0052-WebUI-Fix-ESP-Security.patch

--- occu/WebUI/www/rega/esp/programs.fn.orig
+++ occu/WebUI/www/rega/esp/programs.fn
@@ -717,7 +717,8 @@
 
 function ::SetActive()
 {
-  if( system.IsVar("id") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("id")) )
   {
     object oTmp = dom.GetObject( system.GetVar("id") );
     if( oTmp )
@@ -737,7 +738,8 @@
 
 function ::SetVisible()
 {
-  if( system.IsVar("id") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("id")) )
   {
     object oTmp = dom.GetObject( system.GetVar("id") );
     if( oTmp )
@@ -757,7 +759,8 @@
 
 function ::SetOperate()
 {
-  if( system.IsVar("id") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("id")) )
   {
     object oTmp = dom.GetObject( system.GetVar("id") );
     if( oTmp )
@@ -827,7 +830,8 @@
 
 function ::DeleteProgram()
 {
-  if( system.IsVar("id") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("id")) )
   {
     object oTmp = dom.GetObject( system.GetVar("id") );
     if( oTmp )
@@ -865,7 +869,8 @@
 
 function ::CopyToNewProgram()
 {
-  if( system.IsVar("id") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("id")) )
   {
     object oCopy = dom.GetObject( system.GetVar("id") );
     if( oCopy )
@@ -906,19 +911,23 @@
 
 function ::NewProgram()
 {
-  object oPTmp = dom.GetObject( ID_PROGRAMS );
-  object oTmp = dom.CreateObject( OT_PROGRAM );
-  boolean bRet = false;
-  if( oTmp )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( oUser.UserLevel() == iulAdmin )
   {
-    !oTmp.Name( "Neues Programm" );
-    oTmp.Name( "${ruleTmpProgramName}" );
-    boolean bF1 = oPTmp.Add( oTmp.ID() );
-    boolean bF2 = system.SetSessionVar("sessionPRGID", oTmp.ID());
-    boolean bF3 = system.SetSessionVar("sessionORIGPRGID", oTmp.ID());
-    if( bF1 && bF2 && bF3 ) { bRet = true; }
+    object oPTmp = dom.GetObject( ID_PROGRAMS );
+    object oTmp = dom.CreateObject( OT_PROGRAM );
+    boolean bRet = false;
+    if( oTmp )
+    {
+      !oTmp.Name( "Neues Programm" );
+      oTmp.Name( "${ruleTmpProgramName}" );
+      boolean bF1 = oPTmp.Add( oTmp.ID() );
+      boolean bF2 = system.SetSessionVar("sessionPRGID", oTmp.ID());
+      boolean bF3 = system.SetSessionVar("sessionORIGPRGID", oTmp.ID());
+      if( bF1 && bF2 && bF3 ) { bRet = true; }
+    }
+    Write( bRet );
   }
-  Write( bRet );
   return;
 }
 
@@ -976,7 +985,8 @@
 
 function ::AddCondition()
 {
-  if( system.IsVar("rid") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("rid")) )
   {
     object oTmp = dom.GetObject( system.GetVar("rid") );
     if( oTmp )
@@ -1011,7 +1021,8 @@
 
 function ::DeleteCondition()
 {
-  if( system.IsVar("rid") && system.IsVar("cid") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("rid")) && (system.IsVar("cid")) )
   {
     object oTmp = dom.GetObject( system.GetVar("rid") );
     if( oTmp )
@@ -1023,7 +1034,8 @@
 
 function ::AddSingleCondition()
 {
-  if( system.IsVar("cid") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("cid")) )
   {
     object oTmp = dom.GetObject( system.GetVar("cid") );
     if( oTmp )
@@ -1053,7 +1065,8 @@
 
 function ::DeleteSingleCondition()
 {
-  if( system.IsVar("cid") && system.IsVar("sid") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("cid")) && (system.IsVar("sid")) )
   {
     object oTmp = dom.GetObject( system.GetVar("cid") );
     if( oTmp )
@@ -1076,7 +1089,8 @@
 
 function ::AddSingleDestination()
 {
-  if( system.IsVar("did") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("did")) )
   {
     object oTmp = dom.GetObject( system.GetVar("did") );
     if( oTmp )
@@ -1088,7 +1102,8 @@
 
 function ::DeleteSingleDestination()
 {
-  if( system.IsVar("did") && system.IsVar("sid") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("did")) && (system.IsVar("sid")) )
   {
     object oTmp = dom.GetObject( system.GetVar("did") );
     if( oTmp )
@@ -1100,7 +1115,8 @@
 
