[Noalyss-commit] [noalyss] 04/24: Remove unauthorized profile

[Dany De Bontridder]

sparkyx pushed a commit to branch master
in repository noalyss.

commit be71f98aab582a151694bdebd2964131ea3bdc8a
Author: sparkyx <danydb@noalyss.eu>
AuthorDate: Tue May 3 22:40:30 2022 +0200

    Remove unauthorized profile
---
 include/profile.inc.php | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/include/profile.inc.php b/include/profile.inc.php
index f15fbcafb..736398066 100644
--- a/include/profile.inc.php
+++ b/include/profile.inc.php
@@ -34,18 +34,17 @@ if (isset($_POST['change_profile']))
         $aUserProfile=$http->post("ua_id","array",array());
         $p_id=$http->post("p_id","number");
         $aProfile=$http->post("ap_id","array",array());
-        
         for ($e=0; $e<count($aUserProfile); $e++)
         {
             if ($aUserProfile[$e]=='X'&&$aUserProfile[$e]=='')
                 continue;
-            if ($aUserProfile[$e]=='X'&&$aUserProfile[$e]!='')
+            if ($aRight[$e]=='X'&&$aUserProfile[$e]!='')
             {
                 $cn->exec_sql("delete from user_sec_action_profile where 
p_id=$1 and p_granted=$2",
                         array($p_id, $aProfile[$e]));
                 continue;
             }
-            if ($aUserProfile[$e]=="")
+            if ($aUserProfile[$e]==""&& $aRight[$e] !='X')
             {
                 $cn->exec_sql("insert into user_sec_action_profile 
(p_id,p_granted,ua_right) values($1,$2,$3)",
                         array($p_id, $aProfile[$e], $aRight[$e]));