");
-if($_SESSION['userlevel'] != '10') { echo("
You do not have then necessary permission to view this page!
"); } else {
+if($_SESSION['userlevel'] != '10') { include("includes/error-no-perm.inc.php"); } else {
if($_GET['user_id']) {
$user_data = mysql_fetch_array(mysql_query("SELECT * FROM users WHERE user_id = '" . $_GET['user_id'] . "'"));
diff --git a/html/pages/inventory.php b/html/pages/inventory.php
index 5afd767641..85b043e81e 100644
--- a/html/pages/inventory.php
+++ b/html/pages/inventory.php
@@ -82,7 +82,12 @@ if($_POST['device']) {
$where .= " AND D.device_id = '".$_POST['device']."'";
}
-$sql = "SELECT * from entPhysical AS E, devices AS D WHERE E.device_id = D.device_id $where ORDER BY D.hostname";
+if($_SESSION['userlevel'] >= '5') {
+ $sql = "SELECT * from entPhysical AS E, devices AS D WHERE E.device_id = D.device_id $where ORDER BY D.hostname";
+} else {
+ $sql = "SELECT * from entPhysical AS E, devices AS D, devices_perms AS P
+ WHERE E.device_id = D.device_id AND D.device_id = P.device_id $where ORDER BY D.hostname";
+}
$query = mysql_query($sql);
echo("
");
diff --git a/html/pages/syslog.php b/html/pages/syslog.php
index 439e34a023..50b6373064 100644
--- a/html/pages/syslog.php
+++ b/html/pages/syslog.php
@@ -70,7 +70,14 @@ if($_POST['device']) {
$where .= " AND D.device_id = '".$_POST['device']."'";
}
-$sql = "SELECT *, DATE_FORMAT(datetime, '%D %b %T') AS date from syslog AS S, devices AS D WHERE S.device_id = D.device_id $where ORDER BY datetime DESC LIMIT 1000";
+if($_SESSION['userlevel'] >= '5') {
+ $sql = "SELECT *, DATE_FORMAT(datetime, '%D %b %T') AS date from syslog AS S, devices AS D
+ WHERE S.device_id = D.device_id $where ORDER BY datetime DESC LIMIT 1000";
+} else {
+ $sql = "SELECT *, DATE_FORMAT(datetime, '%D %b %T') AS date from syslog AS S, devices AS D, devices_perms AS P
+ WHERE S.device_id = P.device_id AND P.user_id = " . $_SESSION['user_id'] . " AND S.device_id = D.device_id $where ORDER BY datetime DESC LIMIT 1000";
+}
+
$query = mysql_query($sql);
echo("");
while($entry = mysql_fetch_array($query)) { include("includes/print-syslog.inc"); }