diff options
author | Michael Tänzer <neo@nhng.de> | 2014-04-11 22:04:12 +0200 |
---|---|---|
committer | Michael Tänzer <neo@nhng.de> | 2014-04-11 22:04:12 +0200 |
commit | 0a6a55e932fc2a4cb89f75f8c41e71770b60d1a4 (patch) | |
tree | 275c0c69ac0735da631aaad41d0a1d8811575a73 | |
parent | 374a109bd7db6c71fdfff3e396d0a42c1c298d98 (diff) | |
download | cacert-devel-0a6a55e932fc2a4cb89f75f8c41e71770b60d1a4.tar.gz cacert-devel-0a6a55e932fc2a4cb89f75f8c41e71770b60d1a4.tar.xz cacert-devel-0a6a55e932fc2a4cb89f75f8c41e71770b60d1a4.zip |
bug 1138: Make testing for support access to account details page more
robust and possibly fix some issues
- should check for same userid not whether we come from the SE page
- always use the already validated values (not $_REQUEST)
- make if clause logic more readable
Signed-off-by: Michael Tänzer <neo@nhng.de>
-rw-r--r-- | pages/account/59.php | 35 |
1 files changed, 25 insertions, 10 deletions
diff --git a/pages/account/59.php b/pages/account/59.php index ebcc5fc..b4ec324 100644 --- a/pages/account/59.php +++ b/pages/account/59.php @@ -40,25 +40,40 @@ $dob = $row['dob']; $username = $fname." ".$mname." ".$lname." ".$suffix; $email = $row['email']; $alerts =get_alerts($userid); + $support=0; -if(intval($_REQUEST['oldid'])==43){ +if(array_key_exists('admin', $_SESSION['profile'])){ $support=$_SESSION['profile']['admin']; } -$ticketno = ""; if(array_key_exists('ticketno', $_SESSION)) $ticketno = $_SESSION['ticketno']; -if (!valid_ticket_number($ticketno) && $support == 1) { - printf(_("I'm sorry, you did not enter a ticket number! %s Support is not allowed to view the account history without a ticket number."), '<br/>'); - echo '<br/><a href="account.php?id=43&userid=' . intval($_REQUEST['userid']) .'">'. _('Back to previous page.').'</a>'; - showfooter(); - exit; + +$ticketno = ""; +if(array_key_exists('ticketno', $_SESSION)) { + $ticketno = $_SESSION['ticketno']; } -if ( $support == 1) { - if (!write_se_log($userid, $_SESSION['profile']['id'], 'SE View account history', $_REQUEST['ticketno'])) { + +// Support Engineer access restrictions +if ($userid != $_SESSION['profile']['id']) { + if ($support == 0) { + echo _("You do not have access to this page."); + showfooter(); + exit; + } + + if (!valid_ticket_number($ticketno)) { + printf(_("I'm sorry, you did not enter a ticket number! %s Support is not allowed to view the account history without a ticket number."), '<br/>'); + echo '<br/><a href="account.php?id=43&userid='.$userid.'">'. _('Back to previous page.') .'</a>'; + showfooter(); + exit; + } + + if (!write_se_log($userid, $_SESSION['profile']['id'], 'SE View account history', $ticketno)) { echo _("Writing to the admin log failed. Can't continue."); - printf('<br/><a href="account.php?id=43&userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>'); + echo '<br/><a href="account.php?id=43&userid='.$userid.'">'. _('Back to previous page.') .'</a>'; showfooter(); exit; } } + ?> <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> <tr> |