From 3781581ec4dc3db4601e9067dfe9b9d9bc039c62 Mon Sep 17 00:00:00 2001
From: Grisu <grisu_steam@gmx.de>
Date: Sat, 18 Jun 2022 12:58:20 +0200
Subject: [PATCH] user group statistics can now only read statistics

---
 app/public/header_footer/header.php | 6 +++++-
 app/public/statistik.php            | 4 ++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/app/public/header_footer/header.php b/app/public/header_footer/header.php
index fd48af2..b232124 100644
--- a/app/public/header_footer/header.php
+++ b/app/public/header_footer/header.php
@@ -24,9 +24,13 @@
                         echo "<a href=\"mannschaft.php\">Mannschaftsverwaltung</a>\n";
                         echo "<a href=\"stationen.php\">Stationen</a>\n";
                     }
+                    if ($_SESSION['user_group'] == 'statistics') {
+                        echo "<a href=\"statistik.php\">Ergebnisse</a>";
+                    } else {
+                        echo "<a href=\"statistik.php\">Ergebnisse eintragen</a>";
+                    }
                 }
             ?>
-            <a href="statistik.php">Ergebnisse eintragen</a>
         </nav>
         </section>
     </header>
\ No newline at end of file
diff --git a/app/public/statistik.php b/app/public/statistik.php
index 43710a7..ca1bcb8 100644
--- a/app/public/statistik.php
+++ b/app/public/statistik.php
@@ -39,14 +39,14 @@
                 echo "</select>
                     </form>";
             }
-            if($session != "total-score" && get_teams_no_points($con, $session)->rowCount() > 0) {
+            if($session != "total-score" && get_teams_no_points($con, $session)->rowCount() > 0 && $user_data['user_group'] != 'statistics') {
                 echo "<form action=\"add_entry.php\" method=\"get\">
                 <input type=\"hidden\" name=\"station\" value=\"$session\"/> 
                 <input type=\"submit\" value=\"Ergebniss eintragen\"/>
                 </form>\n";
             }
 
-            if ($session != "total-score") {
+            if ($session != "total-score" && $user_data['user_group'] != 'statistics') {
                 //add edit button
                 echo "<div>
                     <form action=\"edit_statistics.php\" method=\"get\">