fix issue #34, edit rights of righless users

includes/pages/admin_user.php

@@ -117,11 +117,16 @@ function admin_user() {
 			$html .= "Hier kannst Du die Benutzergruppen des Engels festlegen:<form action=\"" . page_link_to("admin_user") . "&action=save_groups&id=" . $id . "\" method=\"post\">\n";
 			$html .= '<table>';
 
-			list ($my_highest_group) = sql_select("SELECT * FROM `UserGroups` WHERE `uid`=" . sql_escape($user['UID']) . " ORDER BY `uid`");
-			list ($his_highest_group) = sql_select("SELECT * FROM `UserGroups` WHERE `uid`=" . sql_escape($id) . " ORDER BY `uid`");
+			$my_highest_group = sql_select("SELECT * FROM `UserGroups` WHERE `uid`=" . sql_escape($user['UID']) . " ORDER BY `uid` LIMIT 1");
+			if (count($my_highest_group) > 0)
+				$my_highest_group = $my_highest_group[0]['group_id'];			
+			
+			$his_highest_group = sql_select("SELECT * FROM `UserGroups` WHERE `uid`=" . sql_escape($id) . " ORDER BY `uid` LIMIT 1");
+			if (count($his_highest_group) > 0)
+				$his_highest_group = $his_highest_group[0]['group_id'];
 
 			if ($id != $user['UID'] && $my_highest_group <= $his_highest_group) {
-				$groups = sql_select("SELECT * FROM `Groups` LEFT OUTER JOIN `UserGroups` ON (`UserGroups`.`group_id` = `Groups`.`UID` AND `UserGroups`.`uid` = " . sql_escape($id) . ") WHERE `Groups`.`UID` >= " . sql_escape($my_highest_group['group_id']) . " ORDER BY `Groups`.`Name`");
+				$groups = sql_select("SELECT * FROM `Groups` LEFT OUTER JOIN `UserGroups` ON (`UserGroups`.`group_id` = `Groups`.`UID` AND `UserGroups`.`uid` = " . sql_escape($id) . ") WHERE `Groups`.`UID` >= " . sql_escape($my_highest_group) . " ORDER BY `Groups`.`Name`");
 				foreach ($groups as $group)
 					$html .= '<tr><td><input type="checkbox" name="groups[]" value="' . $group['UID'] . '"' . ($group['group_id'] != "" ? ' checked="checked"' : '') . ' /></td><td>' . $group['Name'] . '</td></tr>';
 
@@ -138,7 +143,7 @@ function admin_user() {
 			$html .= "</form>";
 
 			$html .= "<hr />";
-			$html .= funktion_db_element_list_2row("Freeloader Shifts", "SELECT `Remove_Time`, `Length`, `Comment` FROM `ShiftFreeloader` WHERE UID=" . $_REQUEST['id']);
+			//$html .= funktion_db_element_list_2row("Freeloader Shifts", "SELECT `Remove_Time`, `Length`, `Comment` FROM `ShiftFreeloader` WHERE UID=" . $_REQUEST['id']);
 		} else {
 			switch ($_REQUEST['action']) {
 				case 'save_groups' :

includes/sys_auth.php

@@ -10,7 +10,7 @@ function load_auth() {
 
 	if ($_SESSION['IP'] != $_SERVER['REMOTE_ADDR']) {
 		session_destroy();
-		header("Location: " . link_to_page($start));
+		header("Location: " . link_to_page('start'));
 	}
 
 	$user = null;

includes/sys_mysql.php

@@ -26,6 +26,7 @@ function sql_select($query) {
 		}
 		return $data;
 	} else {
+		print_r(debug_backtrace());
 		die('MySQL-query error: ' . $query . ", " . mysql_error($con));
 	}
 }