+$search = NULL;

 if (isset($_POST['query']))

 {

   check_form_token('su_su');

   $id = filter_input_general($_POST['query']);

-  su(NULL, $id);

+  if (! su(NULL, $id)) {

+    $search = $_POST['query'];

+  }

 }

 title("Benutzer wechseln");

@@ -100,6 +104,13 @@ $("#query").autocomplete({

  });

 </script>');

+if ($search) {

+  $allentries = build_results($search);

+  foreach ($allentries as $entry) {

+    output("  <p><a href=\"?do=".filter_input_general($entry['id'])."\">".filter_input_general($entry['value'])."</a></p>");

+  }

+}

+

 /*

@@ -78,13 +78,15 @@ $debug = '';

 if ($debugmode)

   $debug = 'debug&';

+$path = config('jquery_ui_path');

+

 html_header('

-<link rel="stylesheet" href="http://code.jquery.com/ui/1.10.0/themes/base/jquery-ui.css">

-<script type="text/javascript" src="http://code.jquery.com/jquery-1.9.0.js" ></script>

-<script type="text/javascript" src="http://code.jquery.com/ui/1.10.0/jquery-ui.js" ></script>

+<link rel="stylesheet" href="'.$path.'/themes/base/jquery-ui.css">

+<script type="text/javascript" src="'.$path.'/jquery-1.9.0.js" ></script>

+<script type="text/javascript" src="'.$path.'/ui/jquery-ui.js" ></script>

 ');

-output(html_form('su_su', '', '', '<label for="query"><strong>Suchtext:</strong></label> <input type="text" name="query" id="query" />

+output(html_form('su_su', '', '', '<label for="query"><strong>Suchtext:</strong></label> <input autocomplete="off" type="text" name="query" id="query" />

 '));

 output('

 <script>

@@ -22,39 +22,51 @@ require_once('su.php');

 require_role(ROLE_SYSADMIN);

-if (isset($_GET['do']))

-{

-  if ($_SESSION['su_ajax_timestamp'] < time() - 30) {

-    system_failure("Die su-Auswahl ist schon abgelaufen!");

-  }

-  $type = $_GET['do'][0];

-  $id = (int) substr($_GET['do'], 1);

+

+function su($type, $id) {

   $role = NULL;

   $admin_user = $_SESSION['userinfo']['username'];

   $_SESSION['admin_user'] = $admin_user;

+  $role = find_role($id, '', True);

+  if (!$role) {

+    unset($_SESSION['admin_user']);

+    return;

+  }

+  setup_session($role, $id);

   if ($type == 'c') {

-    $role = find_role($id, '', True);

-    setup_session($role, $id);

+    if (! (ROLE_CUSTOMER & $_SESSION['role'])) {

+      session_destroy();

+      system_failure('Es wurde ein "su" zu einem Kundenaccount angefordert, das war aber kein Kundenaccount!');

+    }

   } elseif ($type == 'u') {

-    $role = find_role($id, '', True);

-    setup_session($role, $id);

-  } else {

+    if (! (ROLE_SYSTEMUSER & $_SESSION['role'])) {

+      session_destroy();

+      system_failure('Es wurde ein "su" zu einem Benutzeraccount angefordert, das war aber kein Benutzeraccount!');

+    }

+  } elseif ($type) {

+    // wenn type leer ist, dann ist es auch egal

     system_failure('unknown type');

   }

-  header('Location: ../../go/index/index');

+  redirect('../../go/index/index');

   die();

 }

-if (isset($_POST['submit']))

+if (isset($_GET['do']))

 {

-  check_form_token('su_su');

-  $id = (int) $_POST['destination'];

-  $role = find_role($id, '', True);

-  setup_session($role, $id);

+  if ($_SESSION['su_ajax_timestamp'] < time() - 30) {

+    system_failure("Die su-Auswahl ist schon abgelaufen!");

+  }

+  $type = $_GET['do'][0];

+  $id = (int) substr($_GET['do'], 1);

+  su($type, $id);

+}

-  header('Location: ../../go/index/index');

-  die();

+if (isset($_POST['query']))

+{

+  check_form_token('su_su');

+  $id = filter_input_general($_POST['query']);

+  su(NULL, $id);

 }

 title("Benutzer wechseln");

@@ -72,9 +84,8 @@ html_header('

 <script type="text/javascript" src="http://code.jquery.com/ui/1.10.0/jquery-ui.js" ></script>

 ');

-output('<label for="query"><strong>Suchtext:</strong></label> <input type="text" id="query" />

-<input type="hidden" id="query_id" name="query_id" />

-');

+output(html_form('su_su', '', '', '<label for="query"><strong>Suchtext:</strong></label> <input type="text" name="query" id="query" />

