- improvements in permissions (Artem)

git-svn-id: svn://svn.zabbix.com/trunk@5577 97f52cf1-0a1b-0410-bd0e-c28be96e8082

13 files changed, 312 insertions, 286 deletions

diff --git a/frontends/php/chart2.php b/frontends/php/chart2.php
index 048e6c55..d1613ca3 100644
--- a/frontends/php/chart2.php
+++ b/frontends/php/chart2.php
@@ -45,25 +45,25 @@ include_once 'include/page_header.php';
 	check_fields($fields);
 ?>
 <?php
-	if(! (DBfetch(DBselect('select graphid from graphs where graphid='.$_REQUEST['graphid']))) )
-	{
+	if(!DBfetch(DBselect('SELECT graphid FROM graphs WHERE graphid='.$_REQUEST['graphid']))){
 		show_error_message(S_NO_GRAPH_DEFINED);
-
 	}
 
-	$denyed_hosts = get_accessible_hosts_by_user($USER_DETAILS, PERM_READ_ONLY, PERM_MODE_LT);
+	$available_hosts = get_accessible_hosts_by_user($USER_DETAILS, PERM_READ_ONLY);
 	
-	if( !($db_data = DBfetch(DBselect('SELECT g.*,h.host,h.hostid '.
-					' FROM graphs as g '.
-						' LEFT JOIN graphs_items as gi ON g.graphid=gi.graphid '.
-						' LEFT JOIN items as i ON gi.itemid=i.itemid '.
-						' LEFT JOIN hosts as h ON i.hostid=h.hostid '.
-					' WHERE g.graphid='.$_REQUEST['graphid'].
-						' AND ( h.hostid not in ('.$denyed_hosts.') '.
-						' OR h.hostid is NULL) '))))
-	{
+	if(!graph_accessible($_REQUEST['graphid'])){
 		access_deny();
 	}
+
+	$sql = 'SELECT g.*,h.host,h.hostid '.
+				' FROM graphs as g '.
+					' LEFT JOIN graphs_items as gi ON g.graphid=gi.graphid '.
+					' LEFT JOIN items as i ON gi.itemid=i.itemid '.
+					' LEFT JOIN hosts as h ON i.hostid=h.hostid '.
+				' WHERE g.graphid='.$_REQUEST['graphid'].
+					' AND h.hostid IN ('.$available_hosts.') ';
+					
+	$db_data = DBfetch(DBselect($sql));
 	
 	$graph = new Chart($db_data['graphtype']);
 
@@ -89,9 +89,10 @@ include_once 'include/page_header.php';
 	$graph->SetYAxisMin($db_data['yaxismin']);
 	$graph->SetYAxisMax($db_data['yaxismax']);
 
-	$result = DBselect('SELECT gi.* FROM graphs_items gi '.
+	$result = DBselect('SELECT gi.* '.
+		' FROM graphs_items gi '.
 		' WHERE gi.graphid='.$db_data['graphid'].
-		' order by gi.sortorder, gi.itemid desc');
+		' ORDER BY gi.sortorder, gi.itemid DESC');
 
 	while($db_data=DBfetch($result))
 	{
diff --git a/frontends/php/chart3.php b/frontends/php/chart3.php
index 54d69938..f75737cb 100644
--- a/frontends/php/chart3.php
+++ b/frontends/php/chart3.php
@@ -51,20 +51,16 @@ include_once "include/page_header.php";
 	check_fields($fields);
 ?>
 <?php
-	$denyed_hosts = get_accessible_hosts_by_user($USER_DETAILS, PERM_READ_ONLY, PERM_MODE_LT, PERM_RES_IDS_ARRAY);
+	$available_hosts = get_accessible_hosts_by_user($USER_DETAILS, PERM_READ_ONLY, null, PERM_RES_IDS_ARRAY);
 	
 	$items = get_request('items', array());
-
 	asort_by_key($items, 'sortorder');
 
-	foreach($items as $gitem)
-	{
-		if( !($host = DBfetch(DBselect('select h.* from hosts h,items i where h.hostid=i.hostid and i.itemid='.$gitem['itemid']))) )
-		{
+	foreach($items as $gitem){
+		if(!$host = DBfetch(DBselect('select h.* from hosts h,items i where h.hostid=i.hostid and i.itemid='.$gitem['itemid']))){
 			fatal_error(S_NO_ITEM_DEFINED);
 		}
-		if(uint_in_array($host['hostid'], $denyed_hosts))
-		{
+		if(!uint_in_array($host['hostid'], $available_hosts)){
 			access_deny();
 		}
 	}
@@ -73,7 +69,7 @@ include_once "include/page_header.php";
 
 	$graph->SetHeader($host["host"].":".get_request("name",""));
 
-	unset($host, $denyed_hosts);
+	unset($host);
 
 	if(isset($_REQUEST["period"]))		$graph->SetPeriod($_REQUEST["period"]);
 	if(isset($_REQUEST["from"]))		$graph->SetFrom($_REQUEST["from"]);
diff --git a/frontends/php/chart4.php b/frontends/php/chart4.php
index bda1094b..c279d7ea 100644
--- a/frontends/php/chart4.php
+++ b/frontends/php/chart4.php
@@ -38,19 +38,33 @@ include_once "include/page_header.php";
 	check_fields($fields);
 ?>
 <?php
-	$denyed_hosts = get_accessible_hosts_by_user($USER_DETAILS,PERM_READ_ONLY, PERM_MODE_LT);
+	$available_hosts = get_accessible_hosts_by_user($USER_DETAILS,PERM_READ_ONLY);
 
