Changeset 510 for trunk/xpressme_integration_kit/admin/index.php

Timestamp:

Feb 5, 2010, 10:55:05 AM (15 years ago)

Author:

toemon

Message:

ブロックの配置権限をもたせたユーザがDB接続情報を見ることができてしまうバグを修正 Fixes #283

File:

• trunk/xpressme_integration_kit/admin/index.php (modified) (2 diffs)

trunk/xpressme_integration_kit/admin/index.php

@@ -505 +505 @@
 function xpress_config_from_xoops_view($is_report = false)
 {
-        global $xoopsUserIsAdmin;
-
+        global $xoopsUserIsAdmin,$xoopsUser;
+
+        $user_groups = $xoopsUser->_groups;
+        $is_admin_group = in_array('1',$user_groups);
+        
         require_once dirname(dirname( __FILE__ )).'/class/config_from_xoops.class.php' ;
         $xoops_config = new ConfigFromXoops;
@@ -516 +519 @@
                 echo "<fieldset><legend style='font-weight: bold; color: #900;'>" . _AM_XP2_XOOPS_CONFIG_INFO . "</legend>";
                 echo "<div style='padding: 8px;'>";
-                if ($xoopsUserIsAdmin){
+                if ($xoopsUserIsAdmin && $is_admin_group){
                         xpress_config_nomal_view();
                 } else {