 function ::AddSubRule()
 {
-  if( system.IsVar("rid") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("rid")) )
   {
     object oTmp = dom.GetObject( system.GetVar("rid") );
     if( oTmp )
@@ -1112,7 +1128,8 @@
 
 function ::AddSubRuleDest()
 {
-  if( system.IsVar("rid") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("rid")) )
   {
     object oTmp = dom.GetObject( system.GetVar("rid") );
     if( oTmp )
@@ -1132,7 +1149,8 @@
 
 function ::AddSubRuleBOR()
 {
-  if( system.IsVar("rid") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("rid")) )
   {
     object oTmp = dom.GetObject( system.GetVar("rid") );
     if( oTmp )
@@ -1150,7 +1168,8 @@
 
 function ::AddNewElseRule()
 {
-  if( system.IsVar("rid") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("rid")) )
   {
     object oTmp = dom.GetObject( system.GetVar("rid") );
     if( oTmp )
@@ -1175,7 +1194,8 @@
 
 function ::DeleteSubRule()
 {
-  if( system.IsVar("rid") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("rid")) )
   {
     object oTmp = dom.GetObject( system.GetVar("rid") );
     if( oTmp )
@@ -1187,7 +1207,8 @@
 
 function ::SetOperatorType()
 {
-  if( system.IsVar("id") && system.IsVar("value") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar("id")) && (system.IsVar("value")) )
   {
     object oTmp = dom.GetObject( system.GetVar("id") );
     if( oTmp )
--- occu/WebUI/www/rega/esp/system.fn.orig
+++ occu/WebUI/www/rega/esp/system.fn
@@ -112,7 +112,11 @@
 
 function ::ClearHistoryData()
 {
-  Write( dom.ClearHistoryData() );
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() != iulGuest) && (oUser.UserLevel() != iulNone) )
+  {
+    Write( dom.ClearHistoryData() );
+  }
   return;
 }
 
@@ -168,7 +172,8 @@
 ![id]
 function ::DeleteObject()
 {
-  if( system.IsVar( "id" ) )
+  object oUser = dom.GetObject( system.GetSessionVar( "sessionUserID" ) );
+  if( (oUser.UserLevel() == iulAdmin) && (system.IsVar( "id" )) )
   {
     object o = dom.GetObject( system.GetVar( "id" ) );
     if( o )
@@ -227,7 +232,8 @@
 ! [id], [name]
 function ::saveName()
 {
-  if( system.IsVar("id") && system.IsVar("name") )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() != iulGuest) && (oUser.UserLevel() != iulNone) && (system.IsVar("id")) && (system.IsVar("name")))
   {
     object o = dom.GetObject( system.GetVar("id") );
     if( o )
@@ -269,18 +275,25 @@
 
 ! [objId], [desc]
 function ::saveDesc() {
-  object obj = dom.GetObject(system.GetVar("objId"));
-  if (obj)
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() != iulGuest) && (oUser.UserLevel() != iulNone) )
   {
-    if( obj.IsTypeOf( OT_ENUM ) ) { Write( "ENUM|"#obj.EnumInfo(system.GetVar("desc")) ); }
-    if( obj.IsTypeOf( OT_DP ) ) { Write( "DP|"#obj.DPInfo(system.GetVar("desc")) ); }
-    if( obj.IsTypeOf( OT_PROGRAM ) ) { Write( "PRG|"#obj.PrgInfo(system.GetVar("desc")) ); }
+    object obj = dom.GetObject(system.GetVar("objId"));
+    if (obj)
+    {
+      if( obj.IsTypeOf( OT_ENUM ) ) { Write( "ENUM|"#obj.EnumInfo(system.GetVar("desc")) ); }
+      if( obj.IsTypeOf( OT_DP ) ) { Write( "DP|"#obj.DPInfo(system.GetVar("desc")) ); }
+      if( obj.IsTypeOf( OT_PROGRAM ) ) { Write( "PRG|"#obj.PrgInfo(system.GetVar("desc")) ); }
+    }
   }
   return;
 }
 
 function ::UpdateUI()
 {
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( (oUser.UserLevel() != iulGuest) && (oUser.UserLevel() != iulNone) )
+  {
   Write( '<script type="text/javascript">' );
 
   string sTime = system.Date( "%H:%M" );
@@ -588,6 +601,7 @@
   }
   Write( 'SwitchOffFlashLight();' );
   Write( '</script>' );
+  }
   return;
 }
 