-	if(! (DBfetch(DBselect('select distinct  t.triggerid from triggers t where t.triggerid='.$_REQUEST['triggerid']))) )
-	{
+	if(!DBfetch(DBselect('select distinct  t.triggerid from triggers t where t.triggerid='.$_REQUEST['triggerid']))){
 		fatal_error(S_NO_TRIGGER_DEFINED);
 	}
-
-	if(! ($db_data = DBfetch(DBselect('select distinct  t.triggerid,t.description,t.expression,h.host,h.hostid '.
-			' from hosts h, items i, functions f, triggers t'.
-			' where h.hostid=i.hostid and i.itemid=f.itemid and f.triggerid=t.triggerid and t.triggerid='.$_REQUEST["triggerid"].
-			' and i.hostid not in ('.$denyed_hosts.') '
-			))))
-	{
+	
+	$sql = 'SELECT t.triggerid '.
+			' FROM hosts h, items i, functions f, triggers t'.
+			' WHERE h.hostid=i.hostid '.
+				' AND i.itemid=f.itemid '.
+				' AND f.triggerid=t.triggerid '.
+				' AND t.triggerid='.$_REQUEST['triggerid'].
+				' AND i.hostid NOT IN ('.$available_hosts.') ';
+
+	if(DBfetch(DBselect($sql,1))){
+		access_deny();
+	}
+				
+	$sql = 'SELECT DISTINCT t.triggerid,t.description,t.expression, h.host,h.hostid '.
+			' FROM hosts h, items i, functions f, triggers t'.
+			' WHERE h.hostid=i.hostid '.
+				' AND i.itemid=f.itemid '.
+				' AND f.triggerid=t.triggerid '.
+				' AND t.triggerid='.$_REQUEST["triggerid"].
+				' AND i.hostid IN ('.$available_hosts.')';
+			
+	if(!$db_data = DBfetch(DBselect($sql))){
 		access_deny();
 	}
 
diff --git a/frontends/php/chart5.php b/frontends/php/chart5.php
index 23b3347c..490eeadc 100644
--- a/frontends/php/chart5.php
+++ b/frontends/php/chart5.php
@@ -38,19 +38,34 @@ include_once "include/page_header.php";
 	check_fields($fields);
 ?>
 <?php
-	if(! (DBfetch(DBselect('select serviceid from services where serviceid='.$_REQUEST["serviceid"]))) )
-	{
+	if(!DBfetch(DBselect('select serviceid from services where serviceid='.$_REQUEST["serviceid"]))){
 		fatal_error(S_NO_IT_SERVICE_DEFINED);
 	}
 
-	$denyed_hosts = get_accessible_hosts_by_user($USER_DETAILS,PERM_READ_ONLY,PERM_MODE_LT);
+	$available_hosts = get_accessible_hosts_by_user($USER_DETAILS, PERM_READ_ONLY);
 	
-	if( !($service = DBfetch(DBselect("select s.* from services s left join triggers t on s.triggerid=t.triggerid ".
-		" left join functions f on t.triggerid=f.triggerid left join items i on f.itemid=i.itemid ".
-		" where (i.hostid is NULL or i.hostid not in (".$denyed_hosts.")) ".
-		" and s.serviceid=".$_REQUEST["serviceid"]
-		))))
-	{
+	$sql = 'SELECT s.serviceid '.
+			' FROM services s, triggers t, functions f, items i '.
+			' WHERE s.serviceid='.$_REQUEST['serviceid'].
+				' AND t.triggerid=s.triggerid '.
+				' AND f.triggerid=t.triggerid '.
+				' AND i.itemid=f.itemid	'.
+				' AND i.hostid NOT IN ('.$available_hosts.')';
+
+	if(DBfetch(DBselect($sql,1))){
+		access_deny();
+	}
+
+	
+	$sql = 'SELECT s.* '.
+			' FROM services s '.
+				' LEFT JOIN triggers t ON s.triggerid=t.triggerid '.
+				' LEFT JOIN functions f ON t.triggerid=f.triggerid '.
+				' LEFT JOIN items i on f.itemid=i.itemid '.
+			' WHERE s.serviceid='.$_REQUEST['serviceid'].
+				' AND i.hostid IN ('.$available_hosts.')';
+		
+	if(!$service = DBfetch(DBselect($sql))){
 		access_deny();
 	}
 ?>
diff --git a/frontends/php/chart6.php b/frontends/php/chart6.php
index 0149f4ed..c5abf5f3 100644
--- a/frontends/php/chart6.php
+++ b/frontends/php/chart6.php
@@ -47,27 +47,26 @@ include_once "include/page_header.php";
 	check_fields($fields);
 ?>
 <?php
-	if(! (DBfetch(DBselect('select graphid from graphs where graphid='.$_REQUEST['graphid']))) )
-	{
+	if(!DBfetch(DBselect('select graphid from graphs where graphid='.$_REQUEST['graphid']))){
 		show_error_message(S_NO_GRAPH_DEFINED);
-
 	}
 
-	$denyed_hosts = get_accessible_hosts_by_user($USER_DETAILS, PERM_READ_ONLY, PERM_MODE_LT);
+	$available_hosts = get_accessible_hosts_by_user($USER_DETAILS, PERM_READ_ONLY);
 	
-	if( !($db_data = DBfetch(DBselect(
-					'SELECT g.*,h.host,h.hostid '.
-					' FROM graphs as g '.
-						' LEFT JOIN graphs_items as gi ON g.graphid=gi.graphid '.
-						' LEFT JOIN items as i ON gi.itemid=i.itemid '.
-						' LEFT JOIN hosts as h ON i.hostid=h.hostid '.
-					' WHERE g.graphid='.$_REQUEST['graphid'].
-						' AND ( h.hostid not in ('.$denyed_hosts.') '.
-						' OR h.hostid is NULL) '))))
-	{
+	if(!graph_accessible($_REQUEST['graphid'])){
 		access_deny();
 	}
 
