int partnerNo = 11 ;
session.setAttribute("THE_FUNCAREA","COMPANY");
String password = (String)request.getParameter("userPassword");
String sql = "select u.user_no,p.password from users u,user_passwd p where u.loginName='"+MyDB.toSQLStr(userName)+"' and u.partner_no="+ partnerNo+
" and p.user_no=u.user_no" ;
String[][] data = MyDB.fetchStrData(conn,sql) ;
if ( data ==null || !data[0][1].equals(password) )
{
out.println("<script>alert('用户不存在或者口令不对');parent.document.form0.userName.focus();</script>");
return;
}
int userNo = Integer.parseInt(data[0][0]) ;
String helpedName = (String)request.getParameter("helpedName");
if (helpedName != null && helpedName.trim().length() != 0 )
{
sql = "select user_no from users where loginName='"+MyDB.toSQLStr(helpedName)+"' and partner_no='"+ partnerNo+"'" ;
data = MyDB.fetchStrData(conn, sql );
if( data == null)
{
out.println("<script>alert('该被帮助者不存在');parent.document.form0.helpedName.focus();</script>");
return;
}
int helpedNo = Integer.parseInt(data[0][0]) ;
sql = "select func_no from helper_right where user_no="+helpedNo +" and helpedby="+userNo +" and expireDate >= getDate()" ;
data = MyDB.fetchStrData(conn,sql );
if ( data == null )
{
out.println("<script>alert('你无权帮助"+helpedName+"');parent.document.form0.helpedName.focus();</script>");
return;
}
session.setAttribute("THE_USERNO",""+helpedNo );
session.setAttribute("THE_HELPEDBY",""+userNo);
}
else
{
sql = "select func_no from rights where user_no="+userNo ;
data = MyDB.fetchStrData(conn,sql );
if ( data == null )
{
// out.println("<script>alert('你无权访问系统');parent.document.form0.userName.focus();</script>");
// return;
}
session.setAttribute("THE_USERNO",""+userNo );
session.setAttribute("THE_HELPEDBY",null);
}
if ( data == null ) session.setAttribute("THE_RIGHTS",null );
else
{
int rows = data.length;
int[] rights = new int[rows];
for(int i = 0 ;i < rows ; ++ i)
{
rights[i] = Integer.parseInt(data[i][0]);
}
session.setAttribute("THE_RIGHTS",rights);
}