? appdb_appimage_try2.diff
? appsubmit.diff.txt
? bugs.diff
? clickable_cells_in_top10_in_progress.patch
? editapp.diff.txt
? fix_maintainer_name_display.patch
? fullpath_move_uploaded_file.patch
? howto.patch
? htmlarea.tar.gz
? htmlarea_cleanup.patch
? index.php.new
? maintainer_fix.patch
? maintainer_improve.patch
? maintainers_process_appdata.patch
? screens.diff
? screenshots.diff
? util.patch
? xinha
? admin/adminCommentView.php.new
? images/temp
? include/changes.patch
? include/incl.patch
? include/sidebar_maintainer_admin.php
? include/util.patch
Index: appimage.php
===================================================================
RCS file: /opt/cvs-commit/appdb/appimage.php,v
retrieving revision 1.15
diff -u -r1.15 appimage.php
--- appimage.php	31 Jul 2005 04:35:18 -0000	1.15
+++ appimage.php	2 Aug 2005 03:14:02 -0000
@@ -11,11 +11,6 @@
 header("Set-Cookie: ");
 header("Pragma: ");
 
-if(!$_SESSION['current']->hasPriv("admin") && $_REQUEST['queued'])
-{
-   errorpage("Insufficient privileges.");
-   exit;
-}
 if ($_REQUEST['REQUEST_METHOD']='HEAD')
 {
    /* WARNING! optimization of logic in include/screenshots.php */
Index: appsubmit.php
===================================================================
RCS file: /opt/cvs-commit/appdb/appsubmit.php,v
retrieving revision 1.27
diff -u -r1.27 appsubmit.php
--- appsubmit.php	29 Jun 2005 03:01:08 -0000	1.27
+++ appsubmit.php	2 Aug 2005 03:14:02 -0000
@@ -87,7 +87,7 @@
         $oApplication = new Application();
         // FIXME When two htmlarea will be able to live on the same page 
         // without problems under gecko, remove the <p></p> around appDescrion
-        $oApplication->create($_REQUEST['appName'], "<p>".$_REQUEST['appDescription']."</p>", $_REQUEST['keywords']." *** ".$_REQUEST['vendorName'], $_REQUEST['webpage'],$_REQUEST['vendorId'], $_REQUEST['catId']);
+        $oApplication->create($_REQUEST['appName'], "<p>".$_REQUEST['appDescription']."</p>", $_REQUEST['keywords']." *** ".$_REQUEST['vendorName'], $_REQUEST['webpage'], $_REQUEST['vendorId'], $_REQUEST['catId']);
         $oVersion = new Version();
         $oVersion->create($_REQUEST['versionName'], $_REQUEST['versionDescription'], null, null, $oApplication->iAppId);
         redirect(apidb_fullurl("index.php"));
Index: admin/adminAppDataQueue.php
===================================================================
RCS file: /opt/cvs-commit/appdb/admin/adminAppDataQueue.php,v
retrieving revision 1.17
diff -u -r1.17 adminAppDataQueue.php
--- admin/adminAppDataQueue.php	25 Jun 2005 01:22:09 -0000	1.17
+++ admin/adminAppDataQueue.php	2 Aug 2005 03:14:03 -0000
@@ -9,25 +9,20 @@
 require(BASE."include/tableve.php");
 require(BASE."include/application.php");
 
-// deny access if not admin
-if(!$_SESSION['current']->hasPriv("admin"))
+// deny access if not admin or at least some kind of maintainer
+if(!$_SESSION['current']->hasPriv("admin") && !$_SESSION['current']->isMaintainer())
 {
     errorpage("Insufficient privileges.");
     exit;
 }
 
-
 // shows the list of appdata in queue
 if (!$_REQUEST['id'])
 {
-
     apidb_header("Admin Application Data Queue");
 