+	$sql = 'SELECT g.*,h.host,h.hostid '.
+				' FROM graphs as g '.
+					' LEFT JOIN graphs_items as gi ON g.graphid=gi.graphid '.
+					' LEFT JOIN items as i ON gi.itemid=i.itemid '.
+					' LEFT JOIN hosts as h ON i.hostid=h.hostid '.
+				' WHERE g.graphid='.$_REQUEST['graphid'].
+					' AND h.hostid IN ('.$available_hosts.') ';
+					
+	$db_data = DBfetch(DBselect($sql));
+	
 	$graph = new Pie($db_data["graphtype"]);
 
 	if(isset($_REQUEST["period"]))		$graph->SetPeriod($_REQUEST["period"]);
diff --git a/frontends/php/chart7.php b/frontends/php/chart7.php
index 1bcf5046..b833c5fb 100644
--- a/frontends/php/chart7.php
+++ b/frontends/php/chart7.php
@@ -49,26 +49,21 @@ include_once "include/page_header.php";
 	check_fields($fields);
 ?>
 <?php
-	$denyed_hosts = get_accessible_hosts_by_user($USER_DETAILS, PERM_READ_ONLY, PERM_MODE_LT, PERM_RES_IDS_ARRAY);
-	
-	$items = get_request('items', array());
+	$available_hosts = get_accessible_hosts_by_user($USER_DETAILS, PERM_READ_ONLY, null, PERM_RES_IDS_ARRAY);
 
+	$items = get_request('items', array());
 	asort_by_key($items, 'sortorder');
 
-	foreach($items as $gitem)
-	{
-		if( !($host = DBfetch(DBselect('select h.* from hosts h,items i where h.hostid=i.hostid and i.itemid='.$gitem['itemid']))) )
-		{
+	foreach($items as $gitem){
+		if(!$host=DBfetch(DBselect('SELECT h.* FROM hosts h,items i WHERE h.hostid=i.hostid AND i.itemid='.$gitem['itemid']))){
 			fatal_error(S_NO_ITEM_DEFINED);
 		}
-		if(uint_in_array($host['hostid'], $denyed_hosts))
-		{
+		if(!uint_in_array($host['hostid'], $available_hosts)){
 			access_deny();
 		}
 	}
 
 	$graph = new Pie(get_request("graphtype"	,GRAPH_TYPE_NORMAL));
-
 	$graph->SetHeader($host["host"].":".get_request("name",""));
 	
 	$graph3d = get_request('graph3d',0);
@@ -77,7 +72,7 @@ include_once "include/page_header.php";
 	if($graph3d == 1) $graph->SwitchPie3D();
 	$graph->SwitchLegend($legend);
 	
-	unset($host, $denyed_hosts);
+	unset($host);
 
 	if(isset($_REQUEST["period"]))		$graph->SetPeriod($_REQUEST["period"]);
 	if(isset($_REQUEST["from"]))		$graph->SetFrom($_REQUEST["from"]);
diff --git a/frontends/php/charts.php b/frontends/php/charts.php
index 6eb861df..1213d0c6 100644
--- a/frontends/php/charts.php
+++ b/frontends/php/charts.php
@@ -103,11 +103,10 @@ include_once 'include/page_header.php';
 		$_REQUEST["groupid"] = $_REQUEST["hostid"] = 0;
 	}
 
-	$_REQUEST["graphid"] = get_request("graphid", get_profile("web.charts.graphid", 0));
+	$_REQUEST["graphid"] =	get_request("graphid", get_profile("web.charts.graphid", 0));
+	$_REQUEST["keep"] 	=	get_request("keep", 1); // possible excessed REQUEST variable !!!
+	$_REQUEST["period"] =	get_request("period",get_profile("web.graph[".$_REQUEST["graphid"]."].period", ZBX_PERIOD_DEFAULT));
 	
-	$_REQUEST["keep"] = get_request("keep", 1); // possible excessed REQUEST variable !!!
-
-	$_REQUEST["period"] = get_request("period",get_profile("web.graph[".$_REQUEST["graphid"]."].period", ZBX_PERIOD_DEFAULT));
 	$effectiveperiod = navigation_bar_calc();
 	
 	$options = array("allow_all_hosts","monitored_hosts","with_items");//, "always_select_first_host");//
@@ -115,7 +114,7 @@ include_once 'include/page_header.php';
 	
 	validate_group_with_host(PERM_READ_ONLY,$options);
 
-	if($_REQUEST['graphid'] > 0){
+	if($_REQUEST['graphid']>0){
 		$result=DBselect('SELECT g.graphid '.
 					' FROM graphs g, graphs_items gi, items i, hosts_groups hg'.
 					' WHERE g.graphid='.$_REQUEST['graphid'].
@@ -130,8 +129,7 @@ include_once 'include/page_header.php';
 	}
 ?>
 <?php
-	if($_REQUEST['graphid'] > 0 && $_REQUEST['period'] >= ZBX_MIN_PERIOD)
-	{
+	if(($_REQUEST['graphid']>0) && ($_REQUEST['period'] >= ZBX_MIN_PERIOD)){
 		update_profile('web.graph['.$_REQUEST['graphid'].'].period',$_REQUEST['period']);
 	}
 
@@ -140,31 +138,19 @@ include_once 'include/page_header.php';
 <?php
 	$h1 = array(S_GRAPHS_BIG.SPACE."/".SPACE);
 	
-	$availiable_groups = get_accessible_groups_by_user($USER_DETAILS,PERM_READ_LIST, null, null, get_current_nodeid());
-	$availiable_hosts = get_accessible_hosts_by_user($USER_DETAILS,PERM_READ_LIST, null, null, get_current_nodeid());
-
-	if($_REQUEST['graphid'] > 0 && DBfetch(DBselect('SELECT DISTINCT graphid FROM graphs WHERE graphid='.$_REQUEST['graphid'])))
-	{
-		if(! ($row = DBfetch(DBselect(' SELECT distinct h.host, g.name '.
-					' FROM hosts h, items i, graphs_items gi, graphs g '.
-					' WHERE h.status='.HOST_STATUS_MONITORED.
-						' AND h.hostid=i.hostid '.
-						' AND g.graphid='.$_REQUEST['graphid'].
-						' AND i.itemid=gi.itemid '.
-						' AND gi.graphid=g.graphid'.
-//						' AND h.hostid NOT IN ('.$denyed_hosts.') '.
-						' AND h.hostid IN ('.$availiable_hosts.') '.
-						' AND '.DBin_node('g.graphid').
-					' ORDER BY h.host, g.name'
-				))))
-		{
+	$available_groups = get_accessible_groups_by_user($USER_DETAILS,PERM_READ_LIST, null, null, get_current_nodeid());
+	$available_hosts = get_accessible_hosts_by_user($USER_DETAILS,PERM_READ_LIST, null, null, get_current_nodeid());
+	
+	$available_graphs = get_accessible_graphs(PERM_READ_LIST, null, get_current_nodeid());
+	
+	if(($_REQUEST['graphid']>0) && ($row=DBfetch(DBselect('SELECT DISTINCT graphid, name FROM graphs WHERE graphid='.$_REQUEST['graphid'])))){
+		if(!graph_accessible($_REQUEST['graphid'])){
 			update_profile('web.charts.graphid',0);
 			access_deny();
 		}
 		array_push($h1, new CLink($row['name'], '?graphid='.$_REQUEST['graphid'].(isset($_REQUEST['fullscreen']) ? '' : '&fullscreen=1')));
 	}
-	else
-	{
+	else{
 		$_REQUEST['graphid'] = 0;
 		array_push($h1, S_SELECT_GRAPH_TO_DISPLAY);
 	}
@@ -182,11 +168,11 @@ include_once 'include/page_header.php';
 	$cmbHosts->AddItem(0,S_ALL_SMALL);
 	$cmbGraph->AddItem(0,S_SELECT_GRAPH_DOT_DOT_DOT);
 	
