Ensembia/QRForge-selfhosted
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fase 2: read-only user role with per-category view toggles

Browse Source 
Adds a third account type 'user' alongside super/admin: no create/edit/delete
rights on qr codes, view access to dynamic/static lists gated per-account by
two admin-controlled toggles (can_view_static, can_view_dynamic), and always
full visibility into the dashboard/reports regardless of those toggles.

- New columns can_view_static/can_view_dynamic on users (migrations/003)
- Users class + form_users.php: 'user' type option with the two toggles
- Access control: dynamic_qrcode.php/static_qrcode.php/bulk_action.php reject
  all mutations for type=user; dynamic_qrcodes.php/static_qrcodes.php enforce
  the view toggle and show all codes (no owner scoping, since 'user' owns none)
- Sidebar and list tables hide add/edit/delete/bulk UI for the read-only role
- index.php dashboard stats are unscoped for both 'super' and 'user'
This commit is contained in:
Dillard Blom
2026-07-08 16:37:25 +02:00
parent 3afe3b7698
commit 52c9f65c61
15 changed files with 163 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
db/init.sql
+2
View File
@@ -16,6 +16,8 @@ CREATE TABLE IF NOT EXISTS `users` (
`type` varchar(10) NOT NULL,
`must_change_password` tinyint(1) NOT NULL DEFAULT 0,
`password_changed_at` datetime DEFAULT NULL,
`can_view_static` tinyint(1) NOT NULL DEFAULT 0,
`can_view_dynamic` tinyint(1) NOT NULL DEFAULT 0,
PRIMARY KEY (`id`),
UNIQUE KEY `username` (`username`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=0 ;
db/migrations/003_user_role.sql
+22
View File
@@ -0,0 +1,22 @@
-- Fase 2: read-only 'user' rol met twee zichtbaarheids-toggles.
-- type='user' vereist geen schemawijziging (varchar(10), geen enum-constraint).
SET @db := DATABASE();
SET @col_exists := (
SELECT COUNT(*) FROM information_schema.COLUMNS
WHERE TABLE_SCHEMA = @db AND TABLE_NAME = 'users' AND COLUMN_NAME = 'can_view_static'
);
SET @sql := IF(@col_exists = 0,
'ALTER TABLE `users` ADD COLUMN `can_view_static` TINYINT(1) NOT NULL DEFAULT 0',
'SELECT 1');
PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
SET @col_exists := (
SELECT COUNT(*) FROM information_schema.COLUMNS
WHERE TABLE_SCHEMA = @db AND TABLE_NAME = 'users' AND COLUMN_NAME = 'can_view_dynamic'
);
SET @sql := IF(@col_exists = 0,
'ALTER TABLE `users` ADD COLUMN `can_view_dynamic` TINYINT(1) NOT NULL DEFAULT 0',
'SELECT 1');
PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
src/authenticate.php
+2
View File
@@ -40,6 +40,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST')
$_SESSION['user_id'] = $row['id'];
$_SESSION['username'] = $row['username'];
$_SESSION['must_change_password'] = !empty($row['must_change_password']);
$_SESSION['can_view_static'] = !empty($row['can_view_static']);
$_SESSION['can_view_dynamic'] = !empty($row['can_view_dynamic']);
$_SESSION['last_activity'] = time();
audit_log('login_success');
src/bulk_action.php
+16 -1
View File
@@ -35,9 +35,18 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
exit();
}
if ($_SESSION['type'] === 'user') {
$view_flag = $type === 'dynamic' ? 'can_view_dynamic' : 'can_view_static';
if (empty($_SESSION[$view_flag] ?? null)) {
http_response_code(403);
echo json_encode(['data' => 'Not allowed to view this qr code type.', 'status' => 403]);
exit();
}
}
foreach ($params as $param) {
$db->where('id', $param);
if ($_SESSION['type'] !== 'super') {
