Ensembia/QRForge-selfhosted
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fase 2: read-only user role with per-category view toggles

Browse Source 
Adds a third account type 'user' alongside super/admin: no create/edit/delete
rights on qr codes, view access to dynamic/static lists gated per-account by
two admin-controlled toggles (can_view_static, can_view_dynamic), and always
full visibility into the dashboard/reports regardless of those toggles.

- New columns can_view_static/can_view_dynamic on users (migrations/003)
- Users class + form_users.php: 'user' type option with the two toggles
- Access control: dynamic_qrcode.php/static_qrcode.php/bulk_action.php reject
  all mutations for type=user; dynamic_qrcodes.php/static_qrcodes.php enforce
  the view toggle and show all codes (no owner scoping, since 'user' owns none)
- Sidebar and list tables hide add/edit/delete/bulk UI for the read-only role
- index.php dashboard stats are unscoped for both 'super' and 'user'
This commit is contained in:
Dillard Blom
2026-07-08 16:37:25 +02:00
parent 3afe3b7698
commit 52c9f65c61
15 changed files with 163 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/forms/form_users.php
+39
View File
@@ -38,8 +38,47 @@
<label class="radio">
<input type="radio" name="type" value="admin" required="required" <?php echo ($edit && $user['type'] =='admin') ? "checked": "" ; ?>/> Admin</label>
</div>
<div class="radio">
<label class="radio">
<input type="radio" name="type" value="user" required="required" id="type-user" <?php echo ($edit && $user['type'] =='user') ? "checked": "" ; ?>/> User (read-only)</label>
</div>
</div>
</div>
<div class="col-sm-12 mt-2" id="user-view-toggles">
<label>Zichtbaarheid voor 'User'-rol</label>
<div class="form-group">
<div class="icheck-primary d-inline-block mr-4">
<input type="checkbox" name="can_view_static" id="can_view_static" value="1" <?php echo ($edit && !empty($user['can_view_static'])) ? "checked": "" ; ?>>
<label for="can_view_static">Mag statische QR-codes bekijken</label>
</div>
<div class="icheck-primary d-inline-block">
<input type="checkbox" name="can_view_dynamic" id="can_view_dynamic" value="1" <?php echo ($edit && !empty($user['can_view_dynamic'])) ? "checked": "" ; ?>>
<label for="can_view_dynamic">Mag dynamische QR-codes bekijken</label>
</div>
<small class="form-text text-muted">Alleen van toepassing op het type 'User'. Reports/statistieken zijn voor 'User' altijd zichtbaar.</small>
</div>
</div>
<script>
(function () {
var typeRadios = document.querySelectorAll('input[name="type"]');
var toggles = document.getElementById('user-view-toggles');
function updateToggleVisibility() {
var userSelected = document.getElementById('type-user').checked;
toggles.style.display = userSelected ? '' : 'none';
}
typeRadios.forEach(function (radio) {
radio.addEventListener('change', updateToggleVisibility);
});
updateToggleVisibility();
})();
</script>
<?php if($edit) { ?>
<input type="hidden" name="id" value="<?php echo $user['id'];?>"/>
<input type="hidden" name="edit" value="true"/>
src/forms/table_dynamic.php
+12 -3
View File
@@ -1,4 +1,6 @@
<?php $is_readonly_user = $_SESSION['type'] === 'user'; ?>
<div class="row">
<?php if (!$is_readonly_user): ?>
<div class="col-12" id="bulk-action-div" style="display: none;">
<div id="err-msg"></div>
<div class="bulk-action-wrapper">
@@ -21,13 +23,16 @@
</form>
</div>
</div>
<?php endif; ?>
<div class="col-12">
<div class="card">
<div class="card-body table-responsive p-0">