-// Selecting first group,host,graph if it's one of kind ;)
+// Selecting first group,host,graph if it's one of a kind ;)
 	if($_REQUEST['groupid'] == 0){
 		$sql = 'SELECT COUNT(DISTINCT g.groupid) as grpcount, MAX(g.groupid) as groupid'.
 				' FROM groups g, hosts_groups hg, hosts h, items i, graphs_items gi '.
-				' WHERE g.groupid in ('.$availiable_groups.') '.
+				' WHERE g.groupid in ('.$available_groups.') '.
 					' AND hg.groupid=g.groupid '.
 					' AND h.status='.HOST_STATUS_MONITORED.
 					' AND h.hostid=i.hostid '.
@@ -201,25 +187,17 @@ include_once 'include/page_header.php';
 	}
 	
 	if($_REQUEST['hostid'] == 0){
-		if($_REQUEST['groupid'] > 0){
-			$sql = 'SELECT COUNT(DISTINCT h.hostid) as hstcount, MAX(h.hostid) as hostid '.
-				' FROM hosts h,items i,hosts_groups hg, graphs_items gi '.
-				' WHERE h.status='.HOST_STATUS_MONITORED.
-					' AND h.hostid=i.hostid '.
-					' AND hg.groupid='.$_REQUEST['groupid'].
-					' AND hg.hostid=h.hostid '.
-					' AND h.hostid IN ('.$availiable_hosts.') '.
-					' AND i.itemid=gi.itemid';
-		}
-		else{
-			$sql = 'SELECT COUNT(DISTINCT h.hostid) as hstcount, MAX(h.hostid) as hostid '.
-				' FROM hosts h,items i, graphs_items gi '.
-				' WHERE h.status='.HOST_STATUS_MONITORED.
-					' AND i.status='.ITEM_STATUS_ACTIVE.
-					' AND h.hostid=i.hostid'.
-					' AND h.hostid IN ('.$availiable_hosts.') '.
-					' AND i.itemid=gi.itemid';
-		}
+		$sql = 'SELECT COUNT(DISTINCT h.hostid) as hstcount, MAX(h.hostid) as hostid '.
+			' FROM hosts h,items i,hosts_groups hg, graphs_items gi '.
+			' WHERE h.status='.HOST_STATUS_MONITORED.
+				' AND i.itemid=gi.itemid'.
+				' AND i.status='.ITEM_STATUS_ACTIVE.
+				' AND h.hostid=i.hostid '.
+				' AND hg.hostid=h.hostid '.
+				($_REQUEST['groupid']?' AND hg.groupid='.$_REQUEST['groupid']:'').
+				' AND gi.graphid IN ('.$available_graphs.')';
+//				' AND h.hostid IN ('.$available_hosts.') ';
+
 
 		if($cnt_row = DBfetch(DBselect($sql))){
 			if($cnt_row['hstcount'] == 1){
@@ -228,38 +206,22 @@ include_once 'include/page_header.php';
 			}
 		}
 	}
+	
 	if($_REQUEST['graphid'] == 0){
-		if($_REQUEST['hostid'] > 0){
-			$sql = 'SELECT COUNT(DISTINCT g.graphid) as grphcount, MAX(g.graphid) as graphid '.
-				' FROM graphs g,graphs_items gi,items i'.
-				' WHERE i.itemid=gi.itemid '.
-					' AND g.graphid=gi.graphid '.
-					' AND i.hostid='.$_REQUEST['hostid'].
-					' AND '.DBin_node('g.graphid').
-					' AND i.hostid IN ('.$availiable_hosts.') ';
-		}
-		elseif ($_REQUEST['groupid'] > 0){
-			$sql = 'SELECT COUNT(DISTINCT g.graphid) as grphcount, MAX(g.graphid) as graphid '.
-				' FROM graphs g,graphs_items gi,items i,hosts_groups hg,hosts h'.
-				' WHERE i.itemid=gi.itemid '.
-					' AND g.graphid=gi.graphid '.
-					' AND i.hostid=hg.hostid '.
-					' AND hg.groupid='.$_REQUEST['groupid'].
-					' AND i.hostid=h.hostid '.
-					' AND h.status='.HOST_STATUS_MONITORED.
-					' AND '.DBin_node('g.graphid').
-					' AND h.hostid IN ('.$availiable_hosts.') ';
-		}
-		else{
-			$sql = 'SELECT COUNT(DISTINCT g.graphid) as grphcount, MAX(g.graphid) as graphid '.
-				' FROM graphs g,graphs_items gi,items i,hosts h'.
-				' WHERE i.itemid=gi.itemid '.
-					' AND g.graphid=gi.graphid '.
-					' AND i.hostid=h.hostid '.
-					' AND h.status='.HOST_STATUS_MONITORED.
-					' AND '.DBin_node('g.graphid').
-					' AND h.hostid IN ('.$availiable_hosts.') ';
-		}
+
+		$sql = 'SELECT COUNT(DISTINCT g.graphid) as grphcount, MAX(g.graphid) as graphid '.
+			' FROM graphs g,graphs_items gi,items i,hosts_groups hg,hosts h'.
+			' WHERE i.itemid=gi.itemid '.
+				' AND g.graphid=gi.graphid '.
+				' AND i.hostid=hg.hostid '.
+				($_REQUEST['groupid']?' AND hg.groupid='.$_REQUEST['groupid']:'').
+				' AND i.hostid=h.hostid '.
+				($_REQUEST['hostid']?' AND h.hostid='.$_REQUEST['hostid']:'').
+				' AND h.status='.HOST_STATUS_MONITORED.
+				' AND '.DBin_node('g.graphid').
+				' AND g.graphid IN ('.$available_graphs.')';
+//				' AND h.hostid IN ('.$available_hosts.') ';
+
 		if($cnt_row = DBfetch(DBselect($sql))){
 			if($cnt_row['grphcount'] == 1){
 				$_REQUEST['graphid'] = $cnt_row['graphid'];
@@ -273,15 +235,15 @@ include_once 'include/page_header.php';
 	
