Default security requests to bog

[hcoop/portal.git] / group.sml

diff --git a/group.sml b/group.sml
index fc72152..75f412a 100644 (file)
--- a/group.sml
+++ b/group.sml
@@ -73,6 +73,18 @@ fun userInGroupName (usr, grp) =
           | _ => false)
     end
 
+fun userReallyInGroupName (usr, grp) =
+    let
+       val c = getDb ()
+    in
+       (case C.oneOrNoRows c ($`SELECT COUNT( * )
+                                   FROM Membership, WebGroup
+                                   WHERE (name = ^(C.stringToSql grp) AND grp = id)
+                                      AND usr = ^(C.intToSql usr)`) of
+            SOME[x] => not (C.isNull x) andalso C.intFromSql x <> 0
+          | _ => false)
+    end
+
 
 (* Managing group memberships *)
 
@@ -107,16 +119,18 @@ fun mkMembershipRow [grp, usr] =
   | mkMembershipRow row = Init.rowError ("membership", row)
 
 fun groupMembers grp =
-    C.map (getDb ()) mkUserRow ($`SELECT id, name, rname, bal, joined, app, shares FROM Membership, WebUser
-                                       WHERE grp = ^(C.intToSql grp)
-                                          AND usr = id
-                                       ORDER BY name`)
+    C.map (getDb ()) mkUserRow ($`SELECT id, name, rname, bal, joined, app, shares, paypal, checkout
+                                 FROM Membership, WebUser
+                                 WHERE grp = ^(C.intToSql grp)
+                                   AND usr = id
+                                 ORDER BY name`)
 
 
 (* Checking memberships of the current user *)
 
 fun inGroupNum grp = userInGroupNum (getUserId(), grp)
 fun inGroupName grp = userInGroupName (getUserId(), grp)
+fun reallyInGroupName grp = userReallyInGroupName (getUserId(), grp)
 
 fun requireGroupNum grp =
     if inGroupNum grp then
@@ -132,7 +146,7 @@ fun requireGroupName grp =
 
 fun validGroupName name =
     size name <= 10
-    andalso CharVector.all Char.isAlpha name
+    andalso CharVector.all Char.isAlphaNum name
 
 fun groupNameToId name =
     case C.oneOrNoRows (getDb ()) ($`SELECT id FROM WebGroup WHERE name = ^(C.stringToSql name)`) of