if ($_SESSION['type'] === 'admin') {
$db->where('id_owner', $_SESSION['user_id']);
$db->orWhere('id_owner', NULL, 'IS');
}
@@ -69,6 +78,12 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
]);
exit();
} else if($json["action"] == "delete") {
if ($_SESSION['type'] === 'user') {
http_response_code(403);
echo json_encode(['data' => 'The "user" role is read-only.', 'status' => 403]);
exit();
}
$params = $json['params'];
if (isset($json['type']) && in_array($json['type'], $allowed_types, true)) {
src/dynamic_qrcode.php
+6
View File
@@ -3,6 +3,12 @@ require_once 'includes/bootstrap.php';
require_once BASE_PATH.'/includes/auth_validate.php';
require_once BASE_PATH . '/lib/DynamicQrcode/DynamicQrcode.php';
if ($_SESSION['type'] === 'user') {
$_SESSION['failure'] = 'The "user" role is read-only and cannot create, edit or delete qr codes.';
header('Location: index.php');
exit;
}
$dynamic_qrcode_instance = new DynamicQrcode();
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
src/dynamic_qrcodes.php
+10 -1
View File
@@ -3,6 +3,12 @@ require_once 'includes/bootstrap.php';
require_once BASE_PATH . '/includes/auth_validate.php';
require_once BASE_PATH . '/lib/DynamicQrcode/DynamicQrcode.php';
if ($_SESSION['type'] === 'user' && empty($_SESSION['can_view_dynamic'] ?? null)) {
$_SESSION['failure'] = 'You are not allowed to view dynamic qr codes.';
header('Location: index.php');
exit;
}
$db = getDbInstance();
$dynamic_qrcode = new DynamicQrcode();
@@ -12,7 +18,8 @@ require_once BASE_PATH . '/includes/search_order.php';
$page = filter_input(INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS) ?? 1;
$db->pageLimit = 15;
if($_SESSION['type'] !== 'super') {
// 'user' ziet, net als 'super', alle codes (heeft zelf geen eigen codes om op te scopen).
if($_SESSION['type'] === 'admin') {
$db->where("id_owner", $_SESSION['user_id']);
$db->orWhere ("id_owner", NULL, 'IS');
}
@@ -49,6 +56,7 @@ $total_pages = $db->totalPages;
<h1 class="m-0 text-dark">Dynamic Qr codes</h1>
</div><!-- /.col -->
<?php if ($_SESSION['type'] !== 'user'): ?>
<div class="col-sm-6">
<ol class="breadcrumb float-sm-right">
<li class="breadcrumb-item">
@@ -56,6 +64,7 @@ $total_pages = $db->totalPages;
</li>
</ol>
</div><!-- /.col -->
<?php endif; ?>
</div><!-- /.row -->
</div><!-- /.container-fluid -->
</div><!-- /.content-header -->
src/forms/form_users.php
+39
View File
@@ -38,8 +38,47 @@
<label class="radio">
<input type="radio" name="type" value="admin" required="required" <?php echo ($edit && $user['type'] =='admin') ? "checked": "" ; ?>/> Admin</label>
</div>
<div class="radio">
<label class="radio">
<input type="radio" name="type" value="user" required="required" id="type-user" <?php echo ($edit && $user['type'] =='user') ? "checked": "" ; ?>/> User (read-only)</label>
</div>
</div>
</div>
<div class="col-sm-12 mt-2" id="user-view-toggles">
<label>Zichtbaarheid voor 'User'-rol</label>
<div class="form-group">
<div class="icheck-primary d-inline-block mr-4">
<input type="checkbox" name="can_view_static" id="can_view_static" value="1" <?php echo ($edit && !empty($user['can_view_static'])) ? "checked": "" ; ?>>
<label for="can_view_static">Mag statische QR-codes bekijken</label>
</div>
<div class="icheck-primary d-inline-block">
<input type="checkbox" name="can_view_dynamic" id="can_view_dynamic" value="1" <?php echo ($edit && !empty($user['can_view_dynamic'])) ? "checked": "" ; ?>>
