Overigen/monpas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

berichten: admincontrole werkte niet

Browse Source 
'if(!$admin = 1 || !$admin = 2)' is een toewijzing en blokkeerde nooit,
waardoor elke ingelogde gebruiker berichten kon beheren. checkadmin()
geeft nu TRUE alleen bij niveau 1 of 2 (zoals checkrechten) en is, net
als deletebericht(), niet meer als url aan te roepen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Monique
2026-10-22 13:05:20 +02:00
co-authored by Claude Opus 5.5
parent 2d44e273e6
commit c224ae853a
1 changed files with 12 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/controllers/monpas/Berichten.php
+12 -31
View File
@@ -41,11 +41,13 @@ class Berichten extends MY_Controller {
}
function checkadmin(){
// beheerder = ingelogd met autorisatieniveau 1 of 2 (zelfde regel als checkrechten)
private function checkadmin(){
if ( ! $this->userid ) return FALSE;
$orguserid = $this->Orgusers_model->get_fieldvalue( array("user_id" => $this->userid, "organisatie_id" => $this->globorgid), "id" );
$niveau = $this->Autorisaties_model->get_fieldvalue( array("orguser_id" => $orguserid), "nivo_id" );
return $niveau;
return ( $niveau == 1 || $niveau == 2 );
}
@@ -101,10 +103,7 @@ class Berichten extends MY_Controller {
function getAdminBerichten()
{
if ( ! $this->userid ) die;
$admin = $this->checkadmin();
if(!$admin = 1 || !$admin = 2){
return;
}
if ( ! $this->checkadmin() ) return;
$berichten = $this->Berichten_model->getalleberichten();
if ( ! $berichten )
@@ -132,10 +131,7 @@ class Berichten extends MY_Controller {
function getmodules()
{
if ( ! $this->userid ) die;
$admin = $this->checkadmin();
if(!$admin = 1 || !$admin = 2){
return;
}
if ( ! $this->checkadmin() ) return;
$berichtid = $this->uri->segment( 4 );
$clusters = $this->Modules_model->getclusters();//haal alle cluster op
@@ -234,10 +230,7 @@ class Berichten extends MY_Controller {
public function saveBericht()
{
$admin = $this->checkadmin();
if(!$admin = 1 || !$admin = 2){
return;
}
if ( ! $this->checkadmin() ) return;
$berichtID = $this->uri->segment( 4 );
$datum = str_replace( '/', '-', $this->input->post( 'datum' ) ?? '');
$samenvatting = $this->input->post( 'samenvatting' ) ?? '';
@@ -267,19 +260,13 @@ class Berichten extends MY_Controller {
public function create_empty_bericht()
{
$admin = $this->checkadmin();
if(!$admin = 1 || !$admin = 2){
return;
}
if ( ! $this->checkadmin() ) return;
$this->Berichten_model->insert_record( ['startdatum' => date( 'Y-m-d H:i:s' )] );
}
function koppelmodule()
{
$admin = $this->checkadmin();
if(!$admin = 1 || !$admin = 2){
return;
}
if ( ! $this->checkadmin() ) return;
$vinkje = $this->clean_input( "modulevinkje" );
$berichtid = $this->clean_input( "berichtid" );
$modulenr = $this->clean_input( "moduleid" );
@@ -303,10 +290,7 @@ class Berichten extends MY_Controller {
function koppelcluster()
{
$admin = $this->checkadmin();
if(!$admin = 1 || !$admin = 2){
return;
}
if ( ! $this->checkadmin() ) return;
$vinkje = $this->clean_input( "clustervinkje" );
$berichtid = $this->clean_input( "berichtid" );
$clusterid = $this->clean_input( "clusterid" );
@@ -338,10 +322,7 @@ class Berichten extends MY_Controller {
function berichtomwegtegooien($berichtid){
if ( ! $this->userid ) die;
$admin = $this->checkadmin();
if(!$admin = 1 || !$admin = 2){
return;
}
if ( ! $this->checkadmin() ) return;
$berichtid = $this->uri->segment( 4 );
if ( $berichtid )
{
@@ -356,7 +337,7 @@ class Berichten extends MY_Controller {
}
function deletebericht($berichtid)
private function deletebericht($berichtid)
{if ( ! $this->userid ) die;
$this->Berichten_model->delete_record( $berichtid );
$this->Modulebericht_model->delete_record_where( array('bericht_id' => $berichtid) );