 	$result=DBselect('SELECT DISTINCT g.groupid, g.name '.
 				' FROM groups g, hosts_groups hg, hosts h, items i, graphs_items gi '.
-				' WHERE g.groupid in ('.$availiable_groups.') '.
+				' WHERE g.groupid in ('.$available_groups.') '.
 					' AND hg.groupid=g.groupid '.
 					' AND h.status='.HOST_STATUS_MONITORED.
 					' AND h.hostid=i.hostid '.
 					' AND hg.hostid=h.hostid '.
 					' AND i.itemid=gi.itemid '.
 				' ORDER BY g.name');
-	while($row=DBfetch($result))
-	{
+				
+	while($row=DBfetch($result)){
 		$cmbGroup->AddItem(
 				$row['groupid'],
 				get_node_name_by_elid($row['groupid']).$row["name"]
@@ -290,30 +252,20 @@ include_once 'include/page_header.php';
 	
 	$r_form->AddItem(array(S_GROUP.SPACE,$cmbGroup));
 	
-	if($_REQUEST['groupid'] > 0){
-		$sql = ' SELECT distinct h.hostid,h.host '.
-			' FROM hosts h,items i,hosts_groups hg, graphs_items gi '.
-			' WHERE h.status='.HOST_STATUS_MONITORED.
-				' AND h.hostid=i.hostid '.
-				' AND hg.groupid='.$_REQUEST['groupid'].
-				' AND hg.hostid=h.hostid '.
-				' AND h.hostid IN ('.$availiable_hosts.') '.
-				' AND i.itemid=gi.itemid'.
-			' ORDER BY h.host';
-	}
-	else{
-		$sql = 'SELECT distinct h.hostid,h.host '.
-			' FROM hosts h,items i, graphs_items gi '.
-			' WHERE h.status='.HOST_STATUS_MONITORED.
-				' AND i.status='.ITEM_STATUS_ACTIVE.
-				' AND h.hostid=i.hostid'.
-				' AND h.hostid IN ('.$availiable_hosts.') '.
-				' AND i.itemid=gi.itemid'.
-			' ORDER BY h.host';
-	}
+	$sql = 'SELECT DISTINCT h.hostid,h.host '.
+		' FROM hosts h,items i,hosts_groups hg, graphs_items gi '.
+		' WHERE h.status='.HOST_STATUS_MONITORED.
+			' AND i.itemid=gi.itemid'.
+			' AND i.status='.ITEM_STATUS_ACTIVE.
+			' AND h.hostid=i.hostid '.
+			' AND hg.hostid=h.hostid '.
+			($_REQUEST['groupid']?' AND hg.groupid='.$_REQUEST['groupid']:'').
+			' AND gi.graphid IN ('.$available_graphs.')'.
+//			' AND h.hostid IN ('.$available_hosts.') '.
+		' ORDER BY h.host';
+	
 	$result=DBselect($sql);
-	while($row=DBfetch($result))
-	{
+	while($row=DBfetch($result)){
 		$cmbHosts->AddItem(
 				$row['hostid'],
 				get_node_name_by_elid($row['hostid']).$row['host']
@@ -321,45 +273,23 @@ include_once 'include/page_header.php';
 	}
 
 	$r_form->AddItem(array(SPACE.S_HOST.SPACE,$cmbHosts));
-
-	if($_REQUEST['hostid'] > 0){
-		$sql = 'SELECT distinct g.graphid,g.name '.
-			' FROM graphs g,graphs_items gi,items i'.
-			' WHERE i.itemid=gi.itemid '.
-				' AND g.graphid=gi.graphid '.
-				' AND i.hostid='.$_REQUEST['hostid'].
-				' AND '.DBin_node('g.graphid').
-				' AND i.hostid IN ('.$availiable_hosts.') '.
-			' ORDER BY g.name';
-	}
-	elseif ($_REQUEST['groupid'] > 0){
-		$sql = 'SELECT distinct g.graphid,g.name '.
-			' FROM graphs g,graphs_items gi,items i,hosts_groups hg,hosts h'.
-			' WHERE i.itemid=gi.itemid '.
-				' AND g.graphid=gi.graphid '.
-				' AND i.hostid=hg.hostid '.
-				' AND hg.groupid='.$_REQUEST['groupid'].
-				' AND i.hostid=h.hostid '.
-				' AND h.status='.HOST_STATUS_MONITORED.
-				' AND '.DBin_node('g.graphid').
-				' AND h.hostid IN ('.$availiable_hosts.') '.
-			' ORDER BY g.name';
-	}
-	else{
-		$sql = 'SELECT DISTINCT g.graphid,g.name '.
-			' FROM graphs g,graphs_items gi,items i,hosts h'.
-			' WHERE i.itemid=gi.itemid '.
-				' AND g.graphid=gi.graphid '.
-				' AND i.hostid=h.hostid '.
-				' AND h.status='.HOST_STATUS_MONITORED.
-				' AND '.DBin_node('g.graphid').
-				' AND h.hostid IN ('.$availiable_hosts.') '.
-			' ORDER BY g.name';
-	}
+	
+	$sql = 'SELECT DISTINCT g.graphid,g.name '.
+		' FROM graphs g,graphs_items gi,items i,hosts_groups hg,hosts h'.
+		' WHERE gi.graphid=g.graphid '.
+			' AND i.itemid=gi.itemid '.
+			' AND hg.hostid=i.hostid '.
+			' AND h.hostid=i.hostid '.
+			' AND h.status='.HOST_STATUS_MONITORED.
+			($_REQUEST['groupid']?' AND hg.groupid='.$_REQUEST['groupid']:'').
+			($_REQUEST['hostid']?' AND h.hostid='.$_REQUEST['hostid']:'').
+			' AND '.DBin_node('g.graphid').
+			' AND g.graphid IN ('.$available_graphs.')'.
+//			' AND h.hostid IN ('.$available_hosts.') ';
+		' ORDER BY g.name';
 
