rights fix

Author: skerbis

fragments/forcal_entries_filter.php

@@ -28,13 +28,27 @@
 // Gespeicherte Filter laden
 $savedFilters = forcalFilterService::getUserFilters($userId);
 
+// Benutzer-Kategorien für nicht-Admins vorbereiten
+$user_categories = [];
+if (!$user->isAdmin()) {
+    $user_categories = forCalUserPermission::getUserCategories($userId);
+}
+
 // Standard-Filter laden, falls kein Filter aktiv ist
 $defaultFilter = null;
 if (empty($currentCategory) && empty($currentVenue) && empty($currentStatus) && empty($currentSearch) && empty($currentCreator) && empty($currentDateFrom)) {
     $defaultFilter = forcalFilterService::getDefaultFilter($userId);
     if ($defaultFilter) {
         $filterData = $defaultFilter['filter_data'];
+        
+        // Sicherheitsprüfung: Kategorie-Zugriff für nicht-Admins
         $currentCategory = $filterData['category'] ?? null;
+        if ($currentCategory && !$user->isAdmin()) {
+            if (!in_array($currentCategory, $user_categories)) {
+                $currentCategory = null; // Kategorie nicht mehr erlaubt
+            }
+        }
+        
         $currentVenue = $filterData['venue'] ?? null;
         $currentStatus = $filterData['status'] ?? null;
         $currentSearch = $filterData['search'] ?? '';
@@ -60,6 +74,13 @@
     if ($loadedFilter) {
         $filterData = $loadedFilter['filter_data'];
 
+        // Sicherheitsprüfung: Kategorie-Zugriff für nicht-Admins
+        if (isset($filterData['category']) && $filterData['category'] && !$user->isAdmin()) {
+            if (!in_array($filterData['category'], $user_categories)) {
+                unset($filterData['category']); // Kategorie nicht mehr erlaubt
+            }
+        }
+        
         // Sortierung wiederherstellen
         if (isset($filterData['sort']) && !empty($filterData['sort'])) {
             rex_set_session('rex_list_' . $tableEvent . '_sort', $filterData['sort']);
@@ -118,13 +139,17 @@
      ORDER BY name_' . rex_clang::getCurrentId()
 );
 
-// Venues laden
-$all_venues = rex_sql::factory()->getArray(
-    'SELECT id, name_' . rex_clang::getCurrentId() . ' as name 
-     FROM ' . rex::getTable('forcal_venues') . ' 
-     WHERE status = 1 
-     ORDER BY name_' . rex_clang::getCurrentId()
-);
+// Venues laden (nur wenn aktiviert)
+$all_venues = [];
+$venuesEnabled = $addon->getConfig('forcal_venues_enabled', true);
+if ($venuesEnabled) {
+    $all_venues = rex_sql::factory()->getArray(
+        'SELECT id, name_' . rex_clang::getCurrentId() . ' as name 
+         FROM ' . rex::getTable('forcal_venues') . ' 
+         WHERE status = 1 
+         ORDER BY name_' . rex_clang::getCurrentId()
+    );
+}
 
 // Benutzer laden (für Ersteller-Filter)
 $creators = rex_sql::factory()->getArray(
@@ -134,12 +159,6 @@
      ORDER BY u.name'
 );
 
-// Benutzer-Kategorien für nicht-Admins
-$user_categories = [];
-if (!$user->isAdmin()) {
-    $user_categories = forCalUserPermission::getUserCategories($userId);
-}
-
 // Aktuelle URL ohne Filter-Parameter
 $baseUrl = rex_url::currentBackendPage();
 $currentParams = [];
@@ -237,6 +256,7 @@ class="btn btn-default <?= $filter['is_default'] ? 'btn-info' : '' ?>"
                         </div>
                     </div>
 
+                    <?php if ($venuesEnabled): ?>
                     <div class="col-sm-2">
                         <div class="form-group" style="margin-bottom: 10px;">
                             <select name="venue_filter" class="form-control input-sm selectpicker" data-live-search="true" data-size="8">
@@ -249,6 +269,7 @@ class="btn btn-default <?= $filter['is_default'] ? 'btn-info' : '' ?>"
                             </select>
                         </div>
                     </div>
+                    <?php endif; ?>
 
                     <div class="col-sm-2">
                         <div class="form-group" style="margin-bottom: 10px;">