+'));

 output('

 <script>

 $("#query").autocomplete({

@@ -22,18 +22,22 @@ require_once('su.php');

 require_role(ROLE_SYSADMIN);

-if (isset($_GET['type']))

+if (isset($_GET['do']))

 {

-  check_form_token('su_su_ajax', $_GET['formtoken']);

+  if ($_SESSION['su_ajax_timestamp'] < time() - 30) {

+    system_failure("Die su-Auswahl ist schon abgelaufen!");

+  }

+  $type = $_GET['do'][0];

+  $id = (int) substr($_GET['do'], 1);

   $role = NULL;

   $admin_user = $_SESSION['userinfo']['username'];

   $_SESSION['admin_user'] = $admin_user;

-  if ($_GET['type'] == 'customer') {

-    $role = find_role($_GET['id'], '', True);

-    setup_session($role, $_GET['id']);

-  } elseif ($_GET['type'] == 'systemuser') {

-    $role = find_role($_GET['uid'], '', True);

-    setup_session($role, $_GET['uid']);

+  if ($type == 'c') {

+    $role = find_role($id, '', True);

+    setup_session($role, $id);

+  } elseif ($type == 'u') {

+    $role = find_role($id, '', True);

+    setup_session($role, $id);

   } else {

     system_failure('unknown type');

   }

@@ -62,32 +66,26 @@ $debug = '';

 if ($debugmode)

   $debug = 'debug&';

-html_header('<script type="text/javascript" src="'.$prefix.'js/ajax.js" ></script>

-<script type="text/javascript">

-

-function doRequest() {

-  ajax_request(\'su_ajax\', \''.$debug.'q=\'+document.getElementById(\'query\').value, got_response)

-}

-

-function keyPressed() {

-  if(window.mytimeout) window.clearTimeout(window.mytimeout);

-  window.mytimeout = window.setTimeout(doRequest, 500);

-  return true;

-}

-

-function got_response() {

-  if (xmlHttp.readyState == 4) {

-    document.getElementById(\'response\').innerHTML = xmlHttp.responseText;

-  }

-}

-

-</script>

+html_header('

+<link rel="stylesheet" href="http://code.jquery.com/ui/1.10.0/themes/base/jquery-ui.css">

+<script type="text/javascript" src="http://code.jquery.com/jquery-1.9.0.js" ></script>

+<script type="text/javascript" src="http://code.jquery.com/ui/1.10.0/jquery-ui.js" ></script>

 ');

-output(html_form('su_su_ajax', '', '', '<strong>Suchtext:</strong> <input type="text" id="query" onkeyup="keyPressed()" />

-'));

-output('<div id="response"></div>

-<div style="height: 3em;">&#160;</div>');

+output('<label for="query"><strong>Suchtext:</strong></label> <input type="text" id="query" />

+<input type="hidden" id="query_id" name="query_id" />

+');

+output('

+<script>

+$("#query").autocomplete({

+    source: "su_ajax",

+    select: function( event, ui ) {

+      if (ui.item) {

+        window.location.href = "?do="+ui.item.id;

+      }

+}

+ });

+</script>');

 /*

@@ -2,7 +2,7 @@

 /*

 This file belongs to the Webinterface of schokokeks.org Hosting

-Written 2008-2012 by schokokeks.org Hosting, namely

+Written 2008-2013 by schokokeks.org Hosting, namely

   Bernd Wurst <bernd@schokokeks.org>

   Hanno Böck <hanno@schokokeks.org>

@@ -1,4 +1,18 @@

 <?php

+/*

+This file belongs to the Webinterface of schokokeks.org Hosting

+

+Written 2008-2012 by schokokeks.org Hosting, namely

+  Bernd Wurst <bernd@schokokeks.org>

+  Hanno Böck <hanno@schokokeks.org>

+

+To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.

+

+You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see 

+http://creativecommons.org/publicdomain/zero/1.0/

+

+Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

+*/

 require_once('inc/base.php');

 require_once('inc/debug.php');

@@ -13,6 +13,7 @@ if (isset($_GET['type']))

   check_form_token('su_su_ajax', $_GET['formtoken']);

   $role = NULL;

   $admin_user = $_SESSION['userinfo']['username'];

+  $_SESSION['admin_user'] = $admin_user;

   if ($_GET['type'] == 'customer') {

     $role = find_role($_GET['id'], '', True);

     setup_session($role, $_GET['id']);

@@ -22,7 +23,6 @@ if (isset($_GET['type']))

   } else {

     system_failure('unknown type');

   }

-  $_SESSION['admin_user'] = $admin_user;

   header('Location: ../../go/index/index');

   die();

