1: <?php
 2: /**
 3:  * CONTENIDO Chain.
 4:  * Category backend access feature.
 5:  *
 6:  * @package          Core
 7:  * @subpackage       Chain
 8:  * @version          SVN Revision $Rev:$
 9:  *
10:  * @author           Unknown
11:  * @copyright        four for business AG <www.4fb.de>
12:  * @license          http://www.contenido.org/license/LIZENZ.txt
13:  * @link             http://www.4fb.de
14:  * @link             http://www.contenido.org
15:  */
16: 
17: defined('CON_FRAMEWORK') || die('Illegal call: Missing framework initialization - request aborted.');
18: 
19: function cecFrontendCategoryAccess_Backend($idlang, $idcat, $user)
20: {
21:     global $cfg, $perm;
22: 
23:     if ($perm->have_perm()) {
24:         // sysadmin or client admin can always access to protected areas
25:         return true;
26:     }
27: 
28:     $db2 = cRegistry::getDb();
29: 
30:     $arrSearchFor = array("'".cSecurity::escapeDB($user, $db2)."'");
31: 
32:     $sql = "SELECT * FROM ".$cfg['tab']['groupmembers']." WHERE user_id = '".cSecurity::escapeDB($user, $db2)."'";
33: 
34:     $db2->query($sql);
35: 
36:     while ($db2->nextRecord()) {
37:         $arrSearchFor[] = "'".cSecurity::escapeDB($db2->f('group_id'), $db2)."'";
38:     }
39: 
40:     $sSearchFor = implode(",", $arrSearchFor);
41: 
42:     $sql = "SELECT idright
43:                     FROM ".$cfg["tab"]["rights"]." AS A,
44:                          ".$cfg["tab"]["actions"]." AS B,
45:                          ".$cfg["tab"]["area"]." AS C
46:                      WHERE B.name = 'front_allow' AND C.name = 'str' AND A.user_id IN (". $sSearchFor .") AND A.idcat = '".cSecurity::toInteger($idcat)."'
47:                             AND A.idarea = C.idarea AND B.idaction = A.idaction AND A.idlang = '".cSecurity::toInteger($idlang)."'";
48: 
49:     $db2->query($sql);
50: 
51:     if (!$db2->nextRecord()) {
52:         return false;
53:     } else {
54:         return true;
55:     }
56: }?>
57: