Fase 2: read-only user role with per-category view toggles

Adds a third account type 'user' alongside super/admin: no create/edit/delete
rights on qr codes, view access to dynamic/static lists gated per-account by
two admin-controlled toggles (can_view_static, can_view_dynamic), and always
full visibility into the dashboard/reports regardless of those toggles.

- New columns can_view_static/can_view_dynamic on users (migrations/003)
- Users class + form_users.php: 'user' type option with the two toggles
- Access control: dynamic_qrcode.php/static_qrcode.php/bulk_action.php reject
  all mutations for type=user; dynamic_qrcodes.php/static_qrcodes.php enforce
  the view toggle and show all codes (no owner scoping, since 'user' owns none)
- Sidebar and list tables hide add/edit/delete/bulk UI for the read-only role
- index.php dashboard stats are unscoped for both 'super' and 'user'

db/init.sql

@@ -16,6 +16,8 @@ CREATE TABLE IF NOT EXISTS `users` (
   `type` varchar(10) NOT NULL,
   `must_change_password` tinyint(1) NOT NULL DEFAULT 0,
   `password_changed_at` datetime DEFAULT NULL,
+  `can_view_static` tinyint(1) NOT NULL DEFAULT 0,
+  `can_view_dynamic` tinyint(1) NOT NULL DEFAULT 0,
   PRIMARY KEY (`id`),
   UNIQUE KEY `username` (`username`)
 ) ENGINE=InnoDB  DEFAULT CHARSET=utf8 AUTO_INCREMENT=0 ;

db/migrations/003_user_role.sql

@@ -0,0 +1,22 @@
+-- Fase 2: read-only 'user' rol met twee zichtbaarheids-toggles.
+-- type='user' vereist geen schemawijziging (varchar(10), geen enum-constraint).
+
+SET @db := DATABASE();
+
+SET @col_exists := (
+  SELECT COUNT(*) FROM information_schema.COLUMNS
+  WHERE TABLE_SCHEMA = @db AND TABLE_NAME = 'users' AND COLUMN_NAME = 'can_view_static'
+);
+SET @sql := IF(@col_exists = 0,
+  'ALTER TABLE `users` ADD COLUMN `can_view_static` TINYINT(1) NOT NULL DEFAULT 0',
+  'SELECT 1');
+PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @col_exists := (
+  SELECT COUNT(*) FROM information_schema.COLUMNS
+  WHERE TABLE_SCHEMA = @db AND TABLE_NAME = 'users' AND COLUMN_NAME = 'can_view_dynamic'
+);
+SET @sql := IF(@col_exists = 0,
+  'ALTER TABLE `users` ADD COLUMN `can_view_dynamic` TINYINT(1) NOT NULL DEFAULT 0',
+  'SELECT 1');
+PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;

src/authenticate.php

@@ -40,6 +40,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST')
         $_SESSION['user_id'] = $row['id'];
 		$_SESSION['username'] = $row['username'];
 		$_SESSION['must_change_password'] = !empty($row['must_change_password']);
+		$_SESSION['can_view_static'] = !empty($row['can_view_static']);
+		$_SESSION['can_view_dynamic'] = !empty($row['can_view_dynamic']);
 		$_SESSION['last_activity'] = time();
 
 		audit_log('login_success');

src/bulk_action.php

@@ -35,9 +35,18 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
             exit();
         }
 
+        if ($_SESSION['type'] === 'user') {
+            $view_flag = $type === 'dynamic' ? 'can_view_dynamic' : 'can_view_static';
+            if (empty($_SESSION[$view_flag] ?? null)) {
+                http_response_code(403);
+                echo json_encode(['data' => 'Not allowed to view this qr code type.', 'status' => 403]);
+                exit();
+            }
+        }
+
         foreach ($params as $param) {
             $db->where('id', $param);
-            if ($_SESSION['type'] !== 'super') {
+            if ($_SESSION['type'] === 'admin') {
                 $db->where('id_owner', $_SESSION['user_id']);
                 $db->orWhere('id_owner', NULL, 'IS');
             }
@@ -69,6 +78,12 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         ]);
         exit();
     } else if($json["action"] == "delete") {
+        if ($_SESSION['type'] === 'user') {
+            http_response_code(403);
+            echo json_encode(['data' => 'The "user" role is read-only.', 'status' => 403]);
+            exit();
+        }
+
         $params = $json['params'];
 
