Updated fixes for checking for admin in get_access_sql_prefix()

git-svn-id: https://code.elgg.org/elgg/trunk@3485 36083f99-b078-4883-b0ff-0f9b5a30f544

diff --git a/engine/lib/access.php b/engine/lib/access.php
index 5ccf238c8d59352e6e537b4f098f22c8ea06f6a4..7edb2d0120eeac3557e9713b17aed79ea628133c 100644 (file)
--- a/engine/lib/access.php
+++ b/engine/lib/access.php
@@ -225,14 +225,21 @@ END;
                        if (!isset($owner)) {
                                $owner = get_loggedin_userid();
                        }
-                       if (!$owner) $owner = -1;
                        
-                       $access = get_access_list($owner);
-
-                       // do NOT use $is_admin global user here, since that only checks against
+                       // do NOT use $is_admin global here, since that only checks against
                        // the current logged in user.
+                       // Can't use metadata here because because of recursion.
+                       // (get_entity, get_*() calls this function.)
+                       if (!$owner) { 
+                               $owner = -1;
+                               $admin = false;
+                       } else {
+                               $admin = is_admin_user($owner);
+                       }
+                       
+                       $access = get_access_list($owner);
                        
-                       if ($owner->admin == 'yes') {
+                       if ($admin) {
                                $sql = " (1 = 1) ";
                        } else if ($owner != -1) {                              
                                $friends_bit = $table_prefix.'access_id = '.ACCESS_FRIENDS.' AND ';
@@ -729,4 +736,4 @@ END;
        // This function will let us know when 'init' has finished
                register_elgg_event_handler('init','system','access_init',9999);
                
-?>
\ No newline at end of file
+?>

diff --git a/engine/lib/sessions.php b/engine/lib/sessions.php
index 18fb9e73cd4d569c9b588053a41387bf61c1f619..b34f07725c659db1d08f5892301cfc503becccdd 100644 (file)
--- a/engine/lib/sessions.php
+++ b/engine/lib/sessions.php
@@ -156,6 +156,41 @@
                        return false;
                }
                
+               /**
+                * Check if the given user is an admin.
+                * 
+                * @param $user_guid
+                * @return bool
+                */
+               function is_admin_user($user_guid) {
+                       global $CONFIG;
+                       
+                       // caching is done at the db level so no need to here.
+                       $query = "SELECT * FROM {$CONFIG->dbprefix}users_entity as e, {$CONFIG->dbprefix}metastrings as ms1, {$CONFIG->dbprefix}metastrings as ms2, {$CONFIG->dbprefix}metadata as md
+                               WHERE (
+                                       ms1.string = 'admin' AND ms2.string = 'yes'
+                                       AND md.name_id = ms1.id AND md.value_id = ms2.id
+                                       AND e.guid = md.entity_guid
+                                       AND e.guid = {$user_guid}
+                                       AND e.banned = 'no'
+                                       )
+                               OR (
+                                       ms1.string = 'admin' AND ms2.string = '1'
+                                       AND md.name_id = ms1.id AND md.value_id = ms2.id
+                                       AND e.guid = md.entity_guid
+                                       AND e.guid = {$user_guid}
+                                       AND e.banned = 'no'
+                                       )";
+
+                       // normalizing the results from get_data()
+                       // See #1242
+                       $info = get_data($query);
+                       if (!((is_array($info) && count($info) < 1) || $info === false)) {
+                               return true;
+                       }
+                       return false;
+               }
+               
        /**
         * Perform standard authentication with a given username and password.
         * Returns an ElggUser object for use with login.