-    // get available appData
-    $sQuery = "SELECT appData.*, appVersion.appId AS appId 
-               FROM appData, appVersion 
-               WHERE appVersion.versionId = appData.versionID AND appData.queued = 'true';";
-    $hResult = query_appdb($sQuery);
+    /* retrieve the queued apps */
+    $hResult = $_SESSION['current']->getAppDataQuery("*", false, true);
 
     if(!$hResult || !mysql_num_rows($hResult))
     {
@@ -81,11 +76,7 @@
     }      
 } else // shows a particular appdata
 {
-    $sQuery = "SELECT appData.*, appVersion.appId AS appId 
-               FROM appData,appVersion 
-               WHERE appVersion.versionId = appData.versionId 
-               AND id='".$_REQUEST['id']."'";
-    $hResult = query_appdb($sQuery);
+    $hResult = $_SESSION['current']->getAppDataQuery($_REQUEST['id'], false, false);
     $obj_row = mysql_fetch_object($hResult);
     
     if(!$_REQUEST['sub']=="inside_form")
@@ -211,9 +202,7 @@
             }
 
             //delete main item
-            $sQuery = "DELETE from appData where id = ".$obj_row->id.";";
-            $hResult = query_appdb($sQuery);
-            if($hResult)
+            if($_SESSION['current']->deleteAppData($obj_row->id))
             {
                //success
                echo "<p>Application data  was successfully deleted from the Queue.</p>\n";
Index: admin/adminAppQueue.php
===================================================================
RCS file: /opt/cvs-commit/appdb/admin/adminAppQueue.php,v
retrieving revision 1.38
diff -u -r1.38 adminAppQueue.php
--- admin/adminAppQueue.php	30 Jun 2005 22:51:28 -0000	1.38
+++ admin/adminAppQueue.php	2 Aug 2005 03:14:03 -0000
@@ -70,8 +70,8 @@
     }
 }
 
-//deny access if not logged in
-if(!$_SESSION['current']->hasPriv("admin"))
+//deny access if not logged in or not a super maintainer of any applications
+if(!$_SESSION['current']->hasPriv("admin") && !$_SESSION['current']->isSuperMaintainer())
 {
     errorpage("Insufficient privileges.");
     exit;
@@ -81,6 +81,13 @@
 {
     if(is_numeric($_REQUEST['appId']))
     {
+        /* make sure the user is authorized to view this application request */
+        if(!$_SESSION['current']->hasPriv("admin"))
+        {
+            errorpage("Insufficient privileges.");
+            exit;
+        }
+
         $oApp = new Application($_REQUEST['appId']);
 
         /* if we are processing a queued application there MUST be an implicitly queued */
@@ -91,9 +98,23 @@
         $hResult = query_appdb($sQuery);
         $oRow = mysql_fetch_object($hResult);
 
+        /* make sure the user has permission to view this version */
+        if(!$_SESSION['current']->hasAppVersionModifyPermission($oRow->versionId))
+        {
+            errorpage("Insufficient privileges.");
+            exit;
+        }
+
         $oVersion = new Version($oRow->versionId);
     } elseif(is_numeric($_REQUEST['versionId']))
     {
+        /* make sure the user has permission to view this version */
+        if(!$_SESSION['current']->hasAppVersionModifyPermission($_REQUEST['versionId']))
+        {
+            errorpage("Insufficient privileges.");
+            exit;
+        }
+
         $oVersion = new Version($_REQUEST['versionId']);
     } else
     {
@@ -309,7 +330,6 @@
         
             /* delete the appId that is the duplicate */
             $oApp->delete();
-
         }
 
         /* redirect back to the main page */
@@ -353,9 +373,9 @@
 else /* if ($_REQUEST['sub']) is not defined, display the main app queue page */
 {
     apidb_header("Admin App Queue");
-    // get queued apps
-    $sQuery = "SELECT appId FROM appFamily WHERE queued = 'true'";
-    $hResult = query_appdb($sQuery);
+
+    // get queued apps that the current user should see
+    $hResult = $_SESSION['current']->getAppQueueQuery(true); /* query for the app family */
 
