From 1671badf586f817cff93b832ee57b48b099e6c14 Mon Sep 17 00:00:00 2001
From: Cris <hainberg@technikum-wien.at>
Date: Tue, 27 Nov 2018 16:20:34 +0100
Subject: [PATCH] Moved permission check-functions to mitarbeiter.class.php

In order to avoid cross scripting problems:
MOVED functions
. check_isVorgesetzter
. check isVorgesetzter_indirekt
FROM functions.inc.php TO mitarbeiter.class.php
---
 include/functions.inc.php     | 48 ----------------------------------
 include/mitarbeiter.class.php | 49 +++++++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+), 48 deletions(-)

diff --git a/include/functions.inc.php b/include/functions.inc.php
index 913c512ac..de31314f0 100644
--- a/include/functions.inc.php
+++ b/include/functions.inc.php
@@ -1113,52 +1113,4 @@ function setLeadingZero($number, $length = 2)
 		return str_pad($number, $length, "0", STR_PAD_LEFT);
 	}
 }
-
-/** Check if uid is a supervisor
- * 
- * @param string $uid
- * @param string $employee_uid
- * @return boolean True if $uid is direct leader of $employee_uid.
- */
-function check_isVorgesetzter($uid, $employee_uid)
-{	
-	$mitarbeiter = new Mitarbeiter();
-	$mitarbeiter->getUntergebene($uid);
-	$untergebenen_arr = $mitarbeiter->untergebene;
-	
-	// Check, if uid is an employee of supervisor
-	if (!empty($untergebenen_arr) &&
-		in_array($employee_uid, $untergebenen_arr))
-	{
-		 return true;
-	}
-	else
-	{
-		return false;
-	}
-}
-/** Check if uid is a supervisor on higher oe level
- * 
- * @param string $uid
- * @param string $employee_uid
- * @return boolean True if $uid is indirect supervisor (leader on higher oe-level)
- *	of $employee_uid. 
- */
-function check_isVorgesetzter_indirekt($uid, $employee_uid)
-{
-	$mitarbeiter = new Mitarbeiter();
-	$mitarbeiter->getUntergebene($uid, true);
-	$untergebenen_ofChildOEs_arr = $mitarbeiter->untergebene;
-	
-	if (!empty($untergebenen_ofChildOEs_arr) &&
-		in_array($employee_uid, $untergebenen_ofChildOEs_arr))
-	{
-		return true;
-	}
-	else
-	{
-		return false;
-	}
-}
-
 ?>
diff --git a/include/mitarbeiter.class.php b/include/mitarbeiter.class.php
index e6e9e6506..70dff1aac 100644
--- a/include/mitarbeiter.class.php
+++ b/include/mitarbeiter.class.php
@@ -1490,6 +1490,55 @@ class mitarbeiter extends benutzer
 			return false;
 		}
 	}
+	
+	/** Check if uid is a supervisor
+ * 
+ * @param string $uid
+ * @param string $employee_uid
+ * @return boolean True if $uid is direct leader of $employee_uid.
+ */
+	function check_isVorgesetzter($uid, $employee_uid)
+	{	
+		$this->getUntergebene($uid);
+		$untergebenen_arr = $this->untergebene;
+
+		// Check, if uid is an employee of supervisor
+		if (!empty($untergebenen_arr) &&
+			in_array($employee_uid, $untergebenen_arr))
+		{
+			 return true;
+		}
+		else
+		{
+			return false;
+		}
+	}
+	/** Check if uid is a supervisor on higher oe level
+	 * 
+	 * @param string $uid
+	 * @param string $employee_uid
+	 * @return boolean True if $uid is indirect supervisor (leader on higher oe-level)
+	 *	of $employee_uid. 
+	 *	:NOTE: as all children oes also include the direct oe, the return value is also true when 
+	 *	uid is ONLY direct leader. To distinguish you might check in the calling script:
+	 *	isVorgesetzter_indirekt && isVorgesetzter --> direct leader 
+	 *	isVorgesetzter_indirekt && !isVorgesetzter --> only super leader on higher level
+	 */
+	function check_isVorgesetzter_indirekt($uid, $employee_uid)
+	{
+		$this->getUntergebene($uid, true);
+		$untergebenen_ofChildOEs_arr = $this->untergebene;
+
+		if (!empty($untergebenen_ofChildOEs_arr) &&
+			in_array($employee_uid, $untergebenen_ofChildOEs_arr))
+		{
+			return true;
+		}
+		else
+		{
+			return false;
+		}
+	}
 
 }
 ?>