From 049eb581d3169f87b167bb99de5ed3af1c7bcab3 Mon Sep 17 00:00:00 2001
From: Ted Trask <ttrask01@yahoo.com>
Date: Fri, 9 Sep 2011 20:49:31 +0000
Subject: Check permissions before displaying download buttons

---
 weblog-adhocquery-html.lsp | 2 ++
 weblog-viewweblog-html.lsp | 6 +++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/weblog-adhocquery-html.lsp b/weblog-adhocquery-html.lsp
index 69feb37..2923005 100644
--- a/weblog-adhocquery-html.lsp
+++ b/weblog-adhocquery-html.lsp
@@ -33,12 +33,14 @@ require("viewfunctions")
 		<% end %>
 		</TABLE>
 
+		<% if viewlibrary.check_permission("downloadadhocquery") then %>
 		<form action="/cgi-bin/acf/weblog/weblog/downloadadhocquery" method="POST">
 		<input class="hidden" type="hidden"  name="query"  value="<%= html.html_escape(form.value.query.value) %>" >
 		<DL>
 		<DT>Download query result</DT><DD><input class="submit" type="submit" name="Download" value="Download"></DD>
 		</DL>
 		</FORM>
+		<% end %>
 	<% end %>
 <% end %>
 
diff --git a/weblog-viewweblog-html.lsp b/weblog-viewweblog-html.lsp
index fe1f74d..4df704e 100644
--- a/weblog-viewweblog-html.lsp
+++ b/weblog-viewweblog-html.lsp
@@ -268,8 +268,8 @@ end %>
 <% if #data.value.log.value == 0 then %>
 <p>No results, try adjusting search parameters</p>
 <% end %>
-<DT>Download Options</DT>
-<% if page_info.action == "viewweblog" then %>
+
+<% if viewlibrary.check_permission("downloadweblog") then %>
 <form action="<%= html.html_escape(page_info.script .. page_info.prefix .. page_info.controller .. "/downloadweblog") %>" method="POST">
 <input type="hidden"  name="activelog" value="<%= html.html_escape(data.value.activelog.value) %>" >
 <input type="hidden"  name="starttime" value="<%= html.html_escape(data.value.starttime.value) %>" >
@@ -283,7 +283,7 @@ end %>
 <input type="hidden"  name="sortby" value="<%= html.html_escape(data.value.sortby.value) %>" >
 <input type="hidden"  name="urisearch" value="<%= html.html_escape(data.value.urisearch.value) %>" >
 <input type="hidden"  name="selected" value="<%= html.html_escape(data.value.selected.value) %>" >
-<DD><input class="submit" type="submit" name="Download" value="Export List"></DD>
+<DT>Download log</DT><DD><input class="submit" type="submit" name="Download" value="Download"></DD>
 </form>
 <% end %>
 </DL>
-- 
cgit v1.2.3