<?

  function flow_dept_priv ($DEPT_ID)
  {
    global $connection;
    global $QUERY_PRIV;
    $query = '' . 'SELECT * from USER where DEPT_ID=\'' . $DEPT_ID . '\' and NOT_LOGIN!=\'1\' ' . $QUERY_PRIV;
    $cursor = exequery ($connection, $query);
    if ($ROW = mysql_fetch_array ($cursor))
    {
      return 1;
    }
    else
    {
      return 0;
    }

  }

  function deptlisttree ($PARENT_ID)
  {
    global $connection;
    global $LOGIN_USER_ID;
    global $LOGIN_DEPT_ID;
    global $LOGIN_USER_PRIV;
    global $PARA_URL;
    global $PARA_TARGET;
    global $FLOW_ID;
    global $RUN_ID;
    global $PRCS_ID;
    global $PRCS_ID_NEXT;
    $DEPT_PRIV = flow_dept_priv ($PARENT_ID);
    $query = '' . 'SELECT * from DEPARTMENT where DEPT_PARENT=' . $PARENT_ID . ' order by DEPT_NO';
    $cursor1 = exequery ($connection, $query);
    while ($ROW = mysql_fetch_array ($cursor1))
    {
      $DEPT_ID1 = $ROW['DEPT_ID'];
      $DEPT_NAME1 = $ROW['DEPT_NAME'];
      $DEPT_NAME1 = str_replace ('&', '&amp;', $DEPT_NAME1);
      $DEPT_NAME1 = str_replace ('"', '&quot;', $DEPT_NAME1);
      $DEPT_NAME1 = str_replace ('<', '&lt;', $DEPT_NAME1);
      $DEPT_NAME1 = str_replace ('>', '&gt;', $DEPT_NAME1);
      $DEPT_NAME1 = stripslashes ($DEPT_NAME1);
      $CHILD_TEXT = deptlisttree ($DEPT_ID1);
      $DEPT_PRIV1 = flow_dept_priv ($DEPT_ID1);
      if ($DEPT_PRIV1 == 1)
      {
        $XML_TEXT_DEPT .= '' . '<TreeNode id="' . $DEPT_ID1 . '" text="[' . $DEPT_NAME1 . ']" ';
      }
      else
      {
        $XML_TEXT_DEPT .= '' . '<TreeNode id="' . $DEPT_ID1 . '" text="' . $DEPT_NAME1 . '" ';
      }

      if (($PARA_URL != '' AND $DEPT_PRIV1 == 1))
      {
        $URL = '' . $PARA_URL . '?DEPT_ID=' . $DEPT_ID1 . '&amp;FLOW_ID=' . $FLOW_ID . '&amp;RUN_ID=' . $RUN_ID . '&amp;PRCS_ID=' . $PRCS_ID . '&amp;PRCS_ID_NEXT=' . $PRCS_ID_NEXT;
        $XML_TEXT_DEPT .= ('' . 'href="' . $URL . '" target="' . $PARA_TARGET . '"');
      }
      else
      {
        $XML_TEXT_DEPT .= 'href="#" target="_self"';
      }

      $XML_TEXT_DEPT .= ('' . ' img_src="/images/node_dept.gif" title="' . $DEPT_NAME1 . '"');
      if ($CHILD_TEXT != '')
      {
        $XML_TEXT_DEPT .= ('' . ' Xml="dept_list/tree.php?DEPT_ID=' . $DEPT_ID1 . '&amp;PARA_URL=' . $PARA_URL . '&amp;PARA_TARGET=' . $PARA_TARGET . '&amp;FLOW_ID=' . $FLOW_ID . '&amp;RUN_ID=' . $RUN_ID . '&amp;PRCS_ID=' . $PRCS_ID . '&amp;PRCS_ID_NEXT=' . $PRCS_ID_NEXT . '"');
      }

      $XML_TEXT_DEPT .= '/>
';
    }

    return $XML_TEXT_DEPT;
  }

  include_once 'inc/auth.php';
  include_once 'inc/utility_all.php';
  ob_end_clean ();
  header ('Content-type: text/xml');
  $query = '' . 'SELECT * from FLOW_PROCESS where FLOW_ID=' . $FLOW_ID . ' and PRCS_ID=' . $PRCS_ID_NEXT;
  $cursor = exequery ($connection, $query);
  if ($ROW = mysql_fetch_array ($cursor))
  {
    $PRCS_USER = $ROW['PRCS_USER'];
    $PRCS_DEPT = $ROW['PRCS_DEPT'];
    $PRCS_PRIV = $ROW['PRCS_PRIV'];
  }

  $QUERY_PRIV = ' and (1=2 ';
  if ($PRCS_USER != '')
  {
    if (substr ($PRCS_USER, -1) == ',')
    {
      $PRCS_USER = substr ($PRCS_USER, 0, -1);
    }

    $PRCS_USER = '\'' . str_replace (',', '\',\'', $PRCS_USER) . '\'';
    $QUERY_PRIV .= '' . ' or USER_ID in(' . $PRCS_USER . ')';
  }

  if ($PRCS_DEPT != '')
  {
    if (substr ($PRCS_DEPT, -1) == ',')
    {
      $PRCS_DEPT = substr ($PRCS_DEPT, 0, -1);
    }

    $QUERY_PRIV .= '' . ' or DEPT_ID in(' . $PRCS_DEPT . ')';
  }

  if ($PRCS_PRIV != '')
  {
    if (substr ($PRCS_PRIV, -1) == ',')
    {
      $PRCS_PRIV = substr ($PRCS_PRIV, 0, -1);
    }

    $QUERY_PRIV .= '' . ' or USER.USER_PRIV in(' . $PRCS_PRIV . ')';
  }

  $QUERY_PRIV .= ') ';
  $PARENT_ID = $DEPT_ID;
  echo '<?xml version="1.0" encoding="gb2312"?>
';
  echo '<TreeNode>
';
  if ($PARENT_ID == 0)
  {
    $query = 'SELECT * from UNIT';
    $cursor = exequery ($connection, $query);
    if ($ROW = mysql_fetch_array ($cursor))
    {
      $UNIT_NAME = $ROW['UNIT_NAME'];
    }

    $UNIT_NAME = str_replace ('&', '&amp;', $UNIT_NAME);
    $UNIT_NAME = str_replace ('<', '&lt;', $UNIT_NAME);
    $UNIT_NAME = str_replace ('>', '&gt;', $UNIT_NAME);
    $UNIT_NAME = str_replace ('"', '&quot;', $UNIT_NAME);
    $UNIT_NAME = stripslashes ($UNIT_NAME);
    echo '' . '  <TreeNode id="0" text="' . $UNIT_NAME . '" Xml="" img_src="/images/menu/system.gif">
';
    echo deptlisttree ($PARENT_ID);
    echo '  </TreeNode>
';
  }
  else
  {
    echo deptlisttree ($PARENT_ID);
  }

  echo '</TreeNode>
';
?>