<label for="can_view_dynamic">Mag dynamische QR-codes bekijken</label>
</div>
<small class="form-text text-muted">Alleen van toepassing op het type 'User'. Reports/statistieken zijn voor 'User' altijd zichtbaar.</small>
</div>
</div>
<script>
(function () {
var typeRadios = document.querySelectorAll('input[name="type"]');
var toggles = document.getElementById('user-view-toggles');
function updateToggleVisibility() {
var userSelected = document.getElementById('type-user').checked;
toggles.style.display = userSelected ? '' : 'none';
}
typeRadios.forEach(function (radio) {
radio.addEventListener('change', updateToggleVisibility);
});
updateToggleVisibility();
})();
</script>
<?php if($edit) { ?>
<input type="hidden" name="id" value="<?php echo $user['id'];?>"/>
<input type="hidden" name="edit" value="true"/>
src/forms/table_dynamic.php
+12 -3
View File
@@ -1,4 +1,6 @@
<?php $is_readonly_user = $_SESSION['type'] === 'user'; ?>
<div class="row">
<?php if (!$is_readonly_user): ?>
<div class="col-12" id="bulk-action-div" style="display: none;">
<div id="err-msg"></div>
<div class="bulk-action-wrapper">
@@ -21,13 +23,16 @@
</form>
</div>
</div>
<?php endif; ?>
<div class="col-12">
<div class="card">
<div class="card-body table-responsive p-0">
<table class="table table-striped table-bordered">
<thead>
<tr>
<?php if (!$is_readonly_user): ?>
<th><input type="checkbox" name="bulk-select" value="1"></th>
<?php endif; ?>
<th>ID</th>
<th>Owner</th>
<th>Filename</th>
@@ -42,7 +47,9 @@
<tbody>
<?php foreach ($rows as $row): ?>
<tr>
<?php if (!$is_readonly_user): ?>
<td><input type="checkbox" name="action[]" value="<?=$row['id']?>" onchange="updateBulkActionVisibility()"></td>
<?php endif; ?>
<td><?php echo $row['id']; ?></td>
<td>
<?php
@@ -68,10 +75,10 @@
<td><?php echo htmlspecialchars($row['scan']); ?></td>
<td><?php echo htmlspecialchars($row['state']); ?></td>
<td>
<?php if (!$is_readonly_user): ?>
<!-- EDIT -->
<a href="dynamic_qrcode.php?edit=true&id=<?php echo $row['id']; ?>" class="btn btn-primary"><i class="fas fa-edit"></i></a>
<!-- DELETE -->
<a
class="btn btn-danger delete_btn"
@@ -79,7 +86,7 @@
data-target="#delete-modal"
data-del_id="<?php echo $row["id"];?>"
><i class="fas fa-trash"></i></a>
<?php endif; ?>
<!-- DOWNLOAD -->
<a href="<?php echo SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']); ?>" class="btn btn-primary" download><i class="fa fa-download"></i></a>
</td>
@@ -97,6 +104,7 @@
</div><!-- /.col -->
</div><!-- /.row -->
<?php if (!$is_readonly_user): ?>
<!-- Delete Confirmation Modal -->
<div class="modal fade" id="delete-modal" role="dialog">
<div class="modal-dialog">
@@ -122,6 +130,7 @@
</div>
</div>
<!-- /.Delete Confirmation Modal -->
<?php endif; ?>
<script>
const deleteButtons = document.querySelectorAll('.delete_btn');
src/forms/table_static.php
+12 -3
View File
@@ -1,4 +1,6 @@
<?php $is_readonly_user = $_SESSION['type'] === 'user'; ?>
<div class="row">
<?php if (!$is_readonly_user): ?>
<div class="col-12" id="bulk-action-div" style="display: none;">
<div id="err-msg"></div>
<div class="bulk-action-wrapper">
@@ -21,13 +23,16 @@
</form>
</div>
</div>
<?php endif; ?>
<div class="col-12">
<div class="card">
<div class="card-body table-responsive p-0">
<table class="table table-striped table-bordered">
<thead>
<tr>
<?php if (!$is_readonly_user): ?>
<th><input type="checkbox" name="bulk-select" value="1"></th>
<?php endif; ?>
<th>ID</th>
<th>Owner</th>
<th>Filename</th>