         if (isset($json['type']) && in_array($json['type'], $allowed_types, true)) {

src/dynamic_qrcode.php

@@ -3,6 +3,12 @@ require_once 'includes/bootstrap.php';
 require_once BASE_PATH.'/includes/auth_validate.php';
 require_once BASE_PATH . '/lib/DynamicQrcode/DynamicQrcode.php';
 
+if ($_SESSION['type'] === 'user') {
+    $_SESSION['failure'] = 'The "user" role is read-only and cannot create, edit or delete qr codes.';
+    header('Location: index.php');
+    exit;
+}
+
 $dynamic_qrcode_instance = new DynamicQrcode();
 
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {

src/dynamic_qrcodes.php

@@ -3,6 +3,12 @@ require_once 'includes/bootstrap.php';
 require_once BASE_PATH . '/includes/auth_validate.php';
 require_once BASE_PATH . '/lib/DynamicQrcode/DynamicQrcode.php';
 
+if ($_SESSION['type'] === 'user' && empty($_SESSION['can_view_dynamic'] ?? null)) {
+    $_SESSION['failure'] = 'You are not allowed to view dynamic qr codes.';
+    header('Location: index.php');
+    exit;
+}
+
 $db = getDbInstance();
 $dynamic_qrcode = new DynamicQrcode();
 
@@ -12,7 +18,8 @@ require_once BASE_PATH . '/includes/search_order.php';
 $page = filter_input(INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS) ?? 1;
 $db->pageLimit = 15;
 
-if($_SESSION['type'] !==  'super') {
+// 'user' ziet, net als 'super', alle codes (heeft zelf geen eigen codes om op te scopen).
+if($_SESSION['type'] === 'admin') {
     $db->where("id_owner", $_SESSION['user_id']);
     $db->orWhere ("id_owner", NULL, 'IS');
 }
@@ -49,6 +56,7 @@ $total_pages = $db->totalPages;
             <h1 class="m-0 text-dark">Dynamic Qr codes</h1>
           </div><!-- /.col -->
           
+          <?php if ($_SESSION['type'] !== 'user'): ?>
           <div class="col-sm-6">
             <ol class="breadcrumb float-sm-right">
                 <li class="breadcrumb-item">
@@ -56,6 +64,7 @@ $total_pages = $db->totalPages;
                 </li>
             </ol>
           </div><!-- /.col -->
+          <?php endif; ?>
         </div><!-- /.row -->
       </div><!-- /.container-fluid -->
     </div><!-- /.content-header -->