     if(!$hResult || !mysql_num_rows($hResult))
     {
@@ -416,8 +436,7 @@
     }
 
      // get queued versions (only versions where application are not queued already)
-     $sQuery = "SELECT versionId FROM appVersion, appFamily WHERE appFamily.appId = appVersion.appId and appFamily.queued = 'false' AND appVersion.queued = 'true'";
-     $hResult = query_appdb($sQuery);
+     $hResult = $_SESSION['current']->getAppQueueQuery(false); /* query for the app version */
 
      if(!$hResult || !mysql_num_rows($hResult))
      {
Index: include/application.php
===================================================================
RCS file: /opt/cvs-commit/appdb/include/application.php,v
retrieving revision 1.28
diff -u -r1.28 application.php
--- include/application.php	13 Jul 2005 03:44:38 -0000	1.28
+++ include/application.php	2 Aug 2005 03:14:05 -0000
@@ -115,7 +115,6 @@
      */
     function create($sName=null, $sDescription=null, $sKeywords=null, $sWebpage=null, $iVendorId=null, $iCatId=null)
     {
-
         // Security, if we are not an administrator the application must be queued.
         if(!($_SESSION['current']->hasPriv("admin")))
             $this->bQueued = true;
@@ -222,6 +221,10 @@
      */
     function delete($bSilent=false)
     {
+        /* don't let non-admins delete applications */
+        if(!($_SESSION['current']->hasPriv("admin")))
+            return;
+
         foreach($this->aVersionsIds as $iVersionId)
         {
             $oVersion = new Version($iVersionId);
Index: include/incl.php
===================================================================
RCS file: /opt/cvs-commit/appdb/include/incl.php,v
retrieving revision 1.24
diff -u -r1.24 incl.php
--- include/incl.php	27 Jul 2005 02:10:56 -0000	1.24
+++ include/incl.php	2 Aug 2005 03:14:05 -0000
@@ -107,6 +107,10 @@
     {
         include(BASE."include/sidebar_admin.php");
         apidb_sidebar_add("global_admin_menu");
+    } else if($_SESSION['current']->isMaintainer()) /* if the user maintains anything, add their menus */
+    {
+        include(BASE."include/sidebar_maintainer_admin.php");
+        apidb_sidebar_add("global_maintainer_admin_menu");
     }
 
     // Login Menu
Index: include/screenshot.php
===================================================================
RCS file: /opt/cvs-commit/appdb/include/screenshot.php,v
retrieving revision 1.30
diff -u -r1.30 screenshot.php
--- include/screenshot.php	30 Jul 2005 16:04:57 -0000	1.30
+++ include/screenshot.php	2 Aug 2005 03:14:05 -0000
@@ -128,11 +128,9 @@
      */
     function delete($bSilent=false)
     {
-        $sQuery = "DELETE FROM appData 
-                   WHERE id = ".$this->iScreenshotId." 
-                   AND type = 'image' 
-                   LIMIT 1";
-        if($hResult = query_appdb($sQuery))
+        /* the user object should delete the app data entry */
+        /* we can perform better permissions checking there */
+        if($_SESSION['current']->deleteAppData($this->iScreenshotId))
         {
             $this->oScreenshotImage->delete();
             $this->oThumbnailImage->delete();
Index: include/sidebar_admin.php
===================================================================
RCS file: /opt/cvs-commit/appdb/include/sidebar_admin.php,v
retrieving revision 1.16
diff -u -r1.16 sidebar_admin.php
--- include/sidebar_admin.php	20 Jul 2005 02:31:13 -0000	1.16
+++ include/sidebar_admin.php	2 Aug 2005 03:14:05 -0000
@@ -11,8 +11,8 @@
     $g->add("Add Vendor", BASE."admin/addVendor.php");
     
