1: <?php
 2: 
 3: /**
 4:  * CONTENIDO Chain.
 5:  * Category backend access feature.
 6:  *
 7:  * @package          Core
 8:  * @subpackage       Chain
 9:  * @author           Unknown
10:  * @copyright        four for business AG <www.4fb.de>
11:  * @license          http://www.contenido.org/license/LIZENZ.txt
12:  * @link             http://www.4fb.de
13:  * @link             http://www.contenido.org
14:  */
15: 
16: defined('CON_FRAMEWORK') || die('Illegal call: Missing framework initialization - request aborted.');
17: 
18: /**
19:  *
20:  * @param int $idlang
21:  * @param int $idcat
22:  * @param string $user
23:  * @return boolean
24:  */
25: function cecFrontendCategoryAccess_Backend($idlang, $idcat, $user) {
26:     global $cfg, $perm;
27: 
28:     if ($perm->have_perm()) {
29:         // sysadmin or client admin can always access to protected areas
30:         return true;
31:     }
32: 
33:     $db2 = cRegistry::getDb();
34: 
35:     $arrSearchFor = array("'" . $db2->escape($user) . "'");
36: 
37:     $sql = "SELECT * FROM " . $cfg['tab']['groupmembers'] . " WHERE user_id = '" . $db2->escape($user) . "'";
38: 
39:     $db2->query($sql);
40: 
41:     while ($db2->nextRecord()) {
42:         $arrSearchFor[] = "'" . $db2->escape($db2->f('group_id')) . "'";
43:     }
44: 
45:     $sSearchFor = implode(",", $arrSearchFor);
46: 
47:     $sql = "SELECT idright
48:             FROM ".$cfg["tab"]["rights"]." AS A,
49:                  ".$cfg["tab"]["actions"]." AS B,
50:                  ".$cfg["tab"]["area"]." AS C
51:             WHERE B.name = 'front_allow' AND C.name = 'str' AND A.user_id IN (" . $sSearchFor . ") AND A.idcat = " . cSecurity::toInteger($idcat) . "
52:             AND A.idarea = C.idarea AND B.idaction = A.idaction AND A.idlang = " . cSecurity::toInteger($idlang);
53: 
54:     $db2->query($sql);
55: 
56:     if (!$db2->nextRecord()) {
57:         return false;
58:     } else {
59:         return true;
60:     }
61: }
62: