From 11fca58ec0bdbcf54298d1185805c5a02ce7cce8 Mon Sep 17 00:00:00 2001
From: mattf <mattf@3d104415-ff17-0410-8863-d5cf3c621b8a>
Date: Sat, 24 Mar 2018 13:48:56 +0000
Subject: [PATCH] Enforce User Group campaign permissions for lead loading
 templates based on list_id

git-svn-id: svn://192.168.202.10@2951 3d104415-ff17-0410-8863-d5cf3c621b8a
---
 agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php  | 9 +++++----
 .../trunk/www/vicidial/admin_listloader_fourth_gen.php   | 9 +++++----
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php b/agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php
index 1b946aef..8cc3701f 100644
--- a/agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php
+++ b/agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php
@@ -1,7 +1,7 @@
 <?php
 # AST_admin_template_maker.php - version 2.10
 # 
-# Copyright (C) 2017  Matt Florell,Joe Johnson <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2018  Matt Florell,Joe Johnson <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 120402-2132 - First Build
@@ -14,6 +14,7 @@
 # 141114-0912 - Finalized adding QXZ translation to all admin files
 # 141229-2024 - Added code for on-the-fly language translations display
 # 170409-1532 - Added IP List validation code
+# 180324-0942 - Enforce User Group campaign permissions for templates based on list_id
 #
 
 require("dbconnect_mysqli.php");
@@ -210,10 +211,10 @@ $LOGallowed_campaignsSQL='';
 $whereLOGallowed_campaignsSQL='';
 if (!preg_match('/\-ALL/i', $LOGallowed_campaigns))
 	{
-	echo "<BR/>**$LOGallowed_campaigns**";
+#	echo "<BR/>**$LOGallowed_campaigns**";
 	$rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns);
 	$rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL);
-	echo "<BR/>##$rawLOGallowed_campaignsSQL##";
+#	echo "<BR/>##$rawLOGallowed_campaignsSQL##";
 	$LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')";
 	$whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')";
 	}
@@ -416,7 +417,7 @@ if ($success_msg)
 		</td>
 		<td align="left" width='50%'><form action="<?php echo $PHP_SELF; ?>" method="post"><font class="standard"><?php echo _QXZ("Select template to delete"); ?>:</font><?php echo "$NWB#template_maker-delete_template$NWE"; ?><BR><select name="template_id" onChange="loadIFrame('hide_new_template_form', '')">
 <?php
-$template_stmt="select template_id, template_name from vicidial_custom_leadloader_templates order by template_id asc";
+$template_stmt="SELECT template_id, template_name FROM vicidial_custom_leadloader_templates WHERE list_id IN (SELECT list_id FROM vicidial_lists $whereLOGallowed_campaignsSQL) ORDER BY template_id asc;";
 $template_rslt=mysql_to_mysqli($template_stmt, $link);
 if (mysqli_num_rows($template_rslt)>0) {
 	if ($update_template) {echo "<option value='$update_template' selected>$update_template</option>\n";} else {echo "<option value='' selected>--"._QXZ("Choose an existing template")."--</option>\n";}
diff --git a/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php b/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php
index f9fb5c77..f595dd13 100644
--- a/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php
+++ b/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php
@@ -2,7 +2,7 @@
 # admin_listloader_fourth_gen.php - version 2.14
 #  (based upon - new_listloader_superL.php script)
 # 
-# Copyright (C) 2017  Matt Florell,Joe Johnson <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2018  Matt Florell,Joe Johnson <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # ViciDial web-based lead loader from formatted file
 # 
@@ -72,10 +72,11 @@
 # 170409-1553 - Added IP List validation code
 # 171001-0908 - Fixed issue #1041
 # 171204-1517 - Fix for custom field duplicate issue, removed link to old lead loader
+# 180324-0943 - Enforce User Group campaign permissions for templates based on list_id
 #
 
-$version = '2.14-70';
-$build = '171204-1517';
+$version = '2.14-71';
+$build = '180324-0943';
 
 require("dbconnect_mysqli.php");
 require("functions.php");
@@ -681,7 +682,7 @@ if ( (!$OK_to_process) or ( ($leadfile) and ($file_layout!="standard" && $file_l
 			<td align=right width="20%"><font face="arial, helvetica" size=2><?php echo _QXZ("Custom Layout to Use"); ?>: </font></td>
 			<td align=left><select name="template_id" id="template_id">
 <?php
-				$template_stmt="SELECT template_id, template_name from vicidial_custom_leadloader_templates order by template_id asc";
+				$template_stmt="SELECT template_id, template_name FROM vicidial_custom_leadloader_templates WHERE list_id IN (SELECT list_id FROM vicidial_lists $whereLOGallowed_campaignsSQL) ORDER BY template_id asc;";
 				$template_rslt=mysql_to_mysqli($template_stmt, $link);
 				if (mysqli_num_rows($template_rslt)>0) {
 					echo "<option value='' selected>--"._QXZ("Select custom template")."--</option>";