@@ -740,6 +754,9 @@
   ! [sTrue], [sFalse]
 function ::saveSysVar()
 {
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( oUser.UserLevel() == iulAdmin )
+  {
   integer ist = system.GetVar("iSubType"); 
   object oChn = dom.GetObject( system.GetVar("iChnId") );
 
@@ -772,13 +789,14 @@
     {
       ch.DPs().Remove( sv.ID() );
     }
+
     if( (ist == istAlarm) && (sv.ValueSubType() != istAlarm) )
     {
       dom.DeleteObject( sv.ID() );
       sv = dom.CreateObject( OT_ALARMDP, system.GetVar("sName") );
       oSysVars.Add( sv.ID() );
     }
-    if( (ist != istAlarm ) && (sv.ValueSubType() == istAlarm) )
+    elseif( (ist != istAlarm ) && (sv.ValueSubType() == istAlarm) )
     {
       dom.DeleteObject( sv.ID() );
       sv = dom.CreateObject( OT_VARDP, system.GetVar("sName") );
@@ -798,7 +816,7 @@
     sv.AlType(atSystem);
     sv.AlArm(true);
   }
-  if (ist == istBool)
+  elseif (ist == istBool)
   {
     sv.ValueType( ivtBinary );
     sv.ValueSubType( istBool );
@@ -806,7 +824,7 @@
     sv.ValueName0(system.GetVar("sFalse"));
     sv.State(false);
   }
-  if (ist == istGeneric)
+  elseif (ist == istGeneric)
   {
     sv.ValueType( ivtFloat );
     sv.ValueSubType( istGeneric );
@@ -814,19 +832,20 @@
     sv.ValueMax(system.GetVar("iMaxVal"));
     sv.State(system.GetVar("iMinVal"));
   }
-  if (ist == istEnum)
+  elseif (ist == istEnum)
   {
     sv.ValueType( ivtInteger );
     sv.ValueSubType( istEnum );
     sv.ValueList(system.GetVar("sValList"));
     sv.State(0);
   }
-  if (ist == istChar8859)
+  elseif (ist == istChar8859)
   {
     sv.ValueType(ivtString);
     sv.ValueSubType(istChar8859);
     sv.State("???");
   }
+
   if (oChn) 
   {
     oChn.DPs().Add( sv.ID() );
@@ -842,37 +861,49 @@
     sv.Channel( ID_ERROR );
   }
   dom.RTUpdate(0);
+  }
   return;
 }
 
 ! [id], [iProto]
 function ::saveDpProto() {
-  object obj = dom.GetObject(system.GetVar("dpId"));
-  if (obj) {
-    boolean b = false;
-    if (system.GetVar("iProto") == 1) {
-      b = true;
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( oUser.UserLevel() == iulAdmin )
+  {
+    object obj = dom.GetObject(system.GetVar("dpId"));
+    if (obj) {
+      boolean b = false;
+      if (system.GetVar("iProto") == 1) {
+        b = true;
+      }
+      obj.DPArchive(b);
     }
-    obj.DPArchive(b);
   }
   return;
 }
 
 ! [id], [iVisible]
 function ::saveDpVisibility() {
-  object obj = dom.GetObject(system.GetVar("dpId"));
-  if (obj) {
-    boolean b = false;
-    if (system.GetVar("iVisible") == 1) {
-      b = true;
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( oUser.UserLevel() == iulAdmin )
+  {
+    object obj = dom.GetObject(system.GetVar("dpId"));
+    if (obj) {
+      boolean b = false;
+      if (system.GetVar("iVisible") == 1) {
+        b = true;
+      }
+      obj.Visible(b);
     }
-    obj.Visible(b);
   }
   return;
 }
 
 function ::saveTimeModule()
 {
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( oUser.UserLevel() == iulAdmin )
+  {
   Write( '<script type="text/javascript">' );
   string sCI = "saveTimeModule: ";
   object tmObj;
@@ -943,6 +974,7 @@
   sCI = sCI#".";
   Write( 'conInfo("'#sCI#'");' );
   Write( '</script>' );
+  }
   return;
 }
 
