From 547cb36a2331d33479c13ca58a72ebd3d2cc3416 Mon Sep 17 00:00:00 2001
From: dave <dave>
Date: Sun, 24 Jan 2010 06:47:17 +0000
Subject: [PATCH] Fix the project editor for fairs

---
 admin/project_editor.php | 32 ++++++++++++++++++++++++++++----
 1 file changed, 28 insertions(+), 4 deletions(-)

diff --git a/admin/project_editor.php b/admin/project_editor.php
index 9c3993d..995c58f 100644
--- a/admin/project_editor.php
+++ b/admin/project_editor.php
@@ -22,14 +22,38 @@
 */
 ?>
 <?
- require_once('../common.inc.php');
- require_once('../user.inc.php');
- require_once('../register_participants.inc.php');
- user_auth_required('committee', 'admin');
+require_once('../common.inc.php');
+require_once('../user.inc.php');
+require_once('../register_participants.inc.php');
+
+$auth_type = user_auth_required(array('fair','committee'), 'admin');
+
 
 $registrations_id=intval($_GET['id']);
 $action = $_GET['action'];
 
+/* Extra restrictions for auth_type = fair */
+if($auth_type == 'fair') {
+	$fairs_id = $_SESSION['fairs_id'];
+
+	if($registrations_id == -1 && ($action=='registration_load' || $action == 'registration_save')) {
+		/* we can't check the project it hasn't been created. */
+	} else {
+		/* Make sure they have permission to laod this student, check
+		the master copy of the fairs_id in the project */
+		$q=mysql_query("SELECT * FROM projects WHERE 
+				registrations_id='$registrations_id' 
+				AND year='{$config['FAIRYEAR']}'
+				AND fairs_id=$fairs_id");
+		if(mysql_num_rows($q) != 1) {
+			echo "permission denied.";
+			exit;
+		} 
+		/* Ok, they have permission */
+	}
+}
+
+
 switch($action) {
 case 'project_load':
 	project_load();