From 4112b5fe09907eded68a7ed72ac3a68a19b6f627 Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Wed, 19 Nov 2014 09:56:51 -0800
Subject: [PATCH] Fix queries and make sure we have a session

---
 website/auth.php                |  1 +
 website/internals.php           |  1 +
 website/overview/data-suite.php |  2 +-
 website/overview/data.php       | 10 ++++++++++
 4 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/website/auth.php b/website/auth.php
index 8a20531..3121450 100644
--- a/website/auth.php
+++ b/website/auth.php
@@ -1,4 +1,5 @@
 <?php
+session_start();
 
 // Demo site using Auth_BrowserID for authentication
 
diff --git a/website/internals.php b/website/internals.php
index d3c8002..e206167 100755
--- a/website/internals.php
+++ b/website/internals.php
@@ -3,6 +3,7 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+session_start();
 
 function init_database()
 {
diff --git a/website/overview/data-suite.php b/website/overview/data-suite.php
index 109e73f..1cb90aa 100644
--- a/website/overview/data-suite.php
+++ b/website/overview/data-suite.php
@@ -26,7 +26,7 @@ $overview["stamp"] = $row[1];
 $overview["suiteVersion"] = $suiteVersion;
 
 if (!has_permissions()) {
-	$query = "SELECT id FROM `awfy_suite`
+	$query = "SELECT awfy_suite.id FROM `awfy_suite`
               LEFT JOIN awfy_suite_version on suite_id = awfy_suite.id
               WHERE awfy_suite_version.id = $suiteVersion AND
 				    visible = 1
diff --git a/website/overview/data.php b/website/overview/data.php
index c05a60c..c526aa7 100644
--- a/website/overview/data.php
+++ b/website/overview/data.php
@@ -46,6 +46,16 @@ if (!$results || mysql_num_rows($results) < 1)
     die();
 $suiteIds = Array();
 while($row = mysql_fetch_array($results)) {
+	if (!has_permissions()) {
+		$query = "SELECT awfy_suite.id FROM `awfy_suite`
+				  LEFT JOIN awfy_suite_version on suite_id = awfy_suite.id
+				  WHERE awfy_suite_version.id = ".$row[0]." AND
+						awfy_suite.visible = 1
+				  LIMIT 1";
+		$perm = mysql_query($query);
+		if (!$perm || mysql_num_rows($perm) != 1)
+			continue;
+	}
     $suiteIds[] = $row[0];
 }