Change $_SESSIONs to $_POST

webui/user-groups-add.php

@@ -29,7 +29,7 @@ printHeader(array(
 ));
 
 
-if (isset($_POST['groups_user_id'])) {
+if (isset($_POST['user_id'])) {
 
 	if (isset($_POST['frmaction']) && $_POST['frmaction'] == "add") {
 
@@ -37,6 +37,7 @@ if (isset($_POST['groups_user_id'])) {
 		<p class="pageheader">Available Groups</p>
 
 		<form id="main_form" action="user-groups-add.php" method="post">
+			<input type="hidden" name="user_id" value="<?php echo $_POST['user_id']; ?>" />
 			<div class="textcenter">
 				<input type="hidden" name="frmaction" value="add2" />
 				<table class="entry">
@@ -109,9 +110,9 @@ if (isset($_POST['groups_user_id'])) {
 			");
 
 			$res = $stmt->execute(array(
-						$_POST['groups_user_id'],
+						$_POST['user_id'],
 						$_POST['group_id'],
-						$_POST['users_group_comment'],
+						$_POST['users_to_groups_comment'],
 						$_POST['users_group_disabled'],
 						));
 

webui/user-groups-delete.php

@@ -46,6 +46,7 @@ if (isset($_POST['frmaction']) && $_POST['frmaction'] == "delete") {
 			<div>
 				<input type="hidden" name="frmaction" value="delete2" />
 				<input type="hidden" name="group_id" value="<?php echo $_POST['group_id']; ?>" />
+				<input type="hidden" name="user_id" value="<?php echo $_POST['user_id']; ?>" />
 			</div>
 			<div class="textcenter">
 				Are you very sure? <br />
@@ -66,14 +67,14 @@ if (isset($_POST['frmaction']) && $_POST['frmaction'] == "delete") {
 ?>
 	<p class="pageheader">Group Assignment Removal Results</p>
 <?php
-	if (isset($_POST['group_id']) && isset($_POST['groups_user_id'])) {
+	if (isset($_POST['group_id']) && isset($_POST['user_id'])) {
 
 		if (isset($_POST['confirm']) && $_POST['confirm'] == "yes") {
 			$res = $db->exec("	
 				DELETE FROM 
 					${DB_TABLE_PREFIX}users_to_groups 
 				WHERE 
-					UserID = ".$db->quote($_SESSION['groups_user_id'])." 
+					UserID = ".$db->quote($_POST['user_id'])." 
 					AND GroupID = ".$db->quote($_POST['group_id'])."
 			");
 

webui/user-groups.php

@@ -73,6 +73,9 @@ printHeader(array(
 <?php
 
 		if (isset($_POST['user_id'])) {
+?>
+			<input type="hidden" name="user_id" value="<?php echo $_POST['user_id']; ?>" />
+<?php
 			$sql = "SELECT GroupID FROM ${DB_TABLE_PREFIX}users_to_groups WHERE UserID = ".$db->quote($_POST['user_id']);
 			$res = $db->query($sql);