@@ -40,7 +45,9 @@
<tbody>
<?php foreach ($rows as $row): ?>
<tr>
<?php if (!$is_readonly_user): ?>
<td><input type="checkbox" name="action[]" value="<?=$row['id']?>" onchange="updateBulkActionVisibility()"></td>
<?php endif; ?>
<td><?php echo $row['id']; ?></td>
<td>
<?php
@@ -64,10 +71,10 @@
<?php echo '<img src="'.SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']).'" width="100" height="100">'; ?>
</td>
<td>
<?php if (!$is_readonly_user): ?>
<!-- EDIT -->
<a href="static_qrcode.php?edit=true&id=<?php echo $row['id']; ?>" class="btn btn-primary"><i class="fas fa-edit"></i></a>
<!-- DELETE -->
<a
class="btn btn-danger delete_btn"
@@ -75,7 +82,7 @@
data-target="#delete-modal"
data-del_id="<?php echo $row["id"];?>"
><i class="fas fa-trash"></i></a>
<?php endif; ?>
<!-- DOWNLOAD -->
<a href="<?php echo SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']); ?>" class="btn btn-primary" download><i class="fa fa-download"></i></a>
</td>
@@ -93,6 +100,7 @@
</div><!-- /.col -->
</div><!-- /.row -->
<?php if (!$is_readonly_user): ?>
<!-- Delete Confirmation Modal -->
<div class="modal fade" id="delete-modal" role="dialog">
<div class="modal-dialog">
@@ -118,6 +126,7 @@
</div>
</div>
<!-- /.Delete Confirmation Modal -->
<?php endif; ?>
<script>
const deleteButtons = document.querySelectorAll('.delete_btn');
src/includes/sidebar.php
+10
View File
@@ -33,6 +33,7 @@
</p>
</a>
</li>
<?php if ($_SESSION['type'] !== 'user' || !empty($_SESSION['can_view_dynamic'])): ?>
<li <?php echo ((substr(CURRENT_PAGE, 0, 19) == 'dynamic_qrcodes.php') || (substr(CURRENT_PAGE, 0, 18) == 'dynamic_qrcode.php')) ? ' class="nav-item has-treeview menu-open"' : ' class="nav-item has-treeview"'; ?>>
<a href="#" <?php echo ((substr(CURRENT_PAGE, 0, 19) == 'dynamic_qrcodes.php') || (substr(CURRENT_PAGE, 0, 18) == 'dynamic_qrcode.php')) ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
<i class="nav-icon fa fa-qrcode"></i>
@@ -48,14 +49,18 @@
<p>List all</p>
</a>
</li>
<?php if ($_SESSION['type'] !== 'user'): ?>
<li class="nav-item">
<a href="./dynamic_qrcode.php" <?php echo (CURRENT_PAGE == 'dynamic_qrcode.php') ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
<i class="far fa-circle nav-icon"></i>
<p>Add new</p>
</a>
</li>
<?php endif; ?>
</ul>
</li>
<?php endif; ?>
<?php if ($_SESSION['type'] !== 'user' || !empty($_SESSION['can_view_static'])): ?>
<li <?php echo ((substr(CURRENT_PAGE, 0, 18) == 'static_qrcodes.php') || (substr(CURRENT_PAGE, 0, 17) == 'static_qrcode.php')) ? ' class="nav-item has-treeview menu-open"' : ' class="nav-item has-treeview"'; ?>>
<a href="#" <?php echo ((substr(CURRENT_PAGE, 0, 18) == 'static_qrcodes.php') || (substr(CURRENT_PAGE, 0, 17) == 'static_qrcode.php')) ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
<i class="nav-icon fa fa-qrcode"></i>
@@ -71,20 +76,25 @@
<p>List all</p>
</a>
</li>
<?php if ($_SESSION['type'] !== 'user'): ?>
<li class="nav-item">
<a href="./static_qrcode.php" <?php echo (CURRENT_PAGE == 'static_qrcode.php') ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
<i class="far fa-circle nav-icon"></i>
<p>Add new</p>
</a>
</li>
<?php endif; ?>
</ul>
</li>
<?php endif; ?>
<?php if ($_SESSION['type'] === 'super'): ?>
<li class="nav-item">
<a href="./users.php" <?php echo ((substr(CURRENT_PAGE, 0, 15) == 'users.php') || (substr(CURRENT_PAGE, 0, 14) == 'user.php')) ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
