Changeset 210 for branches

Timestamp:

10/03/2009 02:40:13 PM (3 years ago)

Author:

Acinonyx

Message:

[awmn] Fix delete access bypassing

File:

• branches/awmn/includes/pages/mynodes/mynodes.php (modified) (9 diffs)

branches/awmn/includes/pages/mynodes/mynodes.php

@@ -431 +431 @@
                 $ret = $ret && $db->set("ip_ranges", array('delete_req' => 'N'), "node_id = ".intval(get('node')));
                 foreach( (array) $_POST['id'] as $key => $value) {
-                        $ret = $ret && $db->set("ip_ranges", array('delete_req' => 'Y'), "id = '".$value."'");
+                        $ret = $ret && $db->set("ip_ranges", array('delete_req' => 'Y'), "id = '".$value."' AND node_id =  ".intval(get('node')));
                 }
                 if ($ret) {
@@ -445 +445 @@
                 $ret = $ret && $db->set("dns_zones", array('delete_req' => 'N'), "node_id = ".intval(get('node')));
                 foreach( (array) $_POST['id'] as $key => $value) {
-                        $ret = $ret && $db->set("dns_zones", array('delete_req' => 'Y'), "id = '".$value."'");
+                        $ret = $ret && $db->set("dns_zones", array('delete_req' => 'Y'), "id = '".$value."' AND node_id =  ".intval(get('node')));
                 }
                 if ($ret) {
@@ -459 +459 @@
                 $ret = $ret && $db->set("dns_nameservers, ip_ranges, nodes", array('dns_nameservers.delete_req' => 'N'), "dns_nameservers.ip >= ip_ranges.ip_start AND dns_nameservers.ip <= ip_ranges.ip_end AND ip_ranges.node_id = ".intval(get('node'))." AND ip_ranges.node_id = nodes.id");
                 foreach( (array) $_POST['id'] as $key => $value) {
-                        $ret = $ret && $db->set("dns_nameservers", array('delete_req' => 'Y'), "id = '".$value."'");
+                        $ret = $ret && $db->set("dns_nameservers", array('delete_req' => 'Y'), "id = '".$value."' AND node_id =  ".intval(get('node')));
                 }
                 if ($ret) {
@@ -472 +472 @@
                 $ret = TRUE;
                 foreach( (array) $_POST['id'] as $key => $value) {
-                        $ret = $ret && $db->del("links", '', "id = '".$value."'");
+                        $ret = $ret && $db->del("links", '', "id = '".$value."' AND node_id = ".intval(get('node')));
                 }
                 if ($ret) {
@@ -485 +485 @@
                 $ret = TRUE;
                 foreach( (array) $_POST['id'] as $key => $value) {
-                        $ret = $ret && $db->del("links", '', "id = '".$value."'");
+                        $ret = $ret && $db->del("links", '', "id = '".$value."' AND node_id = ".intval(get('node')));
                 }
                 if ($ret) {
@@ -498 +498 @@
                 $ret = TRUE;
                 foreach( (array) $_POST['id'] as $key => $value) {
-                        $ret = $ret && $db->del("subnets", '', "id = '".$value."'");
+                        $ret = $ret && $db->del("subnets", '', "id = '".$value."' AND node_id = ".intval(get('node')));
                 }
                 if ($ret) {
@@ -511 +511 @@
                 $ret = TRUE;
                 foreach( (array) $_POST['id'] as $key => $value) {
-                        $ret = $ret && $db->del("ip_addresses", '', "id = '".$value."'");
+                        $ret = $ret && $db->del("ip_addresses", '', "id = '".$value."' AND node_id = ".intval(get('node')));
                 }
                 if ($ret) {
@@ -524 +524 @@
                 $ret = TRUE;
                 foreach( (array) $_POST['id'] as $key => $value) {
-                        $ret = $ret && $db->del("nodes_services", '', "id = '".$value."'");
+                        $ret = $ret && $db->del("nodes_services", '', "id = '".$value."' AND node_id = ".intval(get('node')));
                 }
                 if ($ret) {
@@ -537 +537 @@
                 if (isset($_POST['id'])) {
                         foreach( (array) $_POST['id'] as $key => $value) {
-                                $db->del("photos", '', "id = '".$value."'");
+                                $db->del("photos", '', "id = '".$value."' AND node_id = ".intval(get('node')));
                                 $uploaddir = $vars['folders']['photos'];
                                 $filename = 'photo-'.$value.".*";