 	$result = DBselect($sql);
-	while($row=DBfetch($result))
-	{
+	while($row=DBfetch($result)){
 		$cmbGraph->AddItem(
 				$row['graphid'],
 				get_node_name_by_elid($row['graphid']).$row['name']
diff --git a/frontends/php/include/graphs.inc.php b/frontends/php/include/graphs.inc.php
index 50d28c44..554887ae 100644
--- a/frontends/php/include/graphs.inc.php
+++ b/frontends/php/include/graphs.inc.php
@@ -29,8 +29,7 @@
  *     Eugene Grigorjev 
  *
  */
-	function	graph_item_type2str($type,$count=null)
-	{
+	function	graph_item_type2str($type,$count=null){
 		switch($type){
 			case GRAPH_ITEM_SUM:	
 				$type = S_GRAPH_SUM;
@@ -56,8 +55,7 @@
  *     Eugene Grigorjev 
  *
  */
-	function	graph_item_drawtypes()
-	{
+	function	graph_item_drawtypes(){
 		return array(
 				GRAPH_ITEM_DRAWTYPE_LINE,
 				GRAPH_ITEM_DRAWTYPE_FILLED_REGION,
@@ -66,7 +64,7 @@
 				GRAPH_ITEM_DRAWTYPE_DASHED_LINE
 			    );
 	}
-
+	
 /*
  * Function: graph_item_drawtype2str
  *
@@ -77,19 +75,17 @@
  *     Eugene Grigorjev 
  *
  */
-	function	graph_item_drawtype2str($drawtype,$type=null)
-	{
-	if($type == GRAPH_ITEM_AGGREGATED) return '-';
+	function	graph_item_drawtype2str($drawtype,$type=null){
+		if($type == GRAPH_ITEM_AGGREGATED) return '-';
 
-	switch($drawtype)
-	{
-		case GRAPH_ITEM_DRAWTYPE_LINE:		$drawtype = "Line";		break;
-		case GRAPH_ITEM_DRAWTYPE_FILLED_REGION:	$drawtype = "Filled region";	break;
-		case GRAPH_ITEM_DRAWTYPE_BOLD_LINE:	$drawtype = "Bold line";	break;
-		case GRAPH_ITEM_DRAWTYPE_DOT:		$drawtype = "Dot";		break;
-		case GRAPH_ITEM_DRAWTYPE_DASHED_LINE:	$drawtype = "Dashed line";	break;
-		default: $drawtype = S_UNKNOWN;		break;
-	}
+		switch($drawtype){
+			case GRAPH_ITEM_DRAWTYPE_LINE:		$drawtype = "Line";		break;
+			case GRAPH_ITEM_DRAWTYPE_FILLED_REGION:	$drawtype = "Filled region";	break;
+			case GRAPH_ITEM_DRAWTYPE_BOLD_LINE:	$drawtype = "Bold line";	break;
+			case GRAPH_ITEM_DRAWTYPE_DOT:		$drawtype = "Dot";		break;
+			case GRAPH_ITEM_DRAWTYPE_DASHED_LINE:	$drawtype = "Dashed line";	break;
+			default: $drawtype = S_UNKNOWN;		break;
+		}
 	return $drawtype;
 	}
 
@@ -157,16 +153,100 @@
 					' ORDER BY itemid,drawtype,sortorder,color,yaxisside'); 
 	}
 