<i class="fas fa-users nav-icon"></i>
<p>Users</p>
</a>
</li>
<?php endif; ?>
</ul>
</nav>
<!-- /.sidebar-menu -->
src/index.php
+9 -5
View File
@@ -4,15 +4,19 @@ require_once 'includes/auth_validate.php';
$db = getDbInstance();
// Reports/statistieken zijn voor de 'user'-rol altijd volledig zichtbaar (net als 'super'),
// ongeacht de can_view_static/can_view_dynamic toggles die alleen de qrcode-lijsten regelen.
$is_full_visibility = in_array($_SESSION['type'], ['super', 'user'], true);
//Get Dynamic qr code rows
if($_SESSION['type'] !== 'super') {
if(!$is_full_visibility) {
$db->where("id_owner", $_SESSION['user_id']);
$db->orWhere ("id_owner", NULL, 'IS');
}
$numQrcode_dynamic = $db->getValue("dynamic_qrcodes", "count(*)");
//Get Static qr code rows
if($_SESSION['type'] !== 'super') {
if(!$is_full_visibility) {
$db->where("id_owner", $_SESSION['user_id']);
$db->orWhere ("id_owner", NULL, 'IS');
}
@@ -21,7 +25,7 @@ $numQrcode_static = $db->getValue("static_qrcodes", "count(*)");
$total = $numQrcode_dynamic + $numQrcode_static;
//Get Total scan
if($_SESSION['type'] !== 'super') {
if(!$is_full_visibility) {
$db->where("id_owner", $_SESSION['user_id']);
$db->orWhere ("id_owner", NULL, 'IS');
}
@@ -31,7 +35,7 @@ $numScan = $db->getOne("dynamic_qrcodes", "sum(scan) as numScan");
//I initialize the variables that will contain the daily values to 0 otherwise in the foreach loop they will be reset every time
//Get the number of DYNAMIC qr code created in 7 days and total scan
if($_SESSION['type'] !== 'super')
if(!$is_full_visibility)
$createdQrcode_dynamic = $db->query("select `created_at`, `scan` from " . DATABASE_PREFIX . "dynamic_qrcodes where `created_at` > curdate()-7 AND (`id_owner`= " . $_SESSION['user_id'] . " OR `id_owner` IS NULL);");
else
$createdQrcode_dynamic = $db->query("select `created_at`, `scan` from ".DATABASE_PREFIX."dynamic_qrcodes where `created_at` > curdate()-7;");
@@ -54,7 +58,7 @@ foreach ($createdQrcode_dynamic as $row) {
/* SCAN CHART */
//Get the number of STATIC qr code created in 7 days
if($_SESSION['type'] !== 'super')
if(!$is_full_visibility)
$createdQrcode_static = $db->query("select `created_at` from " . DATABASE_PREFIX . "static_qrcodes where `created_at` > curdate()-7 AND (`id_owner`=" . $_SESSION['user_id'] . " OR `id_owner` IS NULL);");
else
$createdQrcode_static = $db->query("select `created_at` from ".DATABASE_PREFIX."static_qrcodes where `created_at` > curdate()-7;");
src/lib/Users/Users.php
+5 -1
View File
@@ -3,7 +3,7 @@ require_once 'config/config.php';
class Users
{
const ALLOWED_TYPES = ['super', 'admin'];
const ALLOWED_TYPES = ['super', 'admin', 'user'];
/**
*
@@ -87,6 +87,8 @@ class Users
$data_to_db["username"] = $input_data["username"];
$data_to_db['password'] = password_hash($input_data['password'], PASSWORD_DEFAULT);
$data_to_db["type"] = $input_data["type"];
$data_to_db['can_view_static'] = !empty($input_data['can_view_static']) ? 1 : 0;
$data_to_db['can_view_dynamic'] = !empty($input_data['can_view_dynamic']) ? 1 : 0;
$db->where('username', $data_to_db['username']);
$db->get('users');
@@ -133,6 +135,8 @@ class Users
$data_to_db["username"] = $input_data["username"];
$data_to_db["type"] = $input_data["type"];
$data_to_db['can_view_static'] = !empty($input_data['can_view_static']) ? 1 : 0;
$data_to_db['can_view_dynamic'] = !empty($input_data['can_view_dynamic']) ? 1 : 0;
// Alleen wachtwoord overschrijven als er een nieuwe waarde is opgegeven.
