diff --git a/adm/sms_admin/ajax.hp_chk.php b/adm/sms_admin/ajax.hp_chk.php index b0b29ac3d..8fe487d00 100644 --- a/adm/sms_admin/ajax.hp_chk.php +++ b/adm/sms_admin/ajax.hp_chk.php @@ -10,7 +10,9 @@ if( !function_exists('json_encode') ) { } } -auth_check($auth[$sub_menu], "r"); +if( $auth_check = ajax_auth_check($auth[$sub_menu], "r") ){ + die("{\"error\":\"$auth_check\"}"); +} $err = ''; $arr_ajax_msg = array(); diff --git a/adm/sms_admin/ajax.sms_write_form.php b/adm/sms_admin/ajax.sms_write_form.php index 9a7988129..740ca3c46 100644 --- a/adm/sms_admin/ajax.sms_write_form.php +++ b/adm/sms_admin/ajax.sms_write_form.php @@ -10,9 +10,11 @@ if( !function_exists('json_encode') ) { } } -$page_size = 6; +if( $auth_check = ajax_auth_check($auth[$sub_menu], "r") ){ + die("{\"error\":\"$auth_check\"}"); +} -auth_check($auth[$sub_menu], "r"); +$page_size = 6; if (!$page) $page = 1; diff --git a/adm/sms_admin/ajax.sms_write_level.php b/adm/sms_admin/ajax.sms_write_level.php index a298b113f..d5521efcc 100644 --- a/adm/sms_admin/ajax.sms_write_level.php +++ b/adm/sms_admin/ajax.sms_write_level.php @@ -10,7 +10,9 @@ if( !function_exists('json_encode') ) { } } -auth_check($auth[$sub_menu], "r"); +if( $auth_check = ajax_auth_check($auth[$sub_menu], "r") ){ + die("{\"error\":\"$auth_check\"}"); +} $lev = array(); diff --git a/adm/sms_admin/ajax.sms_write_person.php b/adm/sms_admin/ajax.sms_write_person.php index 686f4a8fa..57c76d126 100644 --- a/adm/sms_admin/ajax.sms_write_person.php +++ b/adm/sms_admin/ajax.sms_write_person.php @@ -5,7 +5,9 @@ include_once("./_common.php"); $page_size = 10; $colspan = 5; -auth_check($auth[$sub_menu], "r"); +if( $auth_check = ajax_auth_check($auth[$sub_menu], "r") ){ + die("{\"error\":\"$auth_check\"}"); +} $g5['title'] = "휴대폰번호 관리"; diff --git a/plugin/sms5/sms5.lib.php b/plugin/sms5/sms5.lib.php index 7db95a0f6..5185bbb14 100644 --- a/plugin/sms5/sms5.lib.php +++ b/plugin/sms5/sms5.lib.php @@ -60,6 +60,30 @@ function sms5_sub_paging($write_pages, $cur_page, $total_page, $url, $add="", $s return ""; } +// 권한 검사 +function ajax_auth_check($auth, $attr) +{ + global $is_admin; + + if ($is_admin == 'super') return; + + if (!trim($auth)) + return '이 메뉴에는 접근 권한이 없습니다.\\n\\n접근 권한은 최고관리자만 부여할 수 있습니다.'; + + $attr = strtolower($attr); + + if (!strstr($auth, $attr)) { + if ($attr == 'r') + return '읽을 권한이 없습니다.'; + else if ($attr == 'w') + return '입력, 추가, 생성, 수정 권한이 없습니다.'; + else if ($attr == 'd') + return '삭제 권한이 없습니다.'; + else + return '속성이 잘못 되었습니다.'; + } +} + if ( ! function_exists('array_overlap')) { function array_overlap($arr, $val) { for ($i=0, $m=count($arr); $i<$m; $i++) {