@@ -39,10 +39,9 @@ if (isset($_POST['submit']))

   die();

 }

-$title = "Benutzer wechseln";

+title("Benutzer wechseln");

-output('<h3>Benutzer wechseln</h3>

-<p>Hiermit können Sie (als Admin) das Webinterface mit den Rechten eines beliebigen anderen Benutzers benutzen.</p>

+output('<p>Hiermit können Sie (als Admin) das Webinterface mit den Rechten eines beliebigen anderen Benutzers benutzen.</p>

 ');

 $debug = '';

@@ -51,7 +51,6 @@ if ($debugmode)

 html_header('<script type="text/javascript" src="'.$prefix.'js/ajax.js" ></script>

 <script type="text/javascript">

-<!--

 function doRequest() {

   ajax_request(\'su_ajax\', \''.$debug.'q=\'+document.getElementById(\'query\').value, got_response)

@@ -69,7 +68,6 @@ function got_response() {

   }

 }

-// -->

 </script>

 ');

@@ -78,6 +76,7 @@ output(html_form('su_su_ajax', '', '', '<strong>Suchtext:</strong> <input type="

 output('<div id="response"></div>

 <div style="height: 3em;">&#160;</div>');

+/*

 $users = list_system_users();

@@ -99,7 +98,7 @@ $customers = list_customers();

 $options = '';

 foreach ($customers as $customer)

 {

-  $options .= "  <option value=\"{$customer->id}\">{$customer->id} - {$customer->name}</option>\n";

+  $options .= "  <option value=\"{$customer->id}\">{$customer->id} - ".htmlspecialchars($customer->name)."</option>\n";

 }

 output(html_form('su_su', 'su', '', '<p>Kunde auswählen:

@@ -110,6 +109,6 @@ output(html_form('su_su', 'su', '', '<p>Kunde auswählen:

 </p>

 '));

-

+*/

 ?>

@@ -12,6 +12,7 @@ if (isset($_GET['type']))

 {

   check_form_token('su_su_ajax', $_GET['formtoken']);

   $role = NULL;

+  $admin_user = $_SESSION['userinfo']['username'];

   if ($_GET['type'] == 'customer') {

     $role = find_role($_GET['id'], '', True);

     setup_session($role, $_GET['id']);

@@ -21,6 +22,7 @@ if (isset($_GET['type']))

   } else {

     system_failure('unknown type');

   }

+  $_SESSION['admin_user'] = $admin_user;

   header('Location: ../../go/index/index');

   die();

@@ -1,5 +1,6 @@

 <?php

+require_once('inc/base.php');

 require_once('inc/debug.php');

 require_once('session/start.php');

@@ -7,6 +8,24 @@ require_once('su.php');

 require_role(ROLE_SYSADMIN);

+if (isset($_GET['type']))

+{

+  check_form_token('su_su_ajax', $_GET['formtoken']);

+  $role = NULL;

+  if ($_GET['type'] == 'customer') {

+    $role = find_role($_GET['id'], '', True);

+    setup_session($role, $_GET['id']);

+  } elseif ($_GET['type'] == 'systemuser') {

+    $role = find_role($_GET['uid'], '', True);

+    setup_session($role, $_GET['uid']);

+  } else {

+    system_failure('unknown type');

+  }

+

+  header('Location: ../../go/index/index');

+  die();

+}

+

 if (isset($_POST['submit']))

 {

   check_form_token('su_su');

@@ -18,14 +37,47 @@ if (isset($_POST['submit']))

   die();

 }

-

-

 $title = "Benutzer wechseln";

 output('<h3>Benutzer wechseln</h3>

 <p>Hiermit können Sie (als Admin) das Webinterface mit den Rechten eines beliebigen anderen Benutzers benutzen.</p>

 ');

+$debug = '';

+if ($debugmode)

+  $debug = 'debug&';

+

+html_header('<script type="text/javascript" src="'.$prefix.'js/ajax.js" ></script>

+<script type="text/javascript">

+<!--

+

+function doRequest() {

+  ajax_request(\'su_ajax\', \''.$debug.'q=\'+document.getElementById(\'query\').value, got_response)

+}

+

+function keyPressed() {

+  if(window.mytimeout) window.clearTimeout(window.mytimeout);

+  window.mytimeout = window.setTimeout(doRequest, 500);

+  return true;

+}

+

+function got_response() {

+  if (xmlHttp.readyState == 4) {

+    document.getElementById(\'response\').innerHTML = xmlHttp.responseText;

+  }

+}

+

+// -->

+</script>

+');

+

+output(html_form('su_su_ajax', '', '', '<strong>Suchtext:</strong> <input type="text" id="query" onkeyup="keyPressed()" />