@@ -1026,97 +1058,117 @@
 }
 
 function ::saveUserPwd() {
-  integer uid = system.GetVar("userId");
-  string pwd = system.GetVar("pw");
-  object user = dom.GetObject(uid);
-  if (user) {
-    user.UserBlankPwd(pwd);
-    if (pwd != "") {
-      Write("Password for user "#user.Name()#" set!");
-    } else {
-      Write("Password for user "#user.Name()#" cleared!");
+  integer uid = system.GetSessionVar("sessionUserID");
+  object oUser = dom.GetObject( uid );
+  if( (oUser.UserLevel() != iulGuest) && (oUser.UserLevel() != iulNone) )
+  {
+    integer targetUID = system.GetVar("userId");
+    if( (targetUID == uid) || (oUser.UserLevel() == iulAdmin) )
+    {
+      string pwd = system.GetVar("pw");
+      object user = dom.GetObject(targetUID);
+      if (user) {
+        user.UserBlankPwd(pwd);
+        if (pwd != "") {
+          Write("Password for user "#user.Name()#" set!");
+        } else {
+          Write("Password for user "#user.Name()#" cleared!");
+        }
+      } else {
+        Write("User unknown");
+      }
     }
-  } else {
-    Write("User unknown");
   }
 }
 
 function ::saveUser() {
-  integer uid = system.GetVar("iUserid");
-  if (uid == 0) {
-    object users = dom.GetObject(ID_USERS);
-    object user = users.UsersAdd();
-    user.UserBlankPwd(system.GetVar("pw"));
-    string tmp = "";
-    foreach (tmp, system.GetVar("sSysVars")) {
-      user.UserSharedObjects().Add(tmp);
-    }
-  }
-  else {
-    object user = dom.GetObject(uid);
-    if (system.GetVar("iPwChanged") == 1) {
-      user.UserBlankPwd(system.GetVar("pw"));
-    }    
-  }
-  user.Name(system.GetVar("userName"));
-  user.UserFirstName(system.GetVar("firstName"));
-  user.UserLastName(system.GetVar("lastName"));
-  user.UserEasyLinkMode(system.GetVar("bEasy"));
-  user.UserLevel(system.GetVar("level"));
-  user.UserPhoneNumber(system.GetVar("phone"));
-  user.UserMailAddress(system.GetVar("mail"));
-  boolean bLogin = false;
-  if (system.GetVar("iLogin") == 1) {
-    bLogin = true;
-  }
-  user.UserShowLogin(bLogin);
-  user.UserClient(system.GetVar("dev"));
-  
-  Write( "FAV=[" );
-  object oFavorites = dom.GetObject( ID_FAVORITES );
-  if( oFavorites )
-  {
-    object oUserFavorite = dom.GetObject( "_USER"#user.ID() );
-    if( !oUserFavorite )
-    {
-      object oUserFavorite = dom.CreateObject( OT_FAVORITE, "_USER"#user.ID() );
-    }
-    if( oUserFavorite )
-    {
-      Write( "2:OK|" );
-      Write( "3:" );
-      Write( oUserFavorite.EnumType( etFavorite ) );
-      Write( "|" );
-      Write( "4:" );
-      Write( oUserFavorite.Visible( false ) );
-      Write( "|" );
-      Write( "5:" );      
-      Write( oFavorites.Add( oUserFavorite.ID() ) );
+  integer uid = system.GetSessionVar("sessionUserID");
+  object oUser = dom.GetObject( uid );
+  if( (oUser.UserLevel() != iulGuest) && (oUser.UserLevel() != iulNone) )
+  {
+    integer targetUID = system.GetVar("iUserid");
+    if( (targetUID == uid) || (oUser.UserLevel() == iulAdmin) )
+    {
+      if (targetUID == 0) {
+        object users = dom.GetObject(ID_USERS);
+        object user = users.UsersAdd();
+        user.UserBlankPwd(system.GetVar("pw"));
+        string tmp = "";
+        foreach (tmp, system.GetVar("sSysVars")) {
+          user.UserSharedObjects().Add(tmp);
+        }
+      }
+      else {
+        object user = dom.GetObject(targetUID);
+        if (system.GetVar("iPwChanged") == 1) {
+          user.UserBlankPwd(system.GetVar("pw"));
+        }    
+      }
+      user.Name(system.GetVar("userName"));
+      user.UserFirstName(system.GetVar("firstName"));
+      user.UserLastName(system.GetVar("lastName"));
+      user.UserEasyLinkMode(system.GetVar("bEasy"));
+      user.UserLevel(system.GetVar("level"));
+      user.UserPhoneNumber(system.GetVar("phone"));
+      user.UserMailAddress(system.GetVar("mail"));
+      boolean bLogin = false;
+      if (system.GetVar("iLogin") == 1) {
+        bLogin = true;
+      }
+      user.UserShowLogin(bLogin);
+      user.UserClient(system.GetVar("dev"));
+      
+      Write( "FAV=[" );
+      object oFavorites = dom.GetObject( ID_FAVORITES );
+      if( oFavorites )
+      {
+        object oUserFavorite = dom.GetObject( "_USER"#user.ID() );
+        if( !oUserFavorite )
+        {
+          object oUserFavorite = dom.CreateObject( OT_FAVORITE, "_USER"#user.ID() );
+        }
+        if( oUserFavorite )
+        {
+          Write( "2:OK|" );
+          Write( "3:" );
+          Write( oUserFavorite.EnumType( etFavorite ) );
+          Write( "|" );
+          Write( "4:" );
+          Write( oUserFavorite.Visible( false ) );
+          Write( "|" );
+          Write( "5:" );      
+          Write( oFavorites.Add( oUserFavorite.ID() ) );
+        }
+      }
+      Write( "]" );
     }
   }
-  Write( "]" );
 }
 
