lkddi/nexusphp
1
0
Fork 0
mirror of https://github.com/lkddi/nexusphp.git synced 2026-04-24 03:57:22 +08:00
Code Issues Packages Projects Releases Wiki Activity

Refactoring user permissions

Browse Source
This commit is contained in:
xiaomlove
2022-08-20 19:11:28 +08:00
parent 3046837576
commit b79762686a
73 changed files with 945 additions and 326 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/fun.php
+3 -5
View File
@@ -19,8 +19,7 @@ if ($action == 'delete')
$arr = mysql_fetch_array($res);
if (!$arr)
stderr($lang_fun['std_error'], $lang_fun['std_invalid_id']);
if (get_user_class() < $funmanage_class)
permissiondenied();
user_can('funmanage', true);
$sure = intval($_GET["sure"] ?? 0);
$returnto = $_GET["returnto"] ? htmlspecialchars($_GET["returnto"]) : htmlspecialchars($_SERVER["HTTP_REFERER"]);
if (!$sure)
@@ -130,7 +129,7 @@ if ($action == 'edit'){
$arr = mysql_fetch_array($res);
if (!$arr)
stderr($lang_fun['std_error'], $lang_fun['std_invalid_id']);
if ($arr["userid"] != $CURUSER["id"] && get_user_class() < $funmanage_class)
if ($arr["userid"] != $CURUSER["id"] && !user_can('funmanage'))
permissiondenied();
if ($_SERVER['REQUEST_METHOD'] == 'POST')
{
@@ -164,8 +163,7 @@ if ($action == 'edit'){
}
if ($action == 'ban')
{
if (get_user_class() < $funmanage_class)
permissiondenied();
user_can('funmanage', true);
$id = intval($_GET["id"] ?? 0);
int_check($id,true);
$res = sql_query("SELECT * FROM fun WHERE id=$id") or sqlerr(__FILE__,__LINE__);