src/forms/form_users.php

@@ -38,8 +38,47 @@
                 <label class="radio">
                 <input type="radio" name="type" value="admin" required="required" <?php echo ($edit && $user['type'] =='admin') ? "checked": "" ; ?>/> Admin</label>
             </div>
+
+            <div class="radio">
+                <label class="radio">
+                <input type="radio" name="type" value="user" required="required" id="type-user" <?php echo ($edit && $user['type'] =='user') ? "checked": "" ; ?>/> User (read-only)</label>
+            </div>
         </div>
     </div>
+
+    <div class="col-sm-12 mt-2" id="user-view-toggles">
+        <label>Zichtbaarheid voor 'User'-rol</label>
+        <div class="form-group">
+            <div class="icheck-primary d-inline-block mr-4">
+                <input type="checkbox" name="can_view_static" id="can_view_static" value="1" <?php echo ($edit && !empty($user['can_view_static'])) ? "checked": "" ; ?>>
+                <label for="can_view_static">Mag statische QR-codes bekijken</label>
+            </div>
+            <div class="icheck-primary d-inline-block">
+                <input type="checkbox" name="can_view_dynamic" id="can_view_dynamic" value="1" <?php echo ($edit && !empty($user['can_view_dynamic'])) ? "checked": "" ; ?>>
+                <label for="can_view_dynamic">Mag dynamische QR-codes bekijken</label>
+            </div>
+            <small class="form-text text-muted">Alleen van toepassing op het type 'User'. Reports/statistieken zijn voor 'User' altijd zichtbaar.</small>
+        </div>
+    </div>
+
+    <script>
+        (function () {
+            var typeRadios = document.querySelectorAll('input[name="type"]');
+            var toggles = document.getElementById('user-view-toggles');
+
+            function updateToggleVisibility() {
+                var userSelected = document.getElementById('type-user').checked;
+                toggles.style.display = userSelected ? '' : 'none';
+            }
+
+            typeRadios.forEach(function (radio) {
+                radio.addEventListener('change', updateToggleVisibility);
+            });
+
+            updateToggleVisibility();
+        })();
+    </script>
+
     <?php if($edit) { ?>
         <input type="hidden" name="id" value="<?php echo $user['id'];?>"/>
         <input type="hidden" name="edit" value="true"/>

src/forms/table_dynamic.php

@@ -1,4 +1,6 @@
+<?php $is_readonly_user = $_SESSION['type'] === 'user'; ?>
 <div class="row">
+    <?php if (!$is_readonly_user): ?>
     <div class="col-12" id="bulk-action-div" style="display: none;">
         <div id="err-msg"></div>
         <div class="bulk-action-wrapper">
@@ -21,13 +23,16 @@
             </form>
         </div>
     </div>
+    <?php endif; ?>
     <div class="col-12">
         <div class="card">
             <div class="card-body table-responsive p-0">
       <table class="table table-striped table-bordered">
         <thead>
             <tr>
+                <?php if (!$is_readonly_user): ?>
                 <th><input type="checkbox" name="bulk-select" value="1"></th>
+                <?php endif; ?>
                 <th>ID</th>
                 <th>Owner</th>
                 <th>Filename</th>
@@ -42,7 +47,9 @@
         <tbody>
             <?php foreach ($rows as $row): ?>
             <tr>
+                <?php if (!$is_readonly_user): ?>
                 <td><input type="checkbox" name="action[]" value="<?=$row['id']?>" onchange="updateBulkActionVisibility()"></td>
+                <?php endif; ?>
                 <td><?php echo $row['id']; ?></td>
                 <td>
                     <?php
@@ -68,7 +75,7 @@
                 <td><?php echo htmlspecialchars($row['scan']); ?></td>
                 <td><?php echo htmlspecialchars($row['state']); ?></td>
                 <td>
-                    
+                    <?php if (!$is_readonly_user): ?>
                     <!-- EDIT -->
                     <a href="dynamic_qrcode.php?edit=true&id=<?php echo $row['id']; ?>" class="btn btn-primary"><i class="fas fa-edit"></i></a>
 
@@ -79,7 +86,7 @@
                             data-target="#delete-modal"
                             data-del_id="<?php echo $row["id"];?>"
                     ><i class="fas fa-trash"></i></a>
-                    
+                    <?php endif; ?>
                     <!-- DOWNLOAD -->
                     <a href="<?php echo SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']); ?>" class="btn btn-primary" download><i class="fa fa-download"></i></a>
                 </td>
@@ -97,6 +104,7 @@
     </div><!-- /.col -->
 </div><!-- /.row -->
 
+<?php if (!$is_readonly_user): ?>
 <!-- Delete Confirmation Modal -->
 <div class="modal fade" id="delete-modal" role="dialog">
     <div class="modal-dialog">
@@ -122,6 +130,7 @@
     </div>
 </div>
 <!-- /.Delete Confirmation Modal -->
+<?php endif; ?>
 
