1: <?php
 2: 
 3: /**
 4:  * CONTENIDO Chain.
 5:  * Category backend access feature.
 6:  *
 7:  * @package          Core
 8:  * @subpackage       Chain
 9:  * @author           Unknown
10:  * @copyright        four for business AG <www.4fb.de>
11:  * @license          http://www.contenido.org/license/LIZENZ.txt
12:  * @link             http://www.4fb.de
13:  * @link             http://www.contenido.org
14:  */
15: 
16: defined('CON_FRAMEWORK') || die('Illegal call: Missing framework initialization - request aborted.');
17: 
18: /**
19:  *
20:  * @param int    $idlang
21:  * @param int    $idcat
22:  * @param string $user
23:  *
24:  * @return bool
25:  *
26:  * @throws cDbException
27:  */
28: function cecFrontendCategoryAccess_Backend($idlang, $idcat, $user) {
29:     global $cfg, $perm;
30: 
31:     if ($perm->have_perm()) {
32:         // sysadmin or client admin can always access to protected areas
33:         return true;
34:     }
35: 
36:     $db2 = cRegistry::getDb();
37: 
38:     $arrSearchFor = array("'" . $db2->escape($user) . "'");
39: 
40:     $sql = "SELECT * FROM " . $cfg['tab']['groupmembers'] . " WHERE user_id = '" . $db2->escape($user) . "'";
41: 
42:     $db2->query($sql);
43: 
44:     while ($db2->nextRecord()) {
45:         $arrSearchFor[] = "'" . $db2->escape($db2->f('group_id')) . "'";
46:     }
47: 
48:     $sSearchFor = implode(",", $arrSearchFor);
49: 
50:     $sql = "SELECT idright
51:             FROM ".$cfg["tab"]["rights"]." AS A,
52:                  ".$cfg["tab"]["actions"]." AS B,
53:                  ".$cfg["tab"]["area"]." AS C
54:             WHERE B.name = 'front_allow' AND C.name = 'str' AND A.user_id IN (" . $sSearchFor . ") AND A.idcat = " . cSecurity::toInteger($idcat) . "
55:             AND A.idarea = C.idarea AND B.idaction = A.idaction AND A.idlang = " . cSecurity::toInteger($idlang);
56: 
57:     $db2->query($sql);
58: 
59:     if (!$db2->nextRecord()) {
60:         return false;
61:     } else {
62:         return true;
63:     }
64: }
65: