0 ) {
$can_view = true;
$is_my_event = true;
}
dbi_free_result ( $res );
}
if ( ($login != "__public__") && ($public_access_others == "Y") ) {
$can_view = true;
}
if ( ! $can_view ) {
$check_group = false;
// if not a participant in the event, must be allowed to look at
// other user's calendar.
if ( $login == "__public__" ) {
if ( $public_access_others == "Y" )
$check_group = true;
}
else {
if ( $allow_view_other == "Y" )
$check_group = true;
}
// If $check_group is true now, it means this user can look at the
// event only if they are in the same group as some of the people in
// the event.
// This gets kind of tricky. If there is a participant from a different
// group, do we still show it? For now, the answer is no.
// This could be configurable somehow, but how many lines of text would
// it need in the admin page to describe this scenario? Would confuse
// 99.9% of users.
// In summary, make sure at least one event participant is in one of
// this user's groups.
$my_users = get_my_users ();
if ( is_array ( $my_users ) ) {
$sql = "SELECT webcal_entry.cal_id FROM webcal_entry, " .
"webcal_entry_user WHERE webcal_entry.cal_id = " .
"webcal_entry_user.cal_id AND webcal_entry.cal_id = $id " .
"AND webcal_entry_user.cal_login IN ( ";
for ( $i = 0; $i < count ( $my_users ); $i++ ) {
if ( $i > 0 )
$sql .= ", ";
$sql .= "'" . $my_users[$i]['cal_login'] . "'";
}
$sql .= " )";
$res = dbi_query ( $sql );
if ( $res ) {
$row = dbi_fetch_row ( $res );
if ( $row && $row[0] > 0 )
$can_view = true;
dbi_free_result ( $res );
}
}
// If we didn't indicate we need to check groups, then this user
// can't view this event.
if ( ! $check_group )
$can_view = false;
}
if ( ! $can_view ) {
$error = translate ( "You are not authorized" );
}
// copied from edit_entry_handler (functions.php?)
function add_duration ( $time, $duration ) {
$hour = (int) ( $time / 10000 );
$min = ( $time / 100 ) % 100;
$minutes = $hour * 60 + $min + $duration;
$h = $minutes / 60;
$m = $minutes % 60;
$ret = sprintf ( "%d%02d00", $h, $m );
//echo "add_duration ( $time, $duration ) = $ret
";
return $ret;
}
if ( ! empty ( $year ) )
$thisyear = $year;
if ( ! empty ( $month ) )
$thismonth = $month;
$pri[1] = translate("Low");
$pri[2] = translate("Medium");
$pri[3] = translate("High");
$unapproved = FALSE;
// Make sure this is not a continuation event.
// If it is, redirect the user to the original event.
$ext_id = -1;
if ( $id > 0 ) {
$res = dbi_query ( "SELECT cal_ext_for_id FROM webcal_entry " .
"WHERE cal_id = $id" );
if ( $res ) {
if ( $row = dbi_fetch_row ( $res ) ) {
$ext_id = $row[0];
}
dbi_free_result ( $res );
} else {
// db error... ignore it, I guess.
}
}
if ( $ext_id > 0 ) {
$url = "view_entry.php?id=$ext_id";
if ( $date != "" )
$url .= "&date=$date";
if ( $user != "" )
$url .= "&user=$user";
if ( $cat_id != "" )
$url .= "&cat_id=$cat_id";
do_redirect ( $url );
}
$INC = array('js/view_entry.php');
print_header($INC);
if ( $id < 1 ) {
echo translate("Invalid entry id") . ".";
exit;
}
// Try to determine the event status.
$event_status = "";
if ( $login != $user ) {
// If viewing another user's calendar, check the status of the
// event on their calendar (to see if it's deleted).
$sql = "SELECT cal_status FROM webcal_entry_user " .
"WHERE cal_login = '$user' AND cal_id = $id";
$res = dbi_query ( $sql );
if ( $res ) {
if ( $row = dbi_fetch_row ( $res ) )
$event_status = $row[0];
dbi_free_result ( $res );
}
} else {
$sql = "SELECT cal_id, cal_status FROM webcal_entry_user " .
"WHERE cal_login = '$login' AND cal_id = $id";
$res = dbi_query ( $sql );
if ( $res ) {
$row = dbi_fetch_row ( $res );
$event_status = $row[1];
dbi_free_result ( $res );
}
}
// At this point, if we don't have the event status, then either
// this user is not viewing an event from his own calendar and not
// viewing an event from someone else's calendar.
// They probably got here from the search results page (or possibly
// by hand typing in the URL.)
// Check to make sure that it hasn't been deleted from everyone's
// calendar.
if ( empty ( $event_status ) ) {
$sql = "SELECT cal_status FROM webcal_entry_user " .
"WHERE cal_status != 'D' ORDER BY cal_status";
$res = dbi_query ( $sql );
if ( $res ) {
if ( $row = dbi_fetch_row ( $res ) )
$event_status = $row[0];
dbi_free_result ( $res );
}
}
// If we have no event status yet, it must have been deleted.
if ( ( empty ( $event_status ) && ! $is_admin ) || ! $can_view ) {
echo "" . translate("Error") .
"
" . translate("You are not authorized") . ".\n";
print_trailer ();
echo "