 <script>
     const deleteButtons = document.querySelectorAll('.delete_btn');

src/forms/table_static.php

@@ -1,4 +1,6 @@
+<?php $is_readonly_user = $_SESSION['type'] === 'user'; ?>
 <div class="row">
+    <?php if (!$is_readonly_user): ?>
     <div class="col-12" id="bulk-action-div" style="display: none;">
         <div id="err-msg"></div>
         <div class="bulk-action-wrapper">
@@ -21,13 +23,16 @@
             </form>
         </div>
     </div>
+    <?php endif; ?>
     <div class="col-12">
         <div class="card">
             <div class="card-body table-responsive p-0">
       <table class="table table-striped table-bordered">
         <thead>
             <tr>
+                <?php if (!$is_readonly_user): ?>
                 <th><input type="checkbox" name="bulk-select" value="1"></th>
+                <?php endif; ?>
                 <th>ID</th>
                 <th>Owner</th>
                 <th>Filename</th>
@@ -40,7 +45,9 @@
         <tbody>
             <?php foreach ($rows as $row): ?>
             <tr>
+                <?php if (!$is_readonly_user): ?>
                 <td><input type="checkbox" name="action[]" value="<?=$row['id']?>" onchange="updateBulkActionVisibility()"></td>
+                <?php endif; ?>
                 <td><?php echo $row['id']; ?></td>
                 <td>
                     <?php
@@ -64,7 +71,7 @@
                     <?php echo '<img src="'.SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']).'" width="100" height="100">'; ?>
                 </td>
                 <td>
-                    
+                    <?php if (!$is_readonly_user): ?>
                     <!-- EDIT -->
                     <a href="static_qrcode.php?edit=true&id=<?php echo $row['id']; ?>" class="btn btn-primary"><i class="fas fa-edit"></i></a>
 
@@ -75,7 +82,7 @@
                             data-target="#delete-modal"
                             data-del_id="<?php echo $row["id"];?>"
                     ><i class="fas fa-trash"></i></a>
-
+                    <?php endif; ?>
                     <!-- DOWNLOAD -->
                     <a href="<?php echo SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']); ?>" class="btn btn-primary" download><i class="fa fa-download"></i></a>
                 </td>
@@ -93,6 +100,7 @@
     </div><!-- /.col -->
 </div><!-- /.row -->
 
+<?php if (!$is_readonly_user): ?>
 <!-- Delete Confirmation Modal -->
 <div class="modal fade" id="delete-modal" role="dialog">
     <div class="modal-dialog">
@@ -118,6 +126,7 @@
     </div>
 </div>
 <!-- /.Delete Confirmation Modal -->
+<?php endif; ?>
 
 <script>
     const deleteButtons = document.querySelectorAll('.delete_btn');

