From 45966656906337a4119f03df3d2cea55e22f1757 Mon Sep 17 00:00:00 2001
From: Janusz Dobrowolski <janusz@frontaccounting.eu>
Date: Sat, 26 Jul 2008 07:20:58 +0000
Subject: [PATCH] Site admin priviledges available only for first registered
 company admins.

---
 admin/create_coy.php      | 11 ++++++-----
 admin/inst_lang.php       |  2 +-
 admin/inst_module.php     |  2 +-
 config.php                | 10 +++++++---
 includes/current_user.inc |  4 +++-
 5 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/admin/create_coy.php b/admin/create_coy.php
index a7cae00c..b40b41d7 100644
--- a/admin/create_coy.php
+++ b/admin/create_coy.php
@@ -1,6 +1,6 @@
 <?php
 
-$page_security = 15;
+$page_security = 20;
 $path_to_root="..";
 include_once($path_to_root . "/includes/session.inc");
 
@@ -29,13 +29,14 @@ else
 
 function check_data()
 {
-	global $db_connections, $tb_pref_counter;
+	global $db_connections, $tb_pref_counter, $selected_id;
 
 	if ($_POST['name'] == "" || $_POST['host'] == "" || $_POST['dbuser'] == "" || $_POST['dbname'] == "")
 		return false;
 	foreach($db_connections as $id=>$con)
 	{
-	  	if ($_POST['host'] == $con['host'] && $_POST['dbname'] == $con['dbname'])
+	 if($id != $selected_id && $_POST['host'] == $con['host'] 
+	 	&& $_POST['dbname'] == $con['dbname'])
 	  	{
 			if ($_POST['tbpref'] == $con['tbpref'])
 			{
@@ -232,8 +233,8 @@ function display_companies()
 		label_cell($conn[$i]['tbpref']);
 		label_cell($what);
 		label_cell("<a href=" . $_SERVER['PHP_SELF']. "?selected_id=" . $i . ">" . _("Edit") . "</a>");
-		if ($i != $coyno)
-			label_cell("<a href='javascript:deleteCompany(" . $i . ")'>" . _("Delete") . "</a>");
+		label_cell( $i == $coyno ? '' :
+	"<a href='javascript:deleteCompany(" . $i . ")'>" . _("Delete") . "</a>");
 		end_row();
 	}
 
diff --git a/admin/inst_lang.php b/admin/inst_lang.php
index d024970f..98776618 100644
--- a/admin/inst_lang.php
+++ b/admin/inst_lang.php
@@ -1,6 +1,6 @@
 <?php
 
-$page_security = 15;
+$page_security = 20;
 $path_to_root="..";
 include_once($path_to_root . "/includes/session.inc");
 
diff --git a/admin/inst_module.php b/admin/inst_module.php
index 2dfde4b9..d0d8a366 100644
--- a/admin/inst_module.php
+++ b/admin/inst_module.php
@@ -1,6 +1,6 @@
 <?php
 
-$page_security = 15;
+$page_security = 20;
 $path_to_root="..";
 include_once($path_to_root . "/includes/session.inc");
 
diff --git a/config.php b/config.php
index a860cf82..86817e45 100644
--- a/config.php
+++ b/config.php
@@ -126,13 +126,17 @@ if (!isset($path_to_root) || isset($_GET['path_to_root']) || isset($_POST['path_
 	If the security setting of the page is contained in the security group as determined by the access level then the user will be allowed access.
 	Each page has a $page_security = x; variable
 	This value is compared to contents of the array applicable which is based on the access level of the user.
-	Access authorisation is checked in header.inc this is where _SESSION["AccessLevel"] is the index of the security_groups array. If you wish to add more security groups with then you must add a new SecurityHeading to the security_headings array
-	and a new array of Security categories to the Security Groups array
+	Access authorisation is checked in session.inc. If you wish to add more security groups 
+	with then you must add a new SecurityHeading to the security_headings array
+	and a new array of Security categories to the Security Groups _at_the_end_ of the array
 	This mechanism allows more fine grained control of access
 	security_groups is an array of arrays
 	The index is the order in which the array of allowed pages is defined new ones can be defined at will
 	or by changing the numbers in each array the security access can be tailored. These numbers need to read
 	in conjunction with the Page Security index
+	Special case is security level 20 which is reserved for admins of first
+	registered company (site admins). All potentially dangerous for whole FA 
+	site operations like installing addon modules require access level 20.
 	*/
 
 	$security_headings = array(
@@ -144,7 +148,7 @@ if (!isset($path_to_root) || isset($_GET['path_to_root']) || isset($_POST['path_
 	$security_groups = array(
 			array(1,2),
 			array(1,2,3,4,5,6,7,8,9,10,11,12,13,14,16),
-			array(1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16),
+			array(1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,20),
 	);
 
 	/*
diff --git a/includes/current_user.inc b/includes/current_user.inc
index 14faa349..7a9f1763 100644
--- a/includes/current_user.inc
+++ b/includes/current_user.inc
@@ -72,7 +72,9 @@ class current_user
 	function can_access_page($page_level)
 	{
 		global $security_groups;
-		return isset($page_level) && in_array($page_level, $security_groups[$this->access]);
+		// first registered company has site admin privileges
+		return isset($page_level) && in_array($page_level, $security_groups[$this->access])
+			&& ($this->company == 0 || $page_level != 20); 
 	}
 
 	function get_db_connection()
-- 
2.30.2