$this->Conn->Query('UPDATE '.$table.' SET Filename = '.$this->Conn->qstr($this->GetDBField('Filename')).' WHERE ItemResourceId = '.$this->GetDBField('ResourceId'));
* Check current user permissions based on it's group permissions in specified category (for non-system permissions) or just checks if system permission is set
*
* @param string $name permission name
* @param int $cat_id category id, current used if not specified
* @param int $type permission type {1 - system, 0 - per category}
* @return int
*/
function CheckPermission($name, $type = 1, $cat_id = null)
{
if ($this->Application->GetVar('u_id') == -1) {
// "root" is allowed anywhere
return $name == 'SYSTEM_ACCESS.READONLY' ? 0 : 1;
}
-
+
if ($type == 1) {
// "system" permission are always checked per "Home" category (ID = 0)
- - Administrative Console Section Permissions - allows controlling view, add, edit and delete permissions individually for every section of the Administrative Console, as weel as section-specific advanced permissions, such as approve, decline, etc.
+ - Administrative Console Section Permissions - allows controlling view, add, edit and delete permissions individually for every section of the Administrative Console, as well as section-specific advanced permissions, such as approve, decline, etc.
- Navigation tree dynamic categories loading - the categories of the catalog are now accessible directly via the navigation tree
- Custom e-mail footer implemented, allowing to add a common footer to every e-mail sent out by the system
- Overall performance improvement due to several levels of caching
IMPORTANT NOTE:
-During the implementation of Administrative Console Section permissions a number of issues have been identified with potential ability for the attacker to gain access to some of In-portal stored data. The issues have been resolved with the implementation of new permissions system. Customers are strongly encouraged to upgrade to the latest version of In-portal platform and corresponding module versions to ensure the reliability and security of their websites!
+A number of security issues have been identified in the previous versions, giving an attacker a potential ability to gain access to some of the In-portal data. The issues have been resolved with the implementation of the new permission system. All customers are strongly encouraged to upgrade to the latest version of In-portal platform and corresponding module versions!
Property changes on: trunk/admin/install/upgrades/readme_1_2_0.txt
$this->Conn->Query('UPDATE '.$table.' SET Filename = '.$this->Conn->qstr($this->GetDBField('Filename')).' WHERE ItemResourceId = '.$this->GetDBField('ResourceId'));
* Check current user permissions based on it's group permissions in specified category (for non-system permissions) or just checks if system permission is set
*
* @param string $name permission name
* @param int $cat_id category id, current used if not specified
* @param int $type permission type {1 - system, 0 - per category}
* @return int
*/
function CheckPermission($name, $type = 1, $cat_id = null)
{
if ($this->Application->GetVar('u_id') == -1) {
// "root" is allowed anywhere
return $name == 'SYSTEM_ACCESS.READONLY' ? 0 : 1;
}
-
+
if ($type == 1) {
// "system" permission are always checked per "Home" category (ID = 0)
function TableCount($TableName, $where="",$JoinCats=1)
{
$db = &GetADODBConnection();
if(!$JoinCats)
{
$sql = "SELECT count(*) as TableCount FROM $TableName";
}
else
$sql = "SELECT count(*) as TableCount FROM $TableName INNER JOIN ".GetTablePrefix()."CategoryItems ON ".GetTablePrefix()."CategoryItems.ItemResourceId=$TableName.ResourceId";
if(strlen($where)>0)
$sql .= " WHERE ".$where;
$rs = $db->Execute($sql);
// echo "SQL TABLE COUNT: ".$sql."<br>\n";
$res = $rs->fields["TableCount"];
return $res;
}
Function QueryCount($sql)
{
$sql = preg_replace('/SELECT(.*)FROM[ \n\r](.*)/is','SELECT COUNT(*) AS TableCount FROM $2', $sql);