improvements to multi user support of stations/logbooks

- Set active logbooks checks if logbook belongs to user
- Link station to logbook checks that station and logbook belong to user
- Unlink station from logbook checks that station and logbook belong to user
- Edit of logbook only shows stations of user
- Set active station checks if station belongs to user
- find_active and find_gridsquare of Stations model now check user

application/controllers/Logbooks.php

@@ -62,7 +62,7 @@ class Logbooks extends CI_Controller {
 		$data['station_locations_array'] = $this->logbooks_model->list_logbook_relationships($station_logbook_id);
 
 		$data['station_logbook_details'] = $station_logbook_details_query->row();
-		$data['station_locations_list'] = $this->stations->all();
+		$data['station_locations_list'] = $this->stations->all_of_user();
 
 		$data['station_locations_linked'] = $this->logbooks_model->list_logbooks_linked($station_logbook_id);
 		

application/models/Logbooks_model.php

@@ -47,8 +47,19 @@ class Logbooks_model extends CI_Model {
 	}
 
 	function set_logbook_active($id) {
+		// Clean input
+		$cleanId = xss_clean($id);
+
+		// be sure that logbook belongs to user
+		$this->db->where('user_id', $this->session->userdata('user_id'));
+		$this->db->where('logbook_id', $cleanId);
+		$query = $this->db->get('station_logbooks');
+		if ($query->num_rows() != 1) {
+			return;
+		}
+
 		$data = array(
-			'active_station_logbook' => xss_clean($id),
+			'active_station_logbook' => $cleanId,
 		);
 
 		$this->db->where('user_id', $this->session->userdata('user_id'));
@@ -67,10 +78,30 @@ class Logbooks_model extends CI_Model {
 
 	// Creates relationship between a logbook and a station location
 	function create_logbook_location_link($logbook_id, $location_id) {
+		// Clean ID
+		$clean_logbook_id = $this->security->xss_clean($logbook_id);
+		$clean_location_id = $this->security->xss_clean($location_id);
+
+		// be sure that logbook belongs to user
+		$this->db->where('user_id', $this->session->userdata('user_id'));
+		$this->db->where('logbook_id', $clean_logbook_id);
+		$query = $this->db->get('station_logbooks');
+		if ($query->num_rows() != 1) {
+			return;
+		}
+
+		// be sure that station belongs to user
+		$this->db->where('user_id', $this->session->userdata('user_id'));
+		$this->db->where('station_id', $clean_location_id);
+		$query = $this->db->get('station_profile');
+		if ($query->num_rows() != 1) {
+			return;
+		}
+
 		// Create data array with field values
 		$data = array(
-			'station_logbook_id' => $logbook_id,
-			'station_location_id' =>  $location_id,
+			'station_logbook_id' => $clean_logbook_id,
+			'station_location_id' =>  $clean_location_id,
 		);
 
 		// Insert Record
@@ -139,6 +170,22 @@ class Logbooks_model extends CI_Model {
 		$clean_logbook_id = $this->security->xss_clean($logbook_id);
 		$clean_station_id = $this->security->xss_clean($station_id);
 
+		// be sure that logbook belongs to user
+		$this->db->where('user_id', $this->session->userdata('user_id'));
+		$this->db->where('logbook_id', $clean_logbook_id);
+		$query = $this->db->get('station_logbooks');
+		if ($query->num_rows() != 1) {
+			return;
+		}
+
+		// be sure that station belongs to user
+		$this->db->where('user_id', $this->session->userdata('user_id'));
+		$this->db->where('station_id', $clean_station_id);
+		$query = $this->db->get('station_profile');
+		if ($query->num_rows() != 1) {
+			return;
+		}
+
 		// Delete QSOs
 		$this->db->where('station_logbook_id', $clean_logbook_id);
 		$this->db->where('station_location_id', $clean_station_id);

application/models/Stations.php

@@ -26,6 +26,11 @@ class Stations extends CI_Model {
 		return $this->db->get('station_profile');
 	}
 
+	function all_of_user() {
+		$this->db->where('user_id', $this->session->userdata('user_id'));
+		return $this->db->get('station_profile');
+	}
+
 	function profile($id) {
 		// Clean ID
 		$clean_id = $this->security->xss_clean($id);
@@ -129,16 +134,26 @@ class Stations extends CI_Model {
 	}
 
 	function set_active($current, $new) {
-
 		// Clean inputs
-
 		$clean_current = $this->security->xss_clean($current);
 		$clean_new = $this->security->xss_clean($new);
 
+		// be sure that stations belong to user
+		$this->db->where('user_id', $this->session->userdata('user_id'));
+		$this->db->where_in('station_id', array($clean_current, $clean_new));
+		$query = $this->db->get('station_profile');
+		if ($clean_current == 0 && $query->num_rows() != 1) {
+			return;
+		}
+		if ($clean_current != 0 && $query->num_rows() != 2) {
+			return;
+		}
+
 		// Deselect current default
 		$current_default = array(
 			'station_active' => null,
 		);
+		$this->db->where('user_id', $this->session->userdata('user_id'));
 		$this->db->where('station_id', $clean_current);
 		$this->db->update('station_profile', $current_default);
 
@@ -146,11 +161,13 @@ class Stations extends CI_Model {
 		$newdefault = array(
 			'station_active' => 1,
 		);
+		$this->db->where('user_id', $this->session->userdata('user_id'));
 		$this->db->where('station_id', $clean_new);
 		$this->db->update('station_profile', $newdefault);
 	}
 
 	public function find_active() {
+		$this->db->where('user_id', $this->session->userdata('user_id'));
 		$this->db->where('station_active', 1);
 		$query = $this->db->get('station_profile');
 
@@ -165,6 +182,7 @@ class Stations extends CI_Model {
 	}
 	
 	public function find_gridsquare() {
+		$this->db->where('user_id', $this->session->userdata('user_id'));
 		$this->db->where('station_active', 1);
 		$query = $this->db->get('station_profile');