src/includes/sidebar.php

@@ -33,6 +33,7 @@
              </p>
            </a>
          </li>
+          <?php if ($_SESSION['type'] !== 'user' || !empty($_SESSION['can_view_dynamic'])): ?>
           <li <?php echo ((substr(CURRENT_PAGE, 0, 19) == 'dynamic_qrcodes.php') || (substr(CURRENT_PAGE, 0, 18) == 'dynamic_qrcode.php')) ? ' class="nav-item has-treeview menu-open"' : ' class="nav-item has-treeview"'; ?>>
             <a href="#" <?php echo ((substr(CURRENT_PAGE, 0, 19) == 'dynamic_qrcodes.php') || (substr(CURRENT_PAGE, 0, 18) == 'dynamic_qrcode.php')) ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
               <i class="nav-icon fa fa-qrcode"></i>
@@ -48,14 +49,18 @@
                   <p>List all</p>
                 </a>
               </li>
+              <?php if ($_SESSION['type'] !== 'user'): ?>
               <li class="nav-item">
                 <a href="./dynamic_qrcode.php" <?php echo (CURRENT_PAGE == 'dynamic_qrcode.php') ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
                   <i class="far fa-circle nav-icon"></i>
                   <p>Add new</p>
                 </a>
               </li>
+              <?php endif; ?>
             </ul>
           </li>
+          <?php endif; ?>
+            <?php if ($_SESSION['type'] !== 'user' || !empty($_SESSION['can_view_static'])): ?>
             <li <?php echo ((substr(CURRENT_PAGE, 0, 18) == 'static_qrcodes.php') || (substr(CURRENT_PAGE, 0, 17) == 'static_qrcode.php')) ? ' class="nav-item has-treeview menu-open"' : ' class="nav-item has-treeview"'; ?>>
                 <a href="#" <?php echo ((substr(CURRENT_PAGE, 0, 18) == 'static_qrcodes.php') || (substr(CURRENT_PAGE, 0, 17) == 'static_qrcode.php')) ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
                     <i class="nav-icon fa fa-qrcode"></i>
@@ -71,20 +76,25 @@
                             <p>List all</p>
                         </a>
                     </li>
+                    <?php if ($_SESSION['type'] !== 'user'): ?>
                     <li class="nav-item">
                         <a href="./static_qrcode.php" <?php echo (CURRENT_PAGE == 'static_qrcode.php') ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
                             <i class="far fa-circle nav-icon"></i>
                             <p>Add new</p>
                         </a>
                     </li>
+                    <?php endif; ?>
                 </ul>
             </li>
+            <?php endif; ?>
+          <?php if ($_SESSION['type'] === 'super'): ?>
           <li class="nav-item">
             <a href="./users.php" <?php echo ((substr(CURRENT_PAGE, 0, 15) == 'users.php') || (substr(CURRENT_PAGE, 0, 14) == 'user.php')) ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
                 <i class="fas fa-users nav-icon"></i>
               <p>Users</p>
             </a>
           </li>
+          <?php endif; ?>
         </ul>
       </nav>
       <!-- /.sidebar-menu -->

src/index.php

@@ -4,15 +4,19 @@ require_once 'includes/auth_validate.php';
 
 $db = getDbInstance();
 
+// Reports/statistieken zijn voor de 'user'-rol altijd volledig zichtbaar (net als 'super'),
+// ongeacht de can_view_static/can_view_dynamic toggles die alleen de qrcode-lijsten regelen.
+$is_full_visibility = in_array($_SESSION['type'], ['super', 'user'], true);
+
 //Get Dynamic qr code rows
-if($_SESSION['type'] !== 'super') {
+if(!$is_full_visibility) {
     $db->where("id_owner", $_SESSION['user_id']);
     $db->orWhere ("id_owner", NULL, 'IS');
 }
 $numQrcode_dynamic = $db->getValue("dynamic_qrcodes", "count(*)");
 
 //Get Static qr code rows
-if($_SESSION['type'] !== 'super') {
+if(!$is_full_visibility) {
     $db->where("id_owner", $_SESSION['user_id']);
     $db->orWhere ("id_owner", NULL, 'IS');
 }
@@ -21,7 +25,7 @@ $numQrcode_static = $db->getValue("static_qrcodes", "count(*)");
 $total = $numQrcode_dynamic + $numQrcode_static;
 
 //Get Total scan
-if($_SESSION['type'] !== 'super') {
+if(!$is_full_visibility) {
     $db->where("id_owner", $_SESSION['user_id']);
     $db->orWhere ("id_owner", NULL, 'IS');
 }
@@ -31,7 +35,7 @@ $numScan = $db->getOne("dynamic_qrcodes", "sum(scan) as numScan");
 //I initialize the variables that will contain the daily values to 0 otherwise in the foreach loop they will be reset every time
 
 //Get the number of DYNAMIC qr code created in 7 days and total scan
-if($_SESSION['type'] !== 'super')
+if(!$is_full_visibility)
     $createdQrcode_dynamic = $db->query("select `created_at`, `scan` from " . DATABASE_PREFIX . "dynamic_qrcodes where `created_at` > curdate()-7 AND (`id_owner`= " . $_SESSION['user_id'] . " OR `id_owner` IS NULL);");
 else
     $createdQrcode_dynamic = $db->query("select `created_at`, `scan` from ".DATABASE_PREFIX."dynamic_qrcodes where `created_at` > curdate()-7;");
@@ -54,7 +58,7 @@ foreach ($createdQrcode_dynamic as $row) {
 