+'));

+output('<div id="response"></div>

+<div style="height: 3em;">&#160;</div>');

+

+

+

 $users = list_system_users();

 $options = '';

 foreach ($users as $user)

@@ -14,7 +14,7 @@ if (isset($_POST['submit']))

   $role = find_role($id, '', True);

   setup_session($role, $id);

-  header('Location: ../../go/index/index.php');

+  header('Location: ../../go/index/index');

   die();

 }

@@ -33,7 +33,7 @@ foreach ($users as $user)

   $options .= "  <option value=\"{$user->uid}\">{$user->username} ({$user->uid})</option>\n";

 }

-output(html_form('su_su', 'su.php', '', '<p>Benutzer auswählen:

+output(html_form('su_su', 'su', '', '<p>Benutzer auswählen:

 <select name="destination" size="1">

 '.$options.'

 </select>

@@ -48,7 +48,7 @@ foreach ($customers as $customer)

   $options .= "  <option value=\"{$customer->id}\">{$customer->id} - {$customer->name}</option>\n";

 }

-output(html_form('su_su', 'su.php', '', '<p>Kunde auswählen:

+output(html_form('su_su', 'su', '', '<p>Kunde auswählen:

 <select name="destination" size="1">

 '.$options.'

 </select>

@@ -24,7 +24,7 @@ $title = "Benutzer wechseln";

 output('<h3>Benutzer wechseln</h3>

 <p>Hiermit können Sie (als Admin) das Webinterface mit den Rechten eines beliebigen anderen Benutzers benutzen.</p>

-<p>Benutzer auswählen: ');

+');

 $users = list_system_users();

 $options = '';

@@ -33,12 +33,13 @@ foreach ($users as $user)

   $options .= "  <option value=\"{$user->uid}\">{$user->username} ({$user->uid})</option>\n";

 }

-output(html_form('su_su', 'su.php', '', '<select name="destination" size="1">

+output(html_form('su_su', 'su.php', '', '<p>Benutzer auswählen:

+<select name="destination" size="1">

 '.$options.'

 </select>

 <input type="submit" name="submit" value="zum Benutzer wechseln" />

+</p>

 '));

-output('</p><p>Kunde auswählen: ');

 $customers = list_customers();

 $options = '';

@@ -47,12 +48,13 @@ foreach ($customers as $customer)

   $options .= "  <option value=\"{$customer->id}\">{$customer->id} - {$customer->name}</option>\n";

 }

-output(html_form('su_su', 'su.php', '', '<select name="destination" size="1">

+output(html_form('su_su', 'su.php', '', '<p>Kunde auswählen:

+<select name="destination" size="1">

 '.$options.'

 </select>

 <input type="submit" name="submit" value="zum Kunden wechseln" />

+</p>

 '));

-output("</p><br />");

@@ -38,7 +38,7 @@ output(html_form('su_su', 'su.php', '', '<select name="destination" size="1">

 </select>

 <input type="submit" name="submit" value="zum Benutzer wechseln" />

 '));

-output('<p>Kunde auswählen: ');

+output('</p><p>Kunde auswählen: ');

 $customers = list_customers();

 $options = '';

@@ -52,7 +52,7 @@ output(html_form('su_su', 'su.php', '', '<select name="destination" size="1">

 </select>

 <input type="submit" name="submit" value="zum Kunden wechseln" />

 '));

-output("<br />");

+output("</p><br />");

new file mode 100644

@@ -0,0 +1,59 @@

+<?php

+

+require_once('inc/debug.php');

+

+require_once('session/start.php');

+require_once('su.php');

+

+require_role(ROLE_SYSADMIN);

+

+if (isset($_POST['submit']))

+{

+  check_form_token('su_su');

+  $id = (int) $_POST['destination'];

+  $role = find_role($id, '', True);

+  setup_session($role, $id);

+

+  header('Location: ../../go/index/index.php');

+  die();

+}

+

+

+

+$title = "Benutzer wechseln";

+

+output('<h3>Benutzer wechseln</h3>

+<p>Hiermit können Sie (als Admin) das Webinterface mit den Rechten eines beliebigen anderen Benutzers benutzen.</p>

+<p>Benutzer auswählen: ');

+

+$users = list_system_users();

+$options = '';

+foreach ($users as $user)

+{

+  $options .= "  <option value=\"{$user->uid}\">{$user->username} ({$user->uid})</option>\n";

+}

+

+output(html_form('su_su', 'su.php', '', '<select name="destination" size="1">

+'.$options.'

+</select>

+<input type="submit" name="submit" value="zum Benutzer wechseln" />

+'));

+output('<p>Kunde auswählen: ');

+