<?
////////////////////////////////////////////////////
// Conciliación: gestión de conciliación de activos
// Version: 1.0
//
// Copyright (C) 2014  Eustotem Multimedia, S.L.
//
// License: MIT, see LICENSE
////////////////////////////////////////////////////


function checkPermissions($param,$acceso){
	$nivel=(int)$_SESSION[session_id()]['level'];
	$retorno=false;
	$acceso=(int)$acceso;
	$caso=0;
	if($acceso==1){
		return ($nivel==1) ? array(1,1,1,1,1,1) : array(0,0,0,0,0,0);
	}else if($acceso==2){
		return ($nivel==1 || $nivel==2) ? array(1,1,1,1,1,1) : array(0,0,0,0,0,0);
	}else if($acceso==3){
		if($nivel<3){
			return array(1,1,1,1,1,1);
		}else if($nivel==3){
			$cadena="SELECT v,i,e,d,dt,dp FROM " . SYS_PERMISSIONS_TABLE . " WHERE idResource='" . $param . "' AND idUser=" . $_SESSION[session_id()]['id'];
			$q=mysql_query($cadena);
			$f=mysql_fetch_array($q);
			if($f['v']==1){
				return array(1,$f['i'],$f['e'],$f['d'],$f['dt'],$f['dp']);
			}else{
				$q=mysql_query("SELECT v,i,e,d,dt,dp FROM " . SYS_PERMISSIONS_TABLE . " WHERE idResource='" . $param . "' AND idGroup=" . $_SESSION[session_id()]['grupo']);
				$ff=mysql_fetch_array($q);
				return array($ff['v'],$ff['i'],$ff['e'],$ff['d'],$ff['dt'],$ff['dp']);
			}
		}else{
			return array(0,0,0,0,0,0);
		}
	}else if($acceso==4){
		return array(1,1,1,1,1,1);
	}else{
		return array(0,0,0,0,0,0);
	}
}


if(!isset($_SESSION[session_id()]['user']) || !isset($_SESSION[session_id()]['password'])){
	header("location:../core/logout.php?a=1");		
}
if($_SESSION[session_id()]['level']!=1){
	
	$segundos=SYS_SESSION_TIMEOUT*60;
	$cadena="SELECT *, (time_to_sec(timediff(now(),last_timestamp))) AS tiempo FROM ".SYS_SESSION_TABLE." WHERE sessid='".session_id()."'";
	$q=mysql_query($cadena);
	$f=mysql_fetch_array($q) or header("location:../logout.php?a=2&lang=".$_SESSION['userlang']);		
	if($f['tiempo']>$segundos){
		header("location:../core/logout.php?a=2&lang=".$_SESSION['userlang']);		
	}
	
	if(isset($_REQUEST['resId'])){
		$check=mysql_query("SELECT access FROM " . SYS_RESOURCES_TABLE . " WHERE idResource='".$_REQUEST['resId']."'");
		$fcheck=mysql_fetch_array($check);
		$permissions=checkPermissions($_REQUEST['resId'],$fcheck['access']);
		if($permissions[0]==0){
			header("location:../core/logout.php?a=1");		
		}
	}
		
	mysql_query("UPDATE ".SYS_SESSION_TABLE." SET last_timestamp='" . date("Y-m-d H:i:s") . "' WHERE sessid='" . session_id() ."'");
	
}else if($_SESSION[session_id()]['level']==1){	
	$permissions=array(1,1,1,1,1,1);
}
?>