  def query
    Log.add_info(request, '')   # Not to show passwords.

    unless @login_user.admin?(User::AUTH_ZEPTAIR)
      render(:text => 'ERROR:' + t('msg.need_to_be_admin'))
      return
    end

    target_user = nil

    user_id = params[:user_id]
    zeptair_id = params[:zeptair_id]
    group_id = params[:group_id]
    SqlHelper.validate_token([user_id, zeptair_id, group_id])

    unless user_id.blank?
      target_user = User.find(user_id)
    end

    unless zeptair_id.blank?
      target_user = User.where("zeptair_id=#{zeptair_id}").first
    end

    if target_user.nil?

      if group_id.blank?
        sql = 'select distinct Item.* from items Item, attachments Attachment'
        sql << " where Item.xtype='#{Item::XTYPE_ZEPTAIR_POST}' and Item.id=Attachment.item_id"
        sql << ' order by Item.user_id ASC'
      else
        group_ids = [group_id]

        if params[:recursive] == 'true'
          group_ids += Group.get_childs(group_id, true, false)
        end

        groups_con = []
        group_ids.each do |grp_id|
          groups_con << SqlHelper.get_sql_like(['User.groups'], "|#{grp_id}|")
        end
        sql = 'select distinct Item.* from items Item, attachments Attachment, users User'
        sql << " where Item.xtype='#{Item::XTYPE_ZEPTAIR_POST}' and Item.id=Attachment.item_id"
        sql << " and (Item.user_id=User.id and (#{groups_con.join(' or ')}))"
        sql << ' order by Item.user_id ASC'
      end

      @post_items = Item.find_by_sql(sql)
    else
      @post_item = ZeptairPostHelper.get_item_for(target_user)
    end

  rescue => evar
    Log.add_error(request, evar)
    render(:text => 'ERROR:' + t('msg.system_error'))
  end