diff --git a/controllers/app_controller.php b/controllers/app_controller.php index 90210e03..a60be457 100755 --- a/controllers/app_controller.php +++ b/controllers/app_controller.php @@ -43,6 +43,18 @@ class AppController extends Controller { } } + + function isManager() { + $currentuser = $this->getCurrentUser(); + if($currentuser['access_level'] == 'manager') { + return true; + } + else { + return false; + } + } + + /** * Read the current logged in user. * @return array - the currently logged in user. diff --git a/controllers/emails_controller.php b/controllers/emails_controller.php index 745034d4..50ac323e 100755 --- a/controllers/emails_controller.php +++ b/controllers/emails_controller.php @@ -87,19 +87,29 @@ class EmailsController extends AppController { * Fetch all the Emails that are from, to, cc a User ID * * @param $id - * @return + * @return */ function view_user_emails($id) { if(!$id) { return; } else { + + $user = $this->Email->User->find('first', array('conditions'=>array('User.id'=>$id), 'fields'=>array('User.id','User.access_level'), 'recursive'=>0)); + + if($user['User']['access_level'] == 'manager' || $user['User']['access_level'] == 'admin') { + if( (!$this->isAdmin()) && (!$this->isManager()) ) { + echo "Unable to view Emails for this User. You have insufficient privileges."; + return; + } + } + //$this->set('emails', $this->paginate()); $fromMailIDs = $this->Email->find('list', array('conditions'=>array('Email.user_id'=>$id))); $recMailIDs = $this->Email->EmailRecipient->find('list', array('conditions'=>array('EmailRecipient.user_id'=>$id), - 'fields'=>array('EmailRecipient.email_id', 'EmailRecipient.email_id'))); + 'fields'=>array('EmailRecipient.email_id', 'EmailRecipient.email_id'))); - // print_r($recMailIDs); + // print_r($recMailIDs); // print_r($fromMailIDs); $allIDs = $fromMailIDs + $recMailIDs; @@ -111,17 +121,17 @@ class EmailsController extends AppController { $this->paginate['Email'] = array( - 'conditions' => array('Email.id'=>$allIDs), - 'order'=>array('Email.udate DESC'), - 'contain' => array('EmailRecipient', 'User'), - 'limit' => 100, + 'conditions' => array('Email.id'=>$allIDs), + 'order'=>array('Email.udate DESC'), + 'contain' => array('EmailRecipient', 'User'), + 'limit' => 100, ); $userMail = $this->paginate('Email'); //$userMail = $this->Email->find('all', array('conditions'=>array('Email.id'=>$allIDs), 'order'=>array('Email.udate DESC'))); $this->set('userMail', $userMail); - + } } @@ -145,7 +155,7 @@ class EmailsController extends AppController { } - + } ?> diff --git a/controllers/users_controller.php b/controllers/users_controller.php index 110c23eb..aa6fca1d 100755 --- a/controllers/users_controller.php +++ b/controllers/users_controller.php @@ -56,6 +56,7 @@ class UsersController extends AppController { function logout() { + $this->Cookie->del('Auth.User'); $this->redirect($this->Auth->logout()); } diff --git a/views/users/view_contact.ctp b/views/users/view_contact.ctp index 4c50b9c7..2c9de117 100644 --- a/views/users/view_contact.ctp +++ b/views/users/view_contact.ctp @@ -81,5 +81,3 @@
- - \ No newline at end of file