From c224ae853ad245396c21fa577ef94eec8234395f Mon Sep 17 00:00:00 2001
From: Monique Hansma <m.hansma@pensare.nl>
Date: Thu, 22 Oct 2026 13:05:20 +0200
Subject: [PATCH] berichten: admincontrole werkte niet

'if(!$admin = 1 || !$admin = 2)' is een toewijzing en blokkeerde nooit,
waardoor elke ingelogde gebruiker berichten kon beheren. checkadmin()
geeft nu TRUE alleen bij niveau 1 of 2 (zoals checkrechten) en is, net
als deletebericht(), niet meer als url aan te roepen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 application/controllers/monpas/Berichten.php | 43 ++++++--------------
 1 file changed, 12 insertions(+), 31 deletions(-)

diff --git a/application/controllers/monpas/Berichten.php b/application/controllers/monpas/Berichten.php
index 1d77a6e..8a0b6d7 100644
--- a/application/controllers/monpas/Berichten.php
+++ b/application/controllers/monpas/Berichten.php
@@ -41,11 +41,13 @@ class  Berichten extends MY_Controller {
     }
 
 
-    function checkadmin(){
+    // beheerder = ingelogd met autorisatieniveau 1 of 2 (zelfde regel als checkrechten)
+    private function checkadmin(){
+        if ( ! $this->userid ) return FALSE;
         $orguserid = $this->Orgusers_model->get_fieldvalue( array("user_id" => $this->userid, "organisatie_id" => $this->globorgid), "id" );
         $niveau = $this->Autorisaties_model->get_fieldvalue( array("orguser_id" => $orguserid), "nivo_id" );
 
-        return $niveau;
+        return ( $niveau == 1 || $niveau == 2 );
     }
 
 
@@ -101,10 +103,7 @@ class  Berichten extends MY_Controller {
     function getAdminBerichten()
     {
         if ( ! $this->userid ) die;
-        $admin = $this->checkadmin();
-        if(!$admin = 1 || !$admin = 2){
-            return;
-        }
+        if ( ! $this->checkadmin() ) return;
 
         $berichten = $this->Berichten_model->getalleberichten();
         if ( ! $berichten )
@@ -132,10 +131,7 @@ class  Berichten extends MY_Controller {
     function getmodules()
     {
         if ( ! $this->userid ) die;
-        $admin = $this->checkadmin();
-        if(!$admin = 1 || !$admin = 2){
-            return;
-        }
+        if ( ! $this->checkadmin() ) return;
         $berichtid = $this->uri->segment( 4 );
         $clusters = $this->Modules_model->getclusters();//haal alle cluster op
 
@@ -234,10 +230,7 @@ class  Berichten extends MY_Controller {
 
     public function saveBericht()
     {
-        $admin = $this->checkadmin();
-        if(!$admin = 1 || !$admin = 2){
-            return;
-        }
+        if ( ! $this->checkadmin() ) return;
         $berichtID = $this->uri->segment( 4 );
         $datum = str_replace( '/', '-', $this->input->post( 'datum' ) ?? '');
         $samenvatting = $this->input->post( 'samenvatting' ) ?? '';
@@ -267,19 +260,13 @@ class  Berichten extends MY_Controller {
 
     public function create_empty_bericht()
     {
-        $admin = $this->checkadmin();
-        if(!$admin = 1 || !$admin = 2){
-            return;
-        }
+        if ( ! $this->checkadmin() ) return;
         $this->Berichten_model->insert_record( ['startdatum' => date( 'Y-m-d H:i:s' )] );
     }
 
     function koppelmodule()
     {
-        $admin = $this->checkadmin();
-        if(!$admin = 1 || !$admin = 2){
-            return;
-        }
+        if ( ! $this->checkadmin() ) return;
         $vinkje = $this->clean_input( "modulevinkje" );
         $berichtid = $this->clean_input( "berichtid" );
         $modulenr = $this->clean_input( "moduleid" );
@@ -303,10 +290,7 @@ class  Berichten extends MY_Controller {
 
     function koppelcluster()
     {
-        $admin = $this->checkadmin();
-        if(!$admin = 1 || !$admin = 2){
-            return;
-        }
+        if ( ! $this->checkadmin() ) return;
         $vinkje = $this->clean_input( "clustervinkje" );
         $berichtid = $this->clean_input( "berichtid" );
         $clusterid = $this->clean_input( "clusterid" );
@@ -338,10 +322,7 @@ class  Berichten extends MY_Controller {
 
     function berichtomwegtegooien($berichtid){
         if ( ! $this->userid ) die;
-        $admin = $this->checkadmin();
-        if(!$admin = 1 || !$admin = 2){
-            return;
-        }
+        if ( ! $this->checkadmin() ) return;
         $berichtid = $this->uri->segment( 4 );
         if ( $berichtid )
         {
@@ -356,7 +337,7 @@ class  Berichten extends MY_Controller {
     }
 
 
-    function deletebericht($berichtid)
+    private function deletebericht($berichtid)
     {if ( ! $this->userid ) die;
     $this->Berichten_model->delete_record( $berichtid );
     $this->Modulebericht_model->delete_record_where( array('bericht_id' => $berichtid) );