-	/*
-	 * Function: get_min_itemclock_by_graphid
-	 *
-	 * Description:
-	 *     Return the time of the 1st apearance of items included in graph in trends
-	 *
-	 * Author:
-	 *     Aly
-	 *
-	 */	
+/*
+ * Function: graph_accessible
+ *
+ * Description:
+ *     Checks if graph is accessible to USER
+ *
+ * Author:
+ *     Aly
+ *
+ */		
+	function graph_accessible($graphid){
+		global $USER_DETAILS;
+		$available_hosts = get_accessible_hosts_by_user($USER_DETAILS, PERM_READ_ONLY);
+		
+		$sql = 	'SELECT g.graphid '.
+				' FROM graphs as g, graphs_items as gi, items as i '.
+				' WHERE g.graphid='.$graphid.
+					' AND g.graphid=gi.graphid '.
+					' AND i.itemid=gi.itemid '.
+					' AND i.hostid NOT IN ('.$available_hosts.')';
+
+		if(DBfetch(DBselect($sql,1))){
+			return false;
+		}
+	return true;
+	}
+
+
+/*
+ * Function: get_accessible_graphs_by_host
+ *
+ * Description:
+ *     returns string of accessible graphid's
+ *
+ * Author:
+ *     Aly
+ *
+ */		
+	function get_accessible_graphs($perm,$perm_res=null,$nodeid=null,$hostid=null){
+		global $USER_DETAILS;
+
+		if(is_null($perm_res))
+			$perm_res = PERM_RES_STRING_LINE;
+		
+		$available_hosts = get_accessible_hosts_by_user($USER_DETAILS, $perm, null, null, $nodeid);
+		
+		$denied_graphs = array();
+		$available_graphs = array();
+		
+		$sql = 	'SELECT DISTINCT g.graphid '.
+				' FROM graphs as g, graphs_items as gi, items as i '.
+				' WHERE g.graphid=gi.graphid '.
+					(!empty($hostid)?' AND i.hostid='.$hostid:'').
+					' AND i.itemid=gi.itemid '.
+					' AND i.hostid NOT IN ('.$available_hosts.')';
+
+		$result = DBselect($sql);
+		while($graph = DBfetch($result)){
+			$denied_graphs[] = $graph['graphid'];
+		}
+
+		$sql = 	'SELECT DISTINCT g.graphid '.
+				' FROM graphs as g, graphs_items as gi, items as i '.
+				' WHERE g.graphid=gi.graphid '.
+					(!empty($hostid)?' AND i.hostid='.$hostid:'').
+					' AND i.itemid=gi.itemid '.
+					' AND i.status='.ITEM_STATUS_ACTIVE.
+					(!empty($denied_graphs)?' AND g.graphid  NOT IN ('.implode(',',$denied_graphs).')':'');
+					
+		$result = DBselect($sql);
+		while($graph = DBfetch($result)){
+			$available_graphs[$graph['graphid']] = $graph['graphid'];
+		}
+		
+		if(PERM_RES_STRING_LINE == $perm_res){
+			if(count($result) == 0) 
+				$available_graphs = '-1';
+			else
+				$available_graphs = implode(',',$available_graphs);
+		}
+		
+	return $available_graphs;
+	}
+
+/*
+ * Function: get_min_itemclock_by_graphid
+ *
+ * Description:
+ *     Return the time of the 1st apearance of items included in graph in trends
+ *
+ * Author:
+ *     Aly
+ *
+ */	
 	function get_min_itemclock_by_graphid($graphid){
 		$row = DBfetch(DBselect('SELECT MIN(t.clock) as clock '.
 						' FROM graphs_items gi, trends t '.
diff --git a/frontends/php/include/maps.inc.php b/frontends/php/include/maps.inc.php
index ceb490d0..d598ba76 100644
--- a/frontends/php/include/maps.inc.php
+++ b/frontends/php/include/maps.inc.php
@@ -83,20 +83,18 @@
 
 		$result = false;
 
-		if($db_result = DBselect('select * from sysmaps_elements where sysmapid='.$sysmapid.
-			' and '.DBin_node('sysmapid', get_current_nodeid($perm))))
+		if($db_result = DBselect('SELECT * '.
+						' FROM sysmaps_elements '.
+						' WHERE sysmapid='.$sysmapid.
+							' AND '.DBin_node('sysmapid', get_current_nodeid($perm))))
 		{
 			$result = true;
-			
-			$denyed_hosts = get_accessible_hosts_by_user($USER_DETAILS,PERM_READ_ONLY, PERM_MODE_LT);
+			$available_hosts = get_accessible_hosts_by_user($USER_DETAILS,PERM_READ_ONLY);
 						
-			while(($se_data = DBfetch($db_result)) && $result)
-			{
-				switch($se_data['elementtype'])
-				{
+			while(($se_data = DBfetch($db_result)) && $result){
+				switch($se_data['elementtype']){
 					case SYSMAP_ELEMENT_TYPE_HOST:
-						if(uint_in_array($se_data['elementid'],explode(',',$denyed_hosts)))
-						{
+						if(!uint_in_array($se_data['elementid'],explode(',',$available_hosts))){
 							$result = false;
 						}
 						break;
@@ -104,21 +102,26 @@
 						$result &= sysmap_accessiable($se_data['elementid'], PERM_READ_ONLY);
 						break;
 					case SYSMAP_ELEMENT_TYPE_TRIGGER:
-						if( DBfetch(DBselect('select triggerid from triggers where triggerid='.$se_data['elementid'])) &&
-						    !DBfetch(DBselect('SELECT DISTINCT t.*'.
+						if(DBfetch(DBselect('SELECT triggerid FROM triggers WHERE triggerid='.$se_data['elementid']))){
+							$sql = 'SELECT DISTINCT t.triggerid'.
 							' FROM triggers t,items i,functions f'.
 							' WHERE f.itemid=i.itemid '.
 								' AND t.triggerid=f.triggerid'.
-								' AND i.hostid NOT IN ('.$denyed_hosts.') '.
-								' AND t.triggerid='.$se_data['elementid'])))
-						{
-							$result = false;
-						}
+								' AND i.hostid NOT IN ('.$available_hosts.') '.
+								' AND t.triggerid='.$se_data['elementid'];
+							if(DBfetch(DBselect($sql,1))){
+								$result = false;
+							}
+						} 
 						break;
 					case SYSMAP_ELEMENT_TYPE_HOST_GROUP:
-						if( DBfetch(DBselect('SELECT groupid FROM groups WHERE groupid='.$se_data['elementid'])) &&
-						    uint_in_array($se_data['elementid'],get_accessible_groups_by_user($USER_DETAILS,PERM_READ_ONLY, PERM_MODE_LT, PERM_RES_IDS_ARRAY)))
-						{
+						$available_groups = get_accessible_groups_by_user($USER_DETAILS,PERM_READ_ONLY, null, PERM_RES_IDS_ARRAY);
+						
+						$sql = 'SELECT groupid '.
+							' FROM groups '.
+							' WHERE groupid='.$se_data['elementid'];
+							
+						if(DBfetch(DBselect($sql,1)) && !uint_in_array($se_data['elementid'],$available_groups)){
 							$result = false;
 						}
 						break;
diff --git a/frontends/php/include/perm.inc.php b/frontends/php/include/perm.inc.php
index 4da32399..e96b77bc 100644
--- a/frontends/php/include/perm.inc.php
+++ b/frontends/php/include/perm.inc.php
@@ -184,7 +184,7 @@
 		return $perm_mode;
 	}
 
-	function	get_accessible_hosts_by_user(&$user_data,$perm,$perm_mode=null,$perm_res=null,$nodeid=null,$cache=1){
+	function get_accessible_hosts_by_user(&$user_data,$perm,$perm_mode=null,$perm_res=null,$nodeid=null,$cache=1){
 		static $available_hosts;
 
 		if(is_null($perm_res))		$perm_res	= PERM_RES_STRING_LINE;
@@ -244,19 +244,15 @@ COpt::counter_up('perm');
 