     $g->addmisc("&nbsp;");
-    $g->add("View App Queue (".getQueuedAppCount()."/".getQueuedVersionCount().")", BASE."admin/adminAppQueue.php");
-    $g->add("View App Data Queue (".getQueuedAppDataCount().")", BASE."admin/adminAppDataQueue.php");
+    $g->add("View App Queue (".$_SESSION['current']->getQueuedAppCount()."/".$_SESSION['current']->getQueuedVersionCount().")", BASE."admin/adminAppQueue.php");
+    $g->add("View App Data Queue (".$_SESSION['current']->getQueuedAppDataCount().")", BASE."admin/adminAppDataQueue.php");
     $g->add("View Maintainer Queue (".getQueuedMaintainerCount().")", BASE."admin/adminMaintainerQueue.php");
     $g->add("View Maintainer Entries (".getMaintainerCount().")", BASE."admin/adminMaintainers.php");
     $g->add("View Vendors (".getVendorCount().")", BASE."admin/adminVendors.php");
@@ -23,7 +23,6 @@
     $g->add("Comments Management", BASE."admin/adminCommentView.php");
     $g->add("Screenshots Management", BASE."admin/adminScreenshots.php");
     $g->done();
-
 }
 
 ?>
Index: include/user.php
===================================================================
RCS file: /opt/cvs-commit/appdb/include/user.php,v
retrieving revision 1.44
diff -u -r1.44 user.php
--- include/user.php	31 Jul 2005 17:53:11 -0000	1.44
+++ include/user.php	2 Aug 2005 03:14:06 -0000
@@ -232,7 +232,7 @@
         if($iAppId)
         {
             $sQuery = "SELECT * FROM appMaintainers WHERE userid = '$this->iUserId' AND appId = '$iAppId' AND superMaintainer = '1'";
-        } else
+        } else /* are we super maintainer of any applications? */
         {
             $sQuery = "SELECT * FROM appMaintainers WHERE userid = '$this->iUserId' AND superMaintainer = '1'";
         }
@@ -295,6 +295,49 @@
         return $statusMessage;
      }
 
