diff --git a/inc/display.php b/inc/display.php index 91577af0..3a9fc577 100644 --- a/inc/display.php +++ b/inc/display.php @@ -241,29 +241,29 @@ $built = ''; if($this->mod) { // Mod controls (on posts) - $built .= ''; // Delete - if($this->mod['type'] >= $config['mod']['delete']) + if(hasPermission($config['mod']['delete'], $board['uri'], $this->mod)) $built .= ' ' . confirmLink($config['mod']['link_delete'], 'Delete', 'Are you sure you want to delete this?', $board['uri'] . '/delete/' . $this->id); // Delete all posts by IP - if($this->mod['type'] >= $config['mod']['deletebyip']) + if(hasPermission($config['mod']['deletebyip'], $board['uri'], $this->mod)) $built .= ' ' . confirmLink($config['mod']['link_deletebyip'], 'Delete all posts by IP', 'Are you sure you want to delete all posts by IP?', $board['uri'] . '/deletebyip/' . $this->id); // Ban - if($this->mod['type'] >= $config['mod']['ban']) + if(hasPermission($config['mod']['ban'], $board['uri'], $this->mod)) $built .= ' ' . $config['mod']['link_ban'] . ''; // Ban & Delete - if($this->mod['type'] >= $config['mod']['bandelete']) + if(hasPermission($config['mod']['bandelete'], $board['uri'], $this->mod)) $built .= ' ' . $config['mod']['link_bandelete'] . ''; // Delete file (keep post) - if(!empty($this->file) && $this->mod['type'] >= $config['mod']['deletefile']) + if(!empty($this->file) && hasPermission($config['mod']['deletefile'], $board['uri'], $this->mod)) $built .= ' ' . $config['mod']['link_deletefile'] . ''; - $built .= ''; + if(!empty($built)) + $built = '' . $built . ''; } return $built; } @@ -309,7 +309,7 @@ . (!empty($this->capcode) ? capcode($this->capcode) : ''); // IP Address - if($this->mod && $this->mod['type'] >= $config['mod']['show_ip']) { + if($this->mod && hasPermission($config['mod']['show_ip'], $board['uri'], $this->mod)) { $built .= ' [' . $this->ip . ']'; } @@ -436,43 +436,42 @@ $built = ''; if($this->mod) { // Mod controls (on posts) - $built .= ''; - // Delete - if($this->mod['type'] >= $config['mod']['delete']) + if(hasPermission($config['mod']['delete'], $board['uri'], $this->mod)) $built .= ' ' . confirmLink($config['mod']['link_delete'], 'Delete', 'Are you sure you want to delete this?', $board['uri'] . '/delete/' . $this->id); // Delete all posts by IP - if($this->mod['type'] >= $config['mod']['deletebyip']) + if(hasPermission($config['mod']['deletebyip'], $board['uri'], $this->mod)) $built .= ' ' . confirmLink($config['mod']['link_deletebyip'], 'Delete all posts by IP', 'Are you sure you want to delete all posts by IP?', $board['uri'] . '/deletebyip/' . $this->id); // Ban - if($this->mod['type'] >= $config['mod']['ban']) + if(hasPermission($config['mod']['ban'], $board['uri'], $this->mod)) $built .= ' ' . $config['mod']['link_ban'] . ''; // Ban & Delete - if($this->mod['type'] >= $config['mod']['bandelete']) + if(hasPermission($config['mod']['bandelete'], $board['uri'], $this->mod)) $built .= ' ' . $config['mod']['link_bandelete'] . ''; // Delete file (keep post) - if(!empty($this->file) && $this->file != 'deleted' && $this->mod['type'] >= $config['mod']['deletefile']) + if(!empty($this->file) && $this->file != 'deleted' && hasPermission($config['mod']['deletefile'], $board['uri'], $this->mod)) $built .= ' ' . $config['mod']['link_deletefile'] . ''; // Sticky - if($this->mod['type'] >= $config['mod']['sticky']) + if(hasPermission($config['mod']['sticky'], $board['uri'], $this->mod)) if($this->sticky) $built .= ' ' . $config['mod']['link_desticky'] . ''; else $built .