 function ::deleteUser()
 {
-  object oUser = dom.GetObject( system.GetVar("userid") );
-  if( oUser )
+  object oUser = dom.GetObject( system.GetSessionVar("sessionUserID") );
+  if( oUser.UserLevel() == iulAdmin )
   {
-    if( !oUser.Unerasable() )
+    oUser = dom.GetObject( system.GetVar("userid") );
+    if( oUser )
     {
-      object oFavorites = dom.GetObject( ID_FAVORITES );
-      if( oFavorites )
-      { 
-        oFavorites.Remove( oUser.UserFavorite() );
-      }
-      dom.DeleteObject( oUser.UserFavorite() );
-    
-      object oUsers = dom.GetObject( ID_USERS );
-      if( oUsers )
+      if( !oUser.Unerasable() )
       {
-        oUsers.Remove( oUser.ID() );
+        object oFavorites = dom.GetObject( ID_FAVORITES );
+        if( oFavorites )
+        { 
+          oFavorites.Remove( oUser.UserFavorite() );
+        }
+        dom.DeleteObject( oUser.UserFavorite() );
+      
+        object oUsers = dom.GetObject( ID_USERS );
+        if( oUsers )
+        {
+          oUsers.Remove( oUser.ID() );
+        }
+        dom.DeleteObject( oUser.ID() );
       }
-      dom.DeleteObject( oUser.ID() );
     }
   }
 }
@@ -1233,11 +1285,21 @@
 
 ! [newSvId], [opt: userId]
 function ::AddSysVarAndBuildTable() {
-  if (system.GetVar("userid") != 0) {
-    object user = dom.GetObject(system.GetVar("userId"));
-    user.UserSharedObjects().Add(system.GetVar("newSvId"));
+  integer uid = system.GetSessionVar("sessionUserID");
+  object oUser = dom.GetObject( uid );
+  if( (oUser.UserLevel() != iulGuest) && (oUser.UserLevel() != iulNone) )
+  {
+    integer targetUID = system.GetVar("userId");
+    if( targetUID != 0 )
+    {
+      if( (targetUID == uid) || (oUser.UserLevel() == iulAdmin) )
+      {
+        object user = dom.GetObject(targetUID);
+        user.UserSharedObjects().Add(system.GetVar("newSvId"));
+      }
+    }
+    Call("system.fn::BuildUserSvTable()");
   }
-  Call("system.fn::BuildUserSvTable()");
   return;
 }
 
@@ -1325,17 +1387,27 @@
 
 ! [userId], [svId]
 function ::UserDeleteSysVarBuildTable() {
-  object user = dom.GetObject(system.GetVar("userId"));
-  if (user) {
-    user.UserSharedObjects().Remove(system.GetVar("svId"));
-    Call("system.fn::BuildUserSvTable()");
+  integer uid = system.GetSessionVar("sessionUserID");
+  object oUser = dom.GetObject( uid );
+  if( (oUser.UserLevel() != iulGuest) && (oUser.UserLevel() != iulNone) )
+  {
+    integer targetUID = system.GetVar("userId");
+    if( (targetUID == uid) || (oUser.UserLevel() == iulAdmin) )
+    {
+      object user = dom.GetObject(targetUID);
+      if (user) 
+      {
+        user.UserSharedObjects().Remove(system.GetVar("svId"));
+        Call("system.fn::BuildUserSvTable()");
+      }
+    }
   }
   return;
 }
 
 ! [alPC], [alPDA]
 function ::setAutoLogin() {
- object oUser = dom.GetObject(system.GetSessionVar("sessionUserID"));
+  object oUser = dom.GetObject(system.GetSessionVar("sessionUserID"));
   if (oUser.UserLevel() == iulAdmin) {
     object users = dom.GetObject(ID_USERS);
     if (users) {