+    /* get the number of queued applications */
+    function getQueuedAppCount()
+    {
+        /* return 0 because non-admins have no way to process new apps */
+        if(!$this->hasPriv("admin"))
+            return 0;
+
+        $qstring = "SELECT count(*) as queued_apps FROM appFamily WHERE queued='true'";
+        $result = query_appdb($qstring);
+        $ob = mysql_fetch_object($result);
+        return $ob->queued_apps;
+    }
+
+    function getQueuedVersionCount()
+    {
+        if($this->hasPriv("admin"))
+        {
+            $qstring = "SELECT count(*) as queued_versions FROM appVersion WHERE queued='true'";
+        } else
+        {
+            /* find all queued versions of applications that the user is a super maintainer of */
+            $qstring = "SELECT count(*) as queued_versions FROM appVersion, appMaintainers
+                        WHERE queued='true' AND appMaintainers.superMaintainer ='1'
+                        AND appVersion.appId = appMaintainers.appId
+                        AND appMaintainers.userId ='".$this->iUserId."';";
+        }
+        $result = query_appdb($qstring);
+        $ob = mysql_fetch_object($result);
+
+        /* we don't want to count the versions that are implicit in the applications */
+        /* that are in the queue */
+        return $ob->queued_versions - $this->getQueuedAppCount();
+    }
+
+
+    /* get the number of queued appdata */
+    function getQueuedAppDataCount()
+    {
+        $hResult = $this->getAppDataQuery(0, true, false);
+        $ob = mysql_fetch_object($hResult);
+        return $ob->queued_appdata;
+    }
+
     function addPriv($sPriv)
     {
         if(!$this->isLoggedIn() || !$sPriv)
@@ -342,6 +385,152 @@
      function wantsEmail()
      {
          return ($this->isLoggedIn() && $this->getPref("send_email","yes")=="yes");
+     }
+
+     /**
+      * Return an app query based on the user permissions and an iAppDataId
+      * Used to display appropriate appdata entries based upon admin vs. maintainer
+      * as well as to determine if the maintainer has permission to delete an appdata entry
+      */
+     function getAppDataQuery($iAppDataId, $queryQueuedCount, $queryQueued)
+     {
+         /* either look for queued app data entries */
+         /* or ones that match the given id */
+         if($queryQueuedCount)
+         {
+             $selectTerms = "count(*) as queued_appdata";
+             $additionalTerms = "AND appData.queued='true'";
+         } else if($queryQueued)
+         {
+             $selectTerms = "appData.*, appVersion.appId AS appId";
+             $additionalTerms = "AND appData.queued='true'";
+         } else
+         {
+             $selectTerms = "appData.*, appVersion.appId AS appId";
+             $additionalTerms = "AND id='".$iAppDataId."'";
+         }
+
+         if($_SESSION['current']->hasPriv("admin"))
+         {
+             $sQuery = "SELECT ".$selectTerms."
+               FROM appData,appVersion 
+               WHERE appVersion.versionId = appData.versionId 
+               ".$additionalTerms.";";
+         } else
+         {
+             /* select versions where we supermaintain the application or where */
+             /* we maintain the appliation, and where the versions we supermaintain */
+             /* or maintain are in the appData list */
+             /* then apply some additional terms */
+             $sQuery = "select ".$selectTerms." from appMaintainers, appVersion, appData where
+                        (
+                         ((appMaintainers.appId = appVersion.appId) AND
+                          (appMaintainers.superMaintainer = '0'))
+                         OR
+                          ((appMaintainers.versionId = appVersion.versionId)
+                           AND (appMaintainers.superMaintainer = '0'))
+                        )
+                        AND appData.versionId = appVersion.versionId
+                        AND appMaintainers.userId = '".$this->iUserId."'
+                        ".$additionalTerms.";";
+         }
+
+         return query_appdb($sQuery);
+     }
+
+     /**
+      * Delete appData
+      */
+     function deleteAppData($iAppDataId)
+     {
+         $isMaintainer = false;
+
+         /* if we aren't an admin we should see if we can find any results */
+         /* for a query based on this appDataId, if we can then */
+         /* we have permission to delete the entry */
+         if(!$this->hasPriv("admin"))
+         {
+             $hResult = $this->getAppDataQuery($iAppDataId, false, false);
+             if(!$hResult)
+                 return false;
+
+             echo "result rows:".mysql_num_row($hResult);
+
+             if(mysql_num_rows($hResult) > 0)
+                 $isMaintainer = true;
+         }
+
+         /* do we have permission to delete this item? */
+         if($this->hasPriv("admin") || $isMaintainer)
+         {
+             $sQuery = "DELETE from appData where id = ".$iAppDataId."
+                        LIMIT 1;";
+             $hResult = query_appdb($sQuery);
+             if($hResult)
+                 return true;
+         }
+
+         return false;
+     }
+
+     /**
+      * Retrieve the list of applications in the app queue that this user can see
+      */
+     function getAppQueueQuery($queryAppFamily)
+     {
+         if($this->hasPriv("admin"))
+         {
+             if($queryAppFamily)
+             {
+                 $sQuery = "SELECT appFamily.appId FROM appFamily WHERE queued = 'true'";
+             } else
+             {
+                 $sQuery = "SELECT appVersion.versionId FROM appVersion, appFamily
+                            WHERE appFamily.appId = appVersion.appId 
+                            AND appFamily.queued = 'false' AND appVersion.queued = 'true'";
+             }
+         } else
+         {
+             if($queryAppFamily)
+             {
+                 $sQuery = "SELECT appFamily.appId FROM appFamily, appMaintainers
+                            WHERE queued = 'true'
+                            AND appFamily.appId = appMaintainers.appId
+                            AND appMaintainers.superMaintainer = '1'
+                            AND appMaintainers.userId = '".$this->iUserId."';";
+             } else
+             {
+                 $sQuery = "SELECT appVersion.versionId FROM appVersion, appFamily, appMaintainers
+                            WHERE appFamily.appId = appVersion.appId 
+                            AND appFamily.queued = 'false' AND appVersion.queued = 'true'
+                            AND appFamily.appId = appMaintainers.appId
+                            AND appMaintainers.superMaintainer = '1'
+                            AND appMaintainers.userId = '".$this->iUserId."';";
+             }
+         }
+
+         return query_appdb($sQuery);
+     }
+
+     /**
+      * Does the user have permission to modify on this version?
+      */
+     function hasAppVersionModifyPermission($iVersionId)
+     {
+         if($this->hasPriv("admin"))
+             return true;
+
+         $sQuery = "SELECT appVersion.versionId FROM appVersion, appFamily, appMaintainers
+                      WHERE appFamily.appId = appVersion.appId 
+                      AND appFamily.appId = appMaintainers.appId
+                      AND appMaintainers.superMaintainer = '1'
+                      AND appMaintainers.userId = '".$this->iUserId."'
+                      AND appVersion.versionId = '".$iVersionId."';";
+         $hResult = query_appdb($sQuery);
+         if(mysql_num_rows($hResult))
+             return true;
+         else
+             return false;
      }
 }
 