 		$processed = array();
 		while($host_data = DBfetch($db_hosts)){
-//			It seems that host details are not required by the logic
-//			$host_data += DBfetch(DBselect('select * from hosts where hostid='.$host_data['hostid']));
-
 			if(empty($host_data['nodeid'])) $host_data['nodeid'] = id2nodeid($host_data['hostid']);
 
 			/* if no rights defined used node rights */
-			if( (empty($host_data['permission']) || is_null($host_data['userid'])) ){
+			if( (empty($host_data['permission']) || empty($host_data['userid'])) ){
 				if( isset($processed[$host_data['hostid']]) )
 					continue;
 
 				if(!isset($nodes)){
-					$nodes = get_accessible_nodes_by_user($user_data,
-						PERM_DENY,PERM_MODE_GE,PERM_RES_DATA_ARRAY);
+					$nodes = get_accessible_nodes_by_user($user_data, PERM_DENY, PERM_MODE_GE, PERM_RES_DATA_ARRAY);
 				}
 				if( !isset($nodes[$host_data['nodeid']]) || $user_type==USER_TYPE_ZABBIX_USER )
 					$host_data['permission'] = PERM_DENY;
@@ -285,8 +281,7 @@ COpt::counter_up('perm');
 	return $result;
 	}
 
-	function	get_accessible_groups_by_user($user_data,$perm,$perm_mode=null,$perm_res=null,$nodeid=null)
-	{
+	function get_accessible_groups_by_user($user_data,$perm,$perm_mode=null,$perm_res=null,$nodeid=null){
 		global $ZBX_LOCALNODEID;
 
 		if(is_null($perm_mode))		$perm_mode	= PERM_MODE_GE;
diff --git a/frontends/php/include/screens.inc.php b/frontends/php/include/screens.inc.php
index 6190aaa9..cce172ee 100644
--- a/frontends/php/include/screens.inc.php
+++ b/frontends/php/include/screens.inc.php
@@ -28,24 +28,20 @@
 
 		$result = false;
 
-		if(DBselect('select screenid from screens where screenid='.$screenid.
-			' and '.DBin_node('screenid', get_current_nodeid($perm))))
+		if(DBfetch(DBselect('SELECT screenid FROM screens WHERE screenid='.$screenid.' AND '.DBin_node('screenid', get_current_nodeid($perm)))))
 		{
 			$result = true;
+			$available_hosts = get_accessible_hosts_by_user($USER_DETAILS,PERM_READ_ONLY);
 			
-			$denyed_hosts = get_accessible_hosts_by_user($USER_DETAILS,PERM_READ_ONLY, PERM_MODE_LT);
-			$denyed_groups = get_accessible_groups_by_user($USER_DETAILS,PERM_READ_ONLY, PERM_MODE_LT);
-			
-			$db_result = DBselect("select * from screens_items where screenid=".$screenid);
-			while(($ac_data = DBfetch($db_result)) && $result)
-			{
-				switch($ac_data['resourcetype'])
-				{
+			$db_result = DBselect('SELECT * FROM screens_items WHERE screenid='.$screenid);
+			while(($ac_data = DBfetch($db_result)) && $result){
+				switch($ac_data['resourcetype']){
 					case SCREEN_RESOURCE_GRAPH:
 						$itemid = array();
 
-						$db_gitems = DBselect("select distinct itemid from graphs_items ".
-							" where graphid=".$ac_data['resourceid']);
+						$db_gitems = DBselect('SELECT DISTINCT itemid '.
+										' FROM graphs_items '.
+										' WHERE graphid='.$ac_data['resourceid']);
 						
 						while($gitem_data = DBfetch($db_gitems)) array_push($itemid, $gitem_data['itemid']);
 						
@@ -57,8 +53,10 @@
 						if(!isset($itemid))
 							$itemid = array($ac_data['resourceid']);
 
-						if(DBfetch(DBselect("select itemid from items where itemid in (".implode(',',$itemid).") ".
-							" and hostid in (".$denyed_hosts.")")))
+						if(DBfetch(DBselect('SELECT itemid '.
+										' FROM items '.
+										' WHERE itemid IN ('.implode(',',$itemid).') '.
+											' AND hostid NOT IN ('.$available_hosts.')')))
 						{
 							$result = false;
 						}	
diff --git a/frontends/php/maps.php b/frontends/php/maps.php
index 87d0fd46..c18aac7f 100644
--- a/frontends/php/maps.php
+++ b/frontends/php/maps.php
@@ -91,11 +91,11 @@ include_once "include/page_header.php";
 
 	$all_maps = array();
 	
-	$result = DBselect('select sysmapid,name from sysmaps '.
-		' where '.DBin_node('sysmapid').
-		' order by name');
-	while($row=DBfetch($result))
-	{
+	$result = DBselect('SELECT sysmapid,name '.
+						' FROM sysmaps '.
+						' WHERE '.DBin_node('sysmapid').
+						' ORDER BY name');
+	while($row=DBfetch($result)){
 		if(!sysmap_accessiable($row["sysmapid"],PERM_READ_ONLY))
 			continue;
 
diff --git a/frontends/php/tr_status.php b/frontends/php/tr_status.php
index 345d9b90..d8895104 100644
--- a/frontends/php/tr_status.php
+++ b/frontends/php/tr_status.php
@@ -166,7 +166,7 @@ include_once "include/page_header.php";
 	
 	$available_hosts = get_accessible_hosts_by_user($USER_DETAILS,PERM_READ_LIST, null, null, get_current_nodeid());
 	$scripts_by_hosts = get_accessible_scripts_by_hosts(explode(',',$available_hosts));
-
+	
 	$result=DBselect('SELECT DISTINCT g.groupid,g.name '.
 					' FROM groups g, hosts_groups hg, hosts h, items i, functions f, triggers t '.
 					' WHERE h.hostid in ('.$available_hosts.') '.