Overigen/monpas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

berichten: admincontrole werkte niet

Browse Source 
'if(!$admin = 1 || !$admin = 2)' is een toewijzing en blokkeerde nooit,
waardoor elke ingelogde gebruiker berichten kon beheren. checkadmin()
geeft nu TRUE alleen bij niveau 1 of 2 (zoals checkrechten) en is, net
als deletebericht(), niet meer als url aan te roepen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Monique
2026-10-22 13:05:20 +02:00
co-authored by Claude Opus 5.5
parent 2d44e273e6
commit c224ae853a
1 changed files with 12 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/controllers/monpas/Berichten.php
+12 -31
View File
@@ -41,11 +41,13 @@ class Berichten extends MY_Controller {
} }
function checkadmin(){ // beheerder = ingelogd met autorisatieniveau 1 of 2 (zelfde regel als checkrechten)
private function checkadmin(){
if ( ! $this->userid ) return FALSE;
$orguserid = $this->Orgusers_model->get_fieldvalue( array("user_id" => $this->userid, "organisatie_id" => $this->globorgid), "id" ); $orguserid = $this->Orgusers_model->get_fieldvalue( array("user_id" => $this->userid, "organisatie_id" => $this->globorgid), "id" );
$niveau = $this->Autorisaties_model->get_fieldvalue( array("orguser_id" => $orguserid), "nivo_id" ); $niveau = $this->Autorisaties_model->get_fieldvalue( array("orguser_id" => $orguserid), "nivo_id" );
return $niveau; return ( $niveau == 1 || $niveau == 2 );
} }
@@ -101,10 +103,7 @@ class Berichten extends MY_Controller {
function getAdminBerichten() function getAdminBerichten()
{ {
if ( ! $this->userid ) die; if ( ! $this->userid ) die;
$admin = $this->checkadmin(); if ( ! $this->checkadmin() ) return;
if(!$admin = 1 || !$admin = 2){
return;
}
$berichten = $this->Berichten_model->getalleberichten(); $berichten = $this->Berichten_model->getalleberichten();
if ( ! $berichten ) if ( ! $berichten )
@@ -132,10 +131,7 @@ class Berichten extends MY_Controller {
function getmodules() function getmodules()
{ {
if ( ! $this->userid ) die; if ( ! $this->userid ) die;
$admin = $this->checkadmin(); if ( ! $this->checkadmin() ) return;
if(!$admin = 1 || !$admin = 2){
return;
}
$berichtid = $this->uri->segment( 4 ); $berichtid = $this->uri->segment( 4 );
$clusters = $this->Modules_model->getclusters();//haal alle cluster op $clusters = $this->Modules_model->getclusters();//haal alle cluster op
@@ -234,10 +230,7 @@ class Berichten extends MY_Controller {
public function saveBericht() public function saveBericht()
{ {
$admin = $this->checkadmin(); if ( ! $this->checkadmin() ) return;
if(!$admin = 1 || !$admin = 2){
return;
}
$berichtID = $this->uri->segment( 4 ); $berichtID = $this->uri->segment( 4 );
$datum = str_replace( '/', '-', $this->input->post( 'datum' ) ?? ''); $datum = str_replace( '/', '-', $this->input->post( 'datum' ) ?? '');
$samenvatting = $this->input->post( 'samenvatting' ) ?? ''; $samenvatting = $this->input->post( 'samenvatting' ) ?? '';
@@ -267,19 +260,13 @@ class Berichten extends MY_Controller {
public function create_empty_bericht() public function create_empty_bericht()
{ {
$admin = $this->checkadmin(); if ( ! $this->checkadmin() ) return;
if(!$admin = 1 || !$admin = 2){
return;
}
$this->Berichten_model->insert_record( ['startdatum' => date( 'Y-m-d H:i:s' )] ); $this->Berichten_model->insert_record( ['startdatum' => date( 'Y-m-d H:i:s' )] );
} }
function koppelmodule() function koppelmodule()
{ {
$admin = $this->checkadmin(); if ( ! $this->checkadmin() ) return;
if(!$admin = 1 || !$admin = 2){
return;
}
$vinkje = $this->clean_input( "modulevinkje" ); $vinkje = $this->clean_input( "modulevinkje" );
$berichtid = $this->clean_input( "berichtid" ); $berichtid = $this->clean_input( "berichtid" );
$modulenr = $this->clean_input( "moduleid" ); $modulenr = $this->clean_input( "moduleid" );
@@ -303,10 +290,7 @@ class Berichten extends MY_Controller {
function koppelcluster() function koppelcluster()
{ {
$admin = $this->checkadmin(); if ( ! $this->checkadmin() ) return;
if(!$admin = 1 || !$admin = 2){
return;
}
$vinkje = $this->clean_input( "clustervinkje" ); $vinkje = $this->clean_input( "clustervinkje" );
$berichtid = $this->clean_input( "berichtid" ); $berichtid = $this->clean_input( "berichtid" );
$clusterid = $this->clean_input( "clusterid" ); $clusterid = $this->clean_input( "clusterid" );
@@ -338,10 +322,7 @@ class Berichten extends MY_Controller {
function berichtomwegtegooien($berichtid){ function berichtomwegtegooien($berichtid){
if ( ! $this->userid ) die; if ( ! $this->userid ) die;
$admin = $this->checkadmin(); if ( ! $this->checkadmin() ) return;
if(!$admin = 1 || !$admin = 2){
return;
}
$berichtid = $this->uri->segment( 4 ); $berichtid = $this->uri->segment( 4 );
if ( $berichtid ) if ( $berichtid )
{ {
@@ -356,7 +337,7 @@ class Berichten extends MY_Controller {
} }
function deletebericht($berichtid) private function deletebericht($berichtid)
{if ( ! $this->userid ) die; {if ( ! $this->userid ) die;
$this->Berichten_model->delete_record( $berichtid ); $this->Berichten_model->delete_record( $berichtid );
$this->Modulebericht_model->delete_record_where( array('bericht_id' => $berichtid) ); $this->Modulebericht_model->delete_record_where( array('bericht_id' => $berichtid) );