if (!empty($input_data['password'])) {
src/login.php
+2
View File
@@ -40,6 +40,8 @@ if (isset($_COOKIE['series_id']) && isset($_COOKIE['remember_token']))
$_SESSION['type'] = $row['type'];
$_SESSION['username'] = $row['username'];
$_SESSION['must_change_password'] = !empty($row['must_change_password']);
$_SESSION['can_view_static'] = !empty($row['can_view_static']);
$_SESSION['can_view_dynamic'] = !empty($row['can_view_dynamic']);
$_SESSION['last_activity'] = time();
audit_log('login_success_remember');
src/static_qrcode.php
+6
View File
@@ -3,6 +3,12 @@ require_once 'includes/bootstrap.php';
require_once BASE_PATH.'/includes/auth_validate.php';
require_once BASE_PATH . '/lib/StaticQrcode/StaticQrcode.php';
if ($_SESSION['type'] === 'user') {
$_SESSION['failure'] = 'The "user" role is read-only and cannot create, edit or delete qr codes.';
header('Location: index.php');
exit;
}
$static_qrcode_instance = new StaticQrcode();
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
src/static_qrcodes.php
+10 -1
View File
@@ -3,6 +3,12 @@ require_once 'includes/bootstrap.php';
require_once BASE_PATH . '/includes/auth_validate.php';
require_once BASE_PATH . '/lib/StaticQrcode/StaticQrcode.php';
if ($_SESSION['type'] === 'user' && empty($_SESSION['can_view_static'] ?? null)) {
$_SESSION['failure'] = 'You are not allowed to view static qr codes.';
header('Location: index.php');
exit;
}
$db = getDbInstance();
$static_qrcode = new StaticQrcode();
@@ -12,7 +18,8 @@ require_once BASE_PATH . '/includes/search_order.php';
$page = filter_input(INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS) ?? 1;
$db->pageLimit = 15;
if($_SESSION['type'] !== 'super') {
// 'user' ziet, net als 'super', alle codes (heeft zelf geen eigen codes om op te scopen).
if($_SESSION['type'] === 'admin') {
$db->where("id_owner", $_SESSION['user_id']);
$db->orWhere ("id_owner", NULL, 'IS');
}
@@ -49,6 +56,7 @@ $total_pages = $db->totalPages;
<h1 class="m-0 text-dark">Static Qr codes</h1>
</div><!-- /.col -->
<?php if ($_SESSION['type'] !== 'user'): ?>
<div class="col-sm-6">
<ol class="breadcrumb float-sm-right">
<li class="breadcrumb-item">
@@ -56,6 +64,7 @@ $total_pages = $db->totalPages;
</li>
</ol>
</div><!-- /.col -->
<?php endif; ?>
</div><!-- /.row -->
</div><!-- /.container-fluid -->
</div><!-- /.content-header -->