From f4f6dfefcbbd6b69e5baf0c82b91bfdce7472167 Mon Sep 17 00:00:00 2001
From: jwacalex <aboehm@dompfaffenweg.de>
Date: Wed, 30 Nov 2016 15:37:59 +0100
Subject: [PATCH 1/2] fixed broken logic in controller (cf. to mail to
 @msquare)

---
 includes/controller/shift_entries_controller.php | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/includes/controller/shift_entries_controller.php b/includes/controller/shift_entries_controller.php
index 1b1a4d02..fae29875 100644
--- a/includes/controller/shift_entries_controller.php
+++ b/includes/controller/shift_entries_controller.php
@@ -36,12 +36,20 @@ function shift_entry_add_controller() {
   } else {
     $type = sql_select("SELECT * FROM `UserAngelTypes` JOIN `AngelTypes` ON (`UserAngelTypes`.`angeltype_id` = `AngelTypes`.`id`) WHERE `AngelTypes`.`id` = '" . sql_escape($type_id) . "' AND (`AngelTypes`.`restricted` = 0 OR (`UserAngelTypes`.`user_id` = '" . sql_escape($user['UID']) . "' AND NOT `UserAngelTypes`.`confirm_user_id` IS NULL)) LIMIT 1");
   }
-  
+
+
   if (count($type) == 0) {
     redirect(page_link_to('user_shifts'));
   }
   $type = $type[0];
-  
+
+  if (isset($_REQUEST['user_id']) && preg_match("/^[0-9]*$/", $_REQUEST['user_id']) &&
+      in_array('user_shifts_admin', $privileges)) {
+    $user_id = $_REQUEST['user_id'];
+  } else {
+    $user_id = $user['UID'];
+  }
+
   $shift_signup_allowed = Shift_signup_allowed(User($user_id), $shift, $type);
   if (! $shift_signup_allowed->isSignupAllowed()) {
     error(_("You are not allowed to sign up for this shift. Maybe shift is full or already running."));

From 1324260e0f43622c7c6f7170bdda702bb587df6e Mon Sep 17 00:00:00 2001
From: jwacalex <aboehm@dompfaffenweg.de>
Date: Wed, 30 Nov 2016 16:15:02 +0100
Subject: [PATCH 2/2] forgot to remove if-statement -.-

---
 includes/controller/shift_entries_controller.php | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/includes/controller/shift_entries_controller.php b/includes/controller/shift_entries_controller.php
index fae29875..adb40c58 100644
--- a/includes/controller/shift_entries_controller.php
+++ b/includes/controller/shift_entries_controller.php
@@ -59,12 +59,7 @@ function shift_entry_add_controller() {
   if (isset($_REQUEST['submit'])) {
     $selected_type_id = $type_id;
     if (in_array('user_shifts_admin', $privileges)) {
-      if (isset($_REQUEST['user_id']) && preg_match("/^[0-9]*$/", $_REQUEST['user_id'])) {
-        $user_id = $_REQUEST['user_id'];
-      } else {
-        $user_id = $user['UID'];
-      }
-      
+
       if (sql_num_query("SELECT * FROM `User` WHERE `UID`='" . sql_escape($user_id) . "' LIMIT 1") == 0) {
         redirect(page_link_to('user_shifts'));
       }
@@ -72,8 +67,6 @@ function shift_entry_add_controller() {
       if (isset($_REQUEST['angeltype_id']) && test_request_int('angeltype_id') && sql_num_query("SELECT * FROM `AngelTypes` WHERE `id`='" . sql_escape($_REQUEST['angeltype_id']) . "' LIMIT 1") > 0) {
         $selected_type_id = $_REQUEST['angeltype_id'];
       }
-    } else {
-      $user_id = $user['UID'];
     }
     
     if (sql_num_query("SELECT * FROM `ShiftEntry` WHERE `SID`='" . sql_escape($shift['SID']) . "' AND `UID` = '" . sql_escape($user_id) . "'")) {