vikbooking / admin / controllers / operators.php

operators.php in VikBooking Hotel Booking Engine & PMS trunk, at admin/controllers/operators.php

155 lines 4.1 KB

Raw Download Zip

1	<?php
2	/**
3	* @package VikBooking
4	* @subpackage core
5	* @author E4J s.r.l.
6	* @copyright Copyright (C) 2024 E4J s.r.l. All Rights Reserved.
7	* @license http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL
8	* @link https://vikwp.com
9	*/
10
11	// No direct access
12	defined('ABSPATH') or die('No script kiddies please!');
13
14	/**
15	* VikBooking operators controller.
16	*
17	* @since 1.16.9 (J) - 1.6.9 (WP)
18	*/
19	class VikBookingControllerOperators extends JControllerAdmin
20	{
21	/**
22	* Removes the permissions from one operator for a given tool.
23	* AJAX endpoint.
24	*/
25	public function removePermission()
26	{
27	if (!JFactory::getUser()->authorise('core.delete', 'com_vikbooking')) {
28	VBOHttpDocument::getInstance()->close(403, JText::translate('JERROR_ALERTNOAUTHOR'));
29	}
30
31	if (!JSession::checkToken()) {
32	// missing CSRF-proof token
33	VBOHttpDocument::getInstance()->close(403, JText::translate('JINVALID_TOKEN'));
34	}
35
36	$dbo = JFactory::getDbo();
37	$app = JFactory::getApplication();
38	$input = $app->input;
39
40	$operator_id = $input->getUInt('operator_id', 0);
41	$tool_id = $input->getString('tool_id', '');
42
43	if (!$operator_id \|\| !$tool_id) {
44	VBOHttpDocument::getInstance($app)->close(400, 'Missing mandatory values to perform the request');
45	}
46
47	// access the global operators object
48	$oper_obj = VikBooking::getOperatorInstance();
49
50	$record = $oper_obj->getOne($operator_id);
51
52	if (!$record \|\| !$record['perms']) {
53	VBOHttpDocument::getInstance($app)->close(404, 'Operator or operator-tool not found');
54	}
55
56	foreach ($record['perms'] as $index => $tool_perms) {
57	if (!strcasecmp($tool_perms['type'], $tool_id)) {
58	// tool permissions found, unset them
59	unset($record['perms'][$index]);
60	break;
61	}
62	}
63
64	// reset keys to always keep a numeric array
65	$record['perms'] = array_values($record['perms']);
66
67	$dbo->setQuery(
68	$dbo->getQuery(true)
69	->update($dbo->qn('#__vikbooking_operators'))
70	->set($dbo->qn('perms') . ' = ' . $dbo->q(json_encode($record['perms'])))
71	->where($dbo->qn('id') . ' = ' . (int) $record['id'])
72	);
73
74	$dbo->execute();
75
76	VBOHttpDocument::getInstance($app)->json($record['perms']);
77	}
78
79	/**
80	* Saves (adds or updates) the permissions of one operator for a given tool.
81	* AJAX endpoint.
82	*/
83	public function savePermission()
84	{
85	if (!JFactory::getUser()->authorise('core.create', 'com_vikbooking')) {
86	VBOHttpDocument::getInstance()->close(403, JText::translate('JERROR_ALERTNOAUTHOR'));
87	}
88
89	if (!JSession::checkToken()) {
90	// missing CSRF-proof token
91	VBOHttpDocument::getInstance()->close(403, JText::translate('JINVALID_TOKEN'));
92	}
93
94	$dbo = JFactory::getDbo();
95	$app = JFactory::getApplication();
96	$input = $app->input;
97
98	$operator_id = $input->getUInt('operator_id', 0);
99	$tool_id = $input->getString('tool_id', '');
100	$perms = $input->get('perms', [], 'array');
101
102	if (!$operator_id \|\| !$tool_id) {
103	VBOHttpDocument::getInstance($app)->close(400, 'Missing mandatory values to perform the request');
104	}
105
106	// access the global operators object
107	$oper_obj = VikBooking::getOperatorInstance();
108
109	$record = $oper_obj->getOne($operator_id);
110
111	if (!$record) {
112	VBOHttpDocument::getInstance($app)->close(404, 'Operator not found');
113	}
114
115	if (!$record['perms']) {
116	$record['perms'] = [];
117	}
118
119	// detect if we are updating existing tool permissions
120	$updated = false;
121	foreach ($record['perms'] as $index => $tool_perms) {
122	if (!strcasecmp($tool_perms['type'], $tool_id)) {
123	// existing tool permissions found
124	$record['perms'][$index]['perms'] = $perms;
125
126	// turn flag on
127	$updated = true;
128
129	break;
130	}
131	}
132
133	if (!$updated) {
134	// append new tool permissions
135	$record['perms'][] = [
136	'type' => $tool_id,
137	'perms' => $perms,
138	];
139	}
140
141	// update operator record
142	$dbo->setQuery(
143	$dbo->getQuery(true)
144	->update($dbo->qn('#__vikbooking_operators'))
145	->set($dbo->qn('perms') . ' = ' . $dbo->q(json_encode($record['perms'])))
146	->where($dbo->qn('id') . ' = ' . (int) $record['id'])
147	);
148
149	$dbo->execute();
150
151	// output the new operator permissions
152	VBOHttpDocument::getInstance($app)->json($record['perms']);
153	}
154	}
155