<table class="table table-striped table-bordered">
<thead>
<tr>
<?php if (!$is_readonly_user): ?>
<th><input type="checkbox" name="bulk-select" value="1"></th>
<?php endif; ?>
<th>ID</th>
<th>Owner</th>
<th>Filename</th>
@@ -42,7 +47,9 @@
<tbody>
<?php foreach ($rows as $row): ?>
<tr>
<?php if (!$is_readonly_user): ?>
<td><input type="checkbox" name="action[]" value="<?=$row['id']?>" onchange="updateBulkActionVisibility()"></td>
<?php endif; ?>
<td><?php echo $row['id']; ?></td>
<td>
<?php
@@ -68,10 +75,10 @@
<td><?php echo htmlspecialchars($row['scan']); ?></td>
<td><?php echo htmlspecialchars($row['state']); ?></td>
<td>
<?php if (!$is_readonly_user): ?>
<!-- EDIT -->
<a href="dynamic_qrcode.php?edit=true&id=<?php echo $row['id']; ?>" class="btn btn-primary"><i class="fas fa-edit"></i></a>
<!-- DELETE -->
<a
class="btn btn-danger delete_btn"
@@ -79,7 +86,7 @@
data-target="#delete-modal"
data-del_id="<?php echo $row["id"];?>"
><i class="fas fa-trash"></i></a>
<?php endif; ?>
<!-- DOWNLOAD -->
<a href="<?php echo SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']); ?>" class="btn btn-primary" download><i class="fa fa-download"></i></a>
</td>
@@ -97,6 +104,7 @@
</div><!-- /.col -->
</div><!-- /.row -->
<?php if (!$is_readonly_user): ?>
<!-- Delete Confirmation Modal -->
<div class="modal fade" id="delete-modal" role="dialog">
<div class="modal-dialog">
@@ -122,6 +130,7 @@
</div>
</div>
<!-- /.Delete Confirmation Modal -->
<?php endif; ?>
<script>
const deleteButtons = document.querySelectorAll('.delete_btn');
src/forms/table_static.php
+12 -3
View File
@@ -1,4 +1,6 @@
<?php $is_readonly_user = $_SESSION['type'] === 'user'; ?>
<div class="row">
<?php if (!$is_readonly_user): ?>
<div class="col-12" id="bulk-action-div" style="display: none;">
<div id="err-msg"></div>
<div class="bulk-action-wrapper">
@@ -21,13 +23,16 @@
</form>
</div>
</div>
<?php endif; ?>
<div class="col-12">
<div class="card">
<div class="card-body table-responsive p-0">
<table class="table table-striped table-bordered">
<thead>
<tr>
<?php if (!$is_readonly_user): ?>
<th><input type="checkbox" name="bulk-select" value="1"></th>
<?php endif; ?>
<th>ID</th>
<th>Owner</th>
<th>Filename</th>
@@ -40,7 +45,9 @@
<tbody>
<?php foreach ($rows as $row): ?>
<tr>
<?php if (!$is_readonly_user): ?>
<td><input type="checkbox" name="action[]" value="<?=$row['id']?>" onchange="updateBulkActionVisibility()"></td>
<?php endif; ?>
<td><?php echo $row['id']; ?></td>
<td>
<?php
@@ -64,10 +71,10 @@
<?php echo '<img src="'.SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']).'" width="100" height="100">'; ?>
</td>
<td>
<?php if (!$is_readonly_user): ?>
<!-- EDIT -->
<a href="static_qrcode.php?edit=true&id=<?php echo $row['id']; ?>" class="btn btn-primary"><i class="fas fa-edit"></i></a>
<!-- DELETE -->
<a
class="btn btn-danger delete_btn"
@@ -75,7 +82,7 @@
data-target="#delete-modal"
data-del_id="<?php echo $row["id"];?>"
><i class="fas fa-trash"></i></a>
<?php endif; ?>
<!-- DOWNLOAD -->
<a href="<?php echo SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']); ?>" class="btn btn-primary" download><i class="fa fa-download"></i></a>
</td>
@@ -93,6 +100,7 @@
</div><!-- /.col -->
</div><!-- /.row -->
<?php if (!$is_readonly_user): ?>
<!-- Delete Confirmation Modal -->
<div class="modal fade" id="delete-modal" role="dialog">
<div class="modal-dialog">
@@ -118,6 +126,7 @@
</div>
</div>
<!-- /.Delete Confirmation Modal -->
<?php endif; ?>
<script>
const deleteButtons = document.querySelectorAll('.delete_btn');