Index: include/util.php
===================================================================
RCS file: /opt/cvs-commit/appdb/include/util.php,v
retrieving revision 1.40
diff -u -r1.40 util.php
--- include/util.php	1 Aug 2005 03:57:32 -0000	1.40
+++ include/util.php	2 Aug 2005 03:14:07 -0000
@@ -146,36 +146,6 @@
     echo "</select>\n";
 }
 
-/* get the number of queued applications */
-function getQueuedAppCount()
-{
-    $qstring = "SELECT count(*) as queued_apps FROM appFamily WHERE queued='true'";
-    $result = query_appdb($qstring);
-    $ob = mysql_fetch_object($result);
-    return $ob->queued_apps;
-}
-
-function getQueuedVersionCount()
-{
-    $qstring = "SELECT count(*) as queued_versions FROM appVersion WHERE queued='true'";
-    $result = query_appdb($qstring);
-    $ob = mysql_fetch_object($result);
-
-    /* we don't want to count the versions that are implicit in the applications */
-    /* that are in the queue */
-    return $ob->queued_versions - getQueuedAppCount();
-}
-
-
-/* get the number of queued appdata */
-function getQueuedAppDataCount()
-{
-    $qstring = "SELECT count(*) as queued_appdata FROM appData WHERE queued='true'";
-    $result = query_appdb($qstring);
-    $ob = mysql_fetch_object($result);
-    return $ob->queued_appdata;
-}
-
 /* get the number of queued maintainers */
 function getQueuedMaintainerCount()
 {
Index: include/version.php
===================================================================
RCS file: /opt/cvs-commit/appdb/include/version.php,v
retrieving revision 1.27
diff -u -r1.27 version.php
--- include/version.php	13 Jul 2005 03:44:38 -0000	1.27
+++ include/version.php	2 Aug 2005 03:14:07 -0000
@@ -248,6 +248,12 @@
      */
     function delete($bSilent=false)
     {
+        /* is the current user allowed to delete this version? */
+        if(!$_SESSION['current']->hasPriv("admin") && !$_SESSION['current']->hasAppVersionModifyPermission($iVersionId))
+        {
+            return;
+        }
+
         /* remove all of the items this version contains */
         foreach($this->aNotesIds as $iNoteId)
         {
@@ -303,6 +309,12 @@
      */
     function unQueue()
     {
+        /* is the current user allowed to delete this version? */
+        if(!$_SESSION['current']->hasPriv("admin") && !$_SESSION['current']->hasAppVersionModifyPermission($iVersionId))
+        {
+            return;
+        }
+
         // If we are not in the queue, we can't move the version out of the queue.
         if(!$this->bQueued)
             return false;
--- /dev/null	2005-08-01 12:08:52.078883384 -0400
+++ include/sidebar_maintainer_admin.php	2005-08-01 23:13:51.000000000 -0400
@@ -0,0 +1,15 @@
+<?php
+/*****************/
+/* sidebar_admin */
+/*****************/
+
+function global_maintainer_admin_menu() {
+
+    $g = new htmlmenu("Maintainer Admin");
+    
+    $g->add("View App Queue (".$_SESSION['current']->getQueuedVersionCount().")", BASE."admin/adminAppQueue.php");
+    $g->add("View App Data Queue (".$_SESSION['current']->getQueuedAppDataCount().")", BASE."admin/adminAppDataQueue.php");
+    $g->done();
+}
+
+?>
