<?php
  require('global-php.php');
  header('Content-type: text/xml; charset=utf-8');
  $verbindung = database_connection(
  	      "<status>" . $lang_database_failure[$language] . "</status>");
  $PHP_AUTH_USER = $_SERVER["PHP_AUTH_USER"];
  $PHP_AUTH_PW = $_SERVER["PHP_AUTH_PW"];
  $ergebnis = db_exec($verbindung,
			"SELECT * FROM staff_authorization,superuser,"
					. "capability "
				. "WHERE superuser.account"
				. "=staff_authorization.id "
				. "AND superuser.capability=capability.id "
				. "AND capability.name='users' "
				. "AND "
				. login_query_clauses(
					$PHP_AUTH_USER,
					$PHP_AUTH_PW)
				. ";");
  if (pg_numrows($ergebnis) < 1) {
    header('WWW-Authenticate: Basic realm="Kursverwaltung"');
    header("HTTP/1.0 401 Unauthorized");
    echo '<status>' . $lang_authentication_failure[$language] . '</status>';
    db_close($verbindung);
    exit;
  }
  $account = intval($_REQUEST["account"]);
  $capability = intval($_REQUEST["capability"]);
  $ergebnis = db_exec($verbindung, "SELECT name "
  					. "FROM staff_authorization "
					. "WHERE id=$account;");
  if (0 < pg_numrows($ergebnis)) {
    $name = pg_result($ergebnis, 0, 0);
  }
  if (0 < pg_cmdtuples(db_exec($verbindung, "INSERT "
			. "INTO superuser (account,capability) "
			. "SELECT "
			. "$account,$capability "
			. "WHERE NOT EXISTS (SELECT true "
			. "FROM superuser "
			. "WHERE account=" . $account . " "
			. "AND capability=$capability);"))) {
?>
<status><?=lang_capability_granted($language,$name)?></status>
<?php
  } else {
?>
<status><?=$lang_capability_not_granted[$language]?></status>
<?php
  }
  db_close($verbindung);
?>