wwwroot/inc/eventz/executorlist.inc

   1 <?php
   2
   3 function executorlist() {
   4         global $db,$error,$node;
   5         $node_id=$node['node_id'];
   6         if ($node['node_permission']!='owner') {
   7                 $error=$error_messages['EVENT_PERMISSION_ERROR'];
   8                 return false;
   9         }
  10
  11         $executors=explode(";",$_POST['executorlist']); // XXX sqli
  12         $db->query("update node_access set node_permission='' where
  13                 node_id=$node_id and node_permission='exec'");
  14         foreach ($executors as $execitpr) {
  15                  $set=$db->query("select user_id from users where login='$executor'");
  16                  $set->next();
  17                  if ($set->getString('user_id')) {
  18                         $q="update node_access set node_permission='exec' where node_id=$node_id and
  19 user_id='".$set->getString('user_id')."'";
  20                         $changed=$db->update($q);
  21                         if (!$changed) {
  22                                 $q="insert into node_access set
  23 node_permission='exec',node_id=$node_id,user_id=".$set->getString('user_id');
  24                                 $db->query($q);
  25                                 $logger::log('add exec',$node_id,'ok',$executor);
  26
  27                         }
  28                 }
  29                 else { $error .= "$executor does not exist..."; }
  30         }
  31 }
  32 ?>