librenms/html/pages/deluser.php
Adam Amstrong a0153126f1 security fixes to non-global users
git-svn-id: http://www.observium.org/svn/observer/trunk@455 61d68cd4-352d-0410-923a-c4978735b2b8
2009-08-12 15:20:20 +00:00

42 lines
1.3 KiB
PHP

<?php
echo("<div style='margin: 10px;'>");
if($_SESSION['userlevel'] != '10') { include("includes/error-no-perm.inc.php"); } else {
echo("<h3>Delete User</h3>");
if($_GET['action'] == "del") {
$delete_username = mysql_result(mysql_query("SELECT username FROM users WHERE user_id = '" . mres($_GET['user_id']) . "'"),0);
if($_GET['confirm'] == "yes") {
mysql_query("DELETE FROM `devices_perms` WHERE `user_id` = '" . mres($_GET['user_id']) . "'");
mysql_query("DELETE FROM `users` WHERE `user_id` = '" . mres($_GET['user_id']) . "'");
if(mysql_affected_rows()) { echo("<span class=info>User '$delete_username' deleted!</span>"); }
} else {
echo("<span class=alert>You have requested deletion of the user '$delete_username'. This action can not be reversed.<br /><a href='?page=deluser&action=del&user_id=" . $_GET['user_id'] . "&confirm=yes'>Click to confirm</a></span>");
}
}
$userlist = mysql_query("SELECT * FROM `users`");
while($userentry = mysql_fetch_array($userlist)) {
$i++;
echo($i . ". " . $userentry['username'] . "
<a href='?page=deluser&action=del&user_id=" . $userentry['user_id'] . "'><img src='images/16/cross.png' align=absmiddle border=0></a><br/>");
}
}
echo("</div>");
?>