From bb7708cd03f43f747fde9c02256c5a927c3c15ca Mon Sep 17 00:00:00 2001
From: laf <neil@lathwood.co.uk>
Date: Wed, 25 Jun 2014 14:51:50 +0100
Subject: [PATCH] Updated queries for non-admin users to filter devices

---
 html/pages/front/default.php  | 12 ++++++++++--
 html/pages/ports.inc.php      | 37 ++++++++++++++++++++++++++++++++---
 html/pages/ports/list.inc.php | 11 ++++++-----
 3 files changed, 50 insertions(+), 10 deletions(-)

diff --git a/html/pages/front/default.php b/html/pages/front/default.php
index d7f0c664c..fe1f5f52e 100644
--- a/html/pages/front/default.php
+++ b/html/pages/front/default.php
@@ -74,8 +74,16 @@ if ($config['warn']['ifdown'])
 
 /* FIXME service permissions? seem nonexisting now.. */
 // Service down boxes
-$sql = "SELECT * FROM `services` AS S, `devices` AS D WHERE S.device_id = D.device_id AND service_status = 'down' AND D.ignore = '0' AND S.service_ignore = '0'";
-foreach (dbFetchRows($sql) as $service)
+if ($_SESSION['userlevel'] == '10')
+{
+  $sql = "SELECT * FROM `services` AS S, `devices` AS D WHERE S.device_id = D.device_id AND service_status = 'down' AND D.ignore = '0' AND S.service_ignore = '0'";
+}
+else
+{
+  $sql = "SELECT * FROM services AS S, devices AS D, devices_perms AS P WHERE P.`user_id` = ? AND P.`device_id` = D.`device_id` AND S.`device_id` = D.`device_id` AND S.`service_ignore` = '0' AND S.`service_disabled` = '0' AND S.`service_status` = '0'";
+  $param[] = $_SESSION['user_id'];
+}
+foreach (dbFetchRows($sql,$param) as $service)
 {
   generate_front_box("service-down", generate_device_link($service, shorthost($service['hostname']))."<br />
     <span class=service-down>Service Down</span>
diff --git a/html/pages/ports.inc.php b/html/pages/ports.inc.php
index 6a4a7bf49..bb0b5c12e 100644
--- a/html/pages/ports.inc.php
+++ b/html/pages/ports.inc.php
@@ -94,12 +94,36 @@ if($vars['searchbar'] != "hide")
         <option value=''>All Devices</option>
 <?php
 
-foreach (dbFetchRows("SELECT `device_id`,`hostname` FROM `devices` GROUP BY `hostname` ORDER BY `hostname`") as $data)
+if($_SESSION['userlevel'] >= 5)
+{
+  $results = dbFetchRows("SELECT `device_id`,`hostname` FROM `devices` GROUP BY `hostname` ORDER BY `hostname`");
+}
+else
+{
+  $results = dbFetchRows("SELECT `D`.`device_id`,`D`.`hostname` FROM `devices` AS `D`, `devices_perms` AS `P` WHERE `P`.`user_id` = ? AND `P`.`device_id` = `D`.`device_id` GROUP BY `hostname` ORDER BY `hostname`", array($_SESSION['user_id']));
+}
+foreach ($results as $data)
 {
   echo('        <option value="'.$data['device_id'].'"');
   if ($data['device_id'] == $vars['device_id']) { echo("selected"); }
   echo(">".$data['hostname']."</option>");
 }
+
+if($_SESSION['userlevel'] < 5)
+{
+  $results = dbFetchRows("SELECT `D`.`device_id`,`D`.`hostname` FROM `ports` AS `I` JOIN `devices` AS `D` ON `D`.`device_id`=`I`.`device_id` JOIN `ports_perms` AS `PP` ON `PP`.`port_id`=`I`.`port_id` WHERE `PP`.`user_id` = ? AND `PP`.`port_id` = `I`.`port_id` GROUP BY `hostname` ORDER BY `hostname`", array($_SESSION['user_id']));
+}
+else
+{
+  $results = '';
+}
+foreach ($results as $data)
+{
+  echo('        <option value="'.$data['device_id'].'"');
+  if ($data['device_id'] == $vars['device_id']) { echo("selected"); }
+  echo(">".$data['hostname']."</option>");
+}
+
 ?>
       </select>
       <input type="hostname" name="hostname" id="hostname" title="Hostname" class="form-control input-sm" <?php if (strlen($vars['hostname'])) {echo('value="'.$vars['hostname'].'"');} ?> placeholder="Hostname" />
@@ -239,10 +263,17 @@ foreach ($vars as $var => $value)
     switch ($var)
     {
       case 'hostname':
-      case 'location':
-        $where .= " AND D.$var LIKE ?";
+        $where .= " AND D.hostname LIKE ?";
         $param[] = "%".$value."%";
+        break;
+      case 'location':
+        $where .= " AND D.location LIKE ?";
+        $param[] = "%".$value."%";
+        break;
       case 'device_id':
+        $where .= " AND D.device_id = ?";
+        $param[] = $value;
+        break;
       case 'deleted':
       case 'ignore':
         if ($value == 1)
diff --git a/html/pages/ports/list.inc.php b/html/pages/ports/list.inc.php
index fac426ad0..92f3c42e9 100644
--- a/html/pages/ports/list.inc.php
+++ b/html/pages/ports/list.inc.php
@@ -30,13 +30,14 @@ $ports_disabled = 0; $ports_down = 0; $ports_up = 0; $ports_total = 0;
 foreach ($ports as $port)
 {
 
-  if ($port['ifAdminStatus'] == "down") { $ports_disabled++;
-  } elseif ($port['ifAdminStatus'] == "up" && $port['ifOperStatus']== "down") { $ports_down++;
-  } elseif ($port['ifAdminStatus'] == "up" && $port['ifOperStatus']== "up") { $ports_up++; }
-  $ports_total++;
-
   if (port_permitted($port['port_id'], $port['device_id']))
   {
+
+    if ($port['ifAdminStatus'] == "down") { $ports_disabled++;
+    } elseif ($port['ifAdminStatus'] == "up" && $port['ifOperStatus']== "down") { $ports_down++;
+    } elseif ($port['ifAdminStatus'] == "up" && $port['ifOperStatus']== "up") { $ports_up++; }
+    $ports_total++;
+
     $speed = humanspeed($port['ifSpeed']);
     $type = humanmedia($port['ifType']);
     $ifclass = ifclass($port['ifOperStatus'], $port['ifAdminStatus']);