From 5c83b3f521747402468e75025db44fce0c4af996 Mon Sep 17 00:00:00 2001
From: Geert Hauwaerts <geert@localhost>
Date: Thu, 17 Mar 2011 21:02:28 +0000
Subject: [PATCH] - User with restricted privileges will see only Locations
 where they have any access on. Other locations will be filtered from the
 lists.

git-svn-id: http://www.observium.org/svn/observer/trunk@1916 61d68cd4-352d-0410-923a-c4978735b2b8
---
 html/includes/print-menubar.php | 6 +++++-
 html/pages/devices.inc.php      | 8 +++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/html/includes/print-menubar.php b/html/includes/print-menubar.php
index 8303df7a64..daf0af8b92 100644
--- a/html/includes/print-menubar.php
+++ b/html/includes/print-menubar.php
@@ -104,7 +104,11 @@ if ($_SESSION['userlevel'] >= '10') {
 ## Display Locations entry if $config['show_locations']
 if ($config['show_locations'])
 {
-  $locations = mysql_query("SELECT DISTINCT location FROM devices ORDER BY location");
+	if($_SESSION['userlevel'] >= '5') {
+		$locations = mysql_query("SELECT DISTINCT location FROM devices GROUP BY location ORDER BY location");
+	} else {
+		$locations = mysql_query("SELECT DISTINCT location FROM devices AS D, devices_perms AS P WHERE D.device_id = P.device_id AND P.user_id = '" . $_SESSION['user_id'] . "' GROUP BY location ORDER BY location");
+	}
 ?>
 <li><a class="menu2four" href="locations/"><img src="images/16/building.png" border="0" align="absmiddle" /> Locations</a>
 <?php
diff --git a/html/pages/devices.inc.php b/html/pages/devices.inc.php
index b2ef8c15bd..142ae6ed99 100644
--- a/html/pages/devices.inc.php
+++ b/html/pages/devices.inc.php
@@ -89,7 +89,13 @@ print_optionbar_start(62);
         <select name="location" id="location">
           <option value="">All Locations</option>
           <?php
-            $query = mysql_query("SELECT `location` FROM `devices` WHERE 1 $where GROUP BY `location` ORDER BY `location`");
+
+		if($_SESSION['userlevel'] >= '5') {
+			$query = mysql_query("SELECT location FROM devices WHERE 1 $where GROUP BY location ORDER BY location");
+		} else {
+			$query = mysql_query("SELECT location FROM devices AS D, devices_perms AS P WHERE  1 $where AND D.device_id = P.device_id AND P.user_id = '" . $_SESSION['user_id'] . "' GROUP BY location ORDER BY location");
+		}
+
             while ($data = mysql_fetch_array($query))
             {
               if ($data['location'])