Fix#164 - Permissions not working at Group level (#189)

* Fix#164 - Permissions not working at Group level

* Fixing php-cs-fixer audit issue

Author: TheWitness

lib/WeatherMap.class.php

@@ -1063,7 +1063,7 @@ function ReadData() {
 								if ($target[0] != '') {
 									$matched_by = $target[5];
 
-									[$in,$out,$datatime] =  $this->plugins['data'][$target[5]]->ReadData($targetstring, $this, $myobj);
+									[$in, $out, $datatime] =  $this->plugins['data'][$target[5]]->ReadData($targetstring, $this, $myobj);
 								}
 
 								if (($in === null) && ($out === null)) {

lib/WeatherMap.functions.php

@@ -78,49 +78,49 @@ function get_allowed_weathermaps($userid, $group_id = null) {
 	return $maps;
 }
 
-function is_weathermap_allowed($mapid, $userid, $group_id = null) {
+function is_weathermap_allowed($mapid, $userid) {
 	// Special Group Limiter
 	$sql_where = '';
-
-	if ($group_id !== null) {
-		$sql_where = 'AND group_id = ' . $group_id;
-	}
+	$params    = [$mapid];
 
 	// Try all users first
-	$allowed = db_fetch_cell_prepared("SELECT mapid
+	$allowed = db_fetch_cell_prepared('SELECT mapid
 		FROM weathermap_auth
 		WHERE userid = 0
-		$sql_where
-		AND mapid = ?",
-		[$mapid]);
+		AND mapid = ?',
+		$params);
 
-	// Try user first
 	if ($allowed) {
 		return true;
 	}
 
-	$allowed = db_fetch_cell_prepared("SELECT mapid
+	$params[] = $userid;
+
+	// Try specific user second
+	$allowed = db_fetch_cell_prepared('SELECT mapid
 		FROM weathermap_auth
-		WHERE userid = ?
-		$sql_where
-		AND mapid = ?",
-		[$userid, $mapid]);
+		WHERE mapid = ?
+		AND userid = ?',
+		$params);
 
-	// Try user second
 	if ($allowed) {
 		return true;
 	}
 
-	$allowed - db_fetch_cell_prepared("SELECT mapid
+	// Try user group last
+	$allowed = db_fetch_cell_prepared('SELECT mapid
 		FROM weathermap_auth AS wa
 		INNER JOIN user_auth_group AS uag
-		ON uag.id = -wa.userid
-		WHERE uag.id = ?
-		$sql_where
-		AND mapid = ?",
-		[-$userid, $mapid]);
+		ON wa.userid < 0
+		AND uag.id = ABS(wa.userid)
+		INNER JOIN user_auth_group_members AS uagm
+		ON uag.id = uagm.group_id
+		WHERE wa.mapid = ?
+		AND uagm.user_id = ?
+		AND uag.enabled = "on"
+		AND uagm.group_id > 0',
+		$params);
 
-	// Try user second
 	if ($allowed) {
 		return true;
 	}

weathermap-cacti-plugin-mgmt.php

@@ -1068,6 +1068,7 @@ function maplist() {
 
 				if ($ulist['groups'] > 0) {
 					$url .= ($found ? ', ' : '') . ($ulist['groups'] == 1 ? __('1 Group', 'weathermap') : __('%d Groups', $ulist['groups'], 'weathermap'));
+					$found = true;
 				}
 
 				if ($ulist['users'] > 0) {
@@ -2010,7 +2011,8 @@ function perms_get_records(&$total_rows, $rows = 30, $apply_limits = true) {
 				SELECT id, name, description, 'group' AS type, wa.mapid AS allowed, 'N/A' AS realm
 				FROM user_auth_group AS uag
 				$join JOIN (SELECT * FROM weathermap_auth WHERE mapid = ?) AS wa
-				ON uag.id = -wa.userid
+				ON wa.userid < 0
+				AND uag.id = ABS(wa.userid)
 				AND uag.enabled = 'on'
 				WHERE (wa.mapid = ? OR (wa.mapid IS NULL AND uag.enabled = 'on'))
 				$sql_where2