= ' ' . $config['mod']['link_sticky'] . ''; // Lock - if($this->mod['type'] >= $config['mod']['lock']) + if(hasPermission($config['mod']['lock'], $board['uri'], $this->mod)) if($this->locked) $built .= ' ' . $config['mod']['link_unlock'] . ''; else $built .= ' ' . $config['mod']['link_lock'] . ''; - $built .= ''; + if(!empty($built)) + $built = '' . $built . ''; } return $built; } @@ -534,7 +533,8 @@ . (!empty($this->capcode) ? capcode($this->capcode) : ''); // IP Address - if($this->mod && $this->mod['type'] >= $config['mod']['show_ip']) { + + if($this->mod && hasPermission($config['mod']['show_ip'], $board['uri'], $this->mod)) { $built .= ' [' . $this->ip . ']'; } diff --git a/inc/mod.php b/inc/mod.php index 78351ba7..0acb3864 100644 --- a/inc/mod.php +++ b/inc/mod.php @@ -14,6 +14,21 @@ return substr(base64_encode(sha1(rand() . time(), true)), 0, $length); } + function hasPermission($action = null, $board = null, $_mod = null) { + if(isset($_mod)) + $mod = &$_mod; + else + global $mod; + + if(isset($action) && $mod['type'] < $action) + return false; + + if(isset($board) && !in_array($board, $mod['boards'])) + return false; + + return true; + } + function login($username, $password, $makehash=true) { global $mod; @@ -22,7 +37,7 @@ $password = sha1($password); } - $query = prepare("SELECT `id`,`type` FROM `mods` WHERE `username` = :username AND `password` = :password LIMIT 1"); + $query = prepare("SELECT `id`,`type`,`boards` FROM `mods` WHERE `username` = :username AND `password` = :password LIMIT 1"); $query->bindValue(':username', $username); $query->bindValue(':password', $password); $query->execute() or error(db_error($query)); @@ -33,7 +48,8 @@ 'type' => $user['type'], 'username' => $username, 'password' => $password, - 'hash' => isset($_SESSION['mod']['hash']) ? $_SESSION['mod']['hash'] : mkhash() + 'hash' => isset($_SESSION['mod']['hash']) ? $_SESSION['mod']['hash'] : mkhash(), + 'boards' => explode(',', $user['boards']) ); } else return false; } @@ -230,4 +246,4 @@ ''; } -?> \ No newline at end of file +?> diff --git a/install.php b/install.php index a9e6b2e6..d9aafd2f 100644 --- a/install.php +++ b/install.php @@ -1,6 +1,6 @@ bindValue(':id', $match[1], PDO::PARAM_INT); @@ -484,7 +484,7 @@ header('Location: ?/noticeboard', true, $config['redirect_http']); } elseif(preg_match('/^\/noticeboard$/', $query)) { - if($mod['type'] < $config['mod']['noticeboard']) error($config['error']['noaccess']); + if(!hasPermission($config['mod']['noticeboard'])) error($config['error']['noaccess']); $body = ''; @@ -553,7 +553,7 @@ ) ); } elseif(preg_match('/^\/news\/delete\/(\d+)$/', $query, $match)) { - if($mod['type'] < $config['mod']['noticeboard_delete']) error($config['error']['noaccess']); + if(!hasPermission($config['mod']['noticeboard_delete'])) error($config['error']['noaccess']); $query = prepare("DELETE FROM `news` WHERE `id` = :id"); $query->bindValue(':id', $match[1], PDO::PARAM_INT); @@ -744,7 +744,7 @@ ); } } elseif(preg_match('/^\/new_PM\/(\d+)(\/(\d+))?$/', $query, $match)) { - if($mod['type'] < $config['mod']['create_pm']) error($config['error']['noaccess']); + if(!hasPermission($config['mod']['create_pm'])) error($config['error']['noaccess']); $to = &$match[1]; @@ -826,7 +826,7 @@ ); } } elseif(preg_match('/^\/search$/', $query)) { - if($mod['type'] < $config['mod']['search']) error($config['error']['noaccess']); + if(!hasPermission($config['mod']['search'])) error($config['error']['noaccess']); $body = '