Adicionar org_id para buscar apenas da uma empresa. SQL com permissões

admin/queues.php

@@ -1,15 +1,16 @@
 <?php
 //include dos arquivos padrões do sistema
 $acao = isset($_REQUEST['acao']) ? trim($_REQUEST['acao']) : 'select';
-$id = isset($_REQUEST['id']) ? trim($_REQUEST['id']) : 0;
+$id = isset($_REQUEST['id']) ? trim(intval($_REQUEST['id'])) : 0;
 $filtro = isset($_REQUEST["numRamal"]) ? trim($_REQUEST["numRamal"]) : '';
 $filtroNovo = !isset($_REQUEST["pgn"]) ? '' : sprintf("&numRamal%s&pgn=%s&bloco=%s&pg=%s&status=%s", $_REQUEST["numRamal"], $_REQUEST["pgn"], $_REQUEST["bloco"], $_REQUEST["pg"], $_REQUEST["status"]);
 $recontaPag = ($acao == 'inseri') || ($acao == "deleta") || isset($_REQUEST['pesquisa']);
 $org_id = GetOrganizacao();
 $status = isset($_REQUEST["status"]) ? trim($_REQUEST["status"]) : 'A';
+$matricula = GetMatricula();
 
 if ($acao == "deleta") {
-    $query = "SELECT numero, nome FROM pbx_queues_grupos WHERE id=$id";
+    $query = "SELECT numero, nome FROM pbx_queues_grupos WHERE id=$id and org_id = $org_id";
     $result = pg_query($dbcon, $query);
 
     if ($dados = pg_fetch_array($result)) {
@@ -18,19 +19,19 @@ if ($acao == "deleta") {
     }
 
     //Remove o dac da interface de supervisao
-    $query = "UPDATE pbx_queues_grupos set status='I', opcao = null, acao = null, context = null where id='$id'";
+    $query = "UPDATE pbx_queues_grupos set status='I', opcao = null, acao = null, context = null where id='$id' and org_id = $org_id";
     pg_query($dbcon, $query);
 
-    $query = "DELETE FROM pbx_supervisor_dacs WHERE trim(dac) = trim((select nome from pbx_dacs where id = '$id'))";
+    $query = "DELETE FROM pbx_supervisor_dacs WHERE trim(dac) = trim((select nome from pbx_dacs where id = '$id' and org_id = $org_id";
     pg_query($dbcon, $query);
 
-    $query = "DELETE FROM pbx_fila_audios WHERE id = '$id' ";
+    $query = "DELETE FROM pbx_fila_audios WHERE id = '$id' and org_id = $org_id";
     pg_query($dbcon, $query);
 
-    $query = "DELETE FROM pbx_queues_membros WHERE id_fila = '$id'";
+    $query = "DELETE FROM pbx_queues_membros WHERE id_fila = '$id' and org_id = $org_id";
     pg_query($dbcon, $query);
 
-    $query = "DELETE FROM  pbx_prioridades_atendimento WHERE dac =  '$nomeFila'";
+    $query = "DELETE FROM  pbx_prioridades_atendimento WHERE dac =  '$nomeFila' and org_id = $org_id";
     pg_query($dbcon, $query);
 
     //    //gera arquivos e executa o reload dos dados no asterisk
@@ -99,14 +100,53 @@ if ($acao == "deleta") {
 
                 $statuSql = "";
                 if ($status == 'A') {
-                    $statuSql = " and status = 'A'";
-                } else if ($status == 'I') {
-                    $statuSql = " and status = 'I'";
+                    $statuSql = " and a.status = 'A'";
+                } else {
+                    $statuSql = " and a.status = 'I'";
                 }
 
-                $compl .= " and org_id = {$org_id} ";
+                $compl .= " and a.org_id = {$org_id} ";
+
+                /* WITH cria verdedaireo se tem matricula true para admin no pbx_usuarios 
+                 * a tabela do with é testada se for true sempre da verdadeiro a todos os INNER JOIN
+                 * 
+                 * 1 = 1 = Serve para não testar se é a primeira sobre AND
+                 */
+                $query = "WITH admin_check AS (
+                    SELECT
+                        CASE
+                            WHEN EXISTS (
+                                SELECT 1
+                                FROM pbx_usuarios
+                                WHERE matricula = '$matricula' AND admin = TRUE
+                            ) THEN TRUE
+                            ELSE FALSE
+                        END AS is_admin
+                )
+                SELECT DISTINCT ON (a.id)
+                    a.id,
+                    a.nome,
+                    a.numero,
+                    a.strategy,
+                    a.timeout2,
+                    a.status
+                FROM
+                    pbx_queues_grupos a
+                INNER JOIN pbx_fila_grupos pfg ON
+                    ((SELECT is_admin FROM admin_check) OR pfg.id = a.id)
+                    AND pfg.org_id = a.org_id
+                INNER JOIN pbx_grupo_usuario pgu ON
+                    ((SELECT is_admin FROM admin_check) OR pgu.gp_id = pfg.gp_id)
+                    AND pgu.org_id = pfg.org_id
+                INNER JOIN pbx_usuarios pu ON
+                    ((pu.id = pgu.user_id AND pu.matricula = '$matricula') OR (SELECT is_admin FROM admin_check))
+                WHERE
+                    1 = 1
+                    $statuSql
+                    $compl
+                ORDER BY
+                    id ASC";
 
-                $query = "SELECT id, nome, numero, strategy, timeout2, status FROM pbx_queues_grupos a where 1=1 $statuSql $compl order by id asc";
                 $params = "&pbxRequest=1&numRamal=$filtro&status=$status";
                 $links = PaginaDados($idProg, $query, $params, $regPagina, $offSet, $pagMostra, true);
                 $query .= " limit $regPagina offset $offSet";
@@ -130,7 +170,7 @@ if ($acao == "deleta") {
                                 <?= GravaNomeOrganizacao($dados['nome']); ?>
                             </a>
                         </td>
-                        <td width="120"><?php echo RemoveOrganizacaoStr($dados['numero']); ?></td>
+                        <td width="120"><?php echo $dados['numero']; ?></td>
                         <td width="250"><?php echo $strategia[$dados['strategy']]; ?></td>
                         <td width="80"><?php echo $dados['timeout2']; ?></td>
                         <td width="30" align="center"><?php echo $dep; ?></td>