                                                 /* SCAN CHART */
 //Get the number of STATIC qr code created in 7 days
-if($_SESSION['type'] !==  'super')
+if(!$is_full_visibility)
     $createdQrcode_static = $db->query("select `created_at` from " . DATABASE_PREFIX . "static_qrcodes where `created_at` > curdate()-7 AND (`id_owner`=" . $_SESSION['user_id'] . " OR `id_owner` IS NULL);");
 else
     $createdQrcode_static = $db->query("select `created_at` from ".DATABASE_PREFIX."static_qrcodes where `created_at` > curdate()-7;");

src/lib/Users/Users.php

@@ -3,7 +3,7 @@ require_once 'config/config.php';
 
 class Users
 {
-    const ALLOWED_TYPES = ['super', 'admin'];
+    const ALLOWED_TYPES = ['super', 'admin', 'user'];
 
     /**
      *
@@ -87,6 +87,8 @@ class Users
         $data_to_db["username"] = $input_data["username"];
         $data_to_db['password'] = password_hash($input_data['password'], PASSWORD_DEFAULT);
         $data_to_db["type"] = $input_data["type"];
+        $data_to_db['can_view_static'] = !empty($input_data['can_view_static']) ? 1 : 0;
+        $data_to_db['can_view_dynamic'] = !empty($input_data['can_view_dynamic']) ? 1 : 0;
 
         $db->where('username', $data_to_db['username']);
         $db->get('users');
@@ -133,6 +135,8 @@ class Users
 
         $data_to_db["username"] = $input_data["username"];
         $data_to_db["type"] = $input_data["type"];
+        $data_to_db['can_view_static'] = !empty($input_data['can_view_static']) ? 1 : 0;
+        $data_to_db['can_view_dynamic'] = !empty($input_data['can_view_dynamic']) ? 1 : 0;
 
         // Alleen wachtwoord overschrijven als er een nieuwe waarde is opgegeven.
         if (!empty($input_data['password'])) {

src/login.php

@@ -40,6 +40,8 @@ if (isset($_COOKIE['series_id']) && isset($_COOKIE['remember_token']))
 			$_SESSION['type'] = $row['type'];
 			$_SESSION['username'] = $row['username'];
 			$_SESSION['must_change_password'] = !empty($row['must_change_password']);
+			$_SESSION['can_view_static'] = !empty($row['can_view_static']);
+			$_SESSION['can_view_dynamic'] = !empty($row['can_view_dynamic']);
 			$_SESSION['last_activity'] = time();
 
 			audit_log('login_success_remember');

src/static_qrcode.php

@@ -3,6 +3,12 @@ require_once 'includes/bootstrap.php';
 require_once BASE_PATH.'/includes/auth_validate.php';
 require_once BASE_PATH . '/lib/StaticQrcode/StaticQrcode.php';
 
+if ($_SESSION['type'] === 'user') {
+    $_SESSION['failure'] = 'The "user" role is read-only and cannot create, edit or delete qr codes.';
+    header('Location: index.php');
+    exit;
+}
+
 $static_qrcode_instance = new StaticQrcode();
 
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {

src/static_qrcodes.php

@@ -3,6 +3,12 @@ require_once 'includes/bootstrap.php';
 require_once BASE_PATH . '/includes/auth_validate.php';
 require_once BASE_PATH . '/lib/StaticQrcode/StaticQrcode.php';
 
+if ($_SESSION['type'] === 'user' && empty($_SESSION['can_view_static'] ?? null)) {
+    $_SESSION['failure'] = 'You are not allowed to view static qr codes.';
+    header('Location: index.php');
+    exit;
+}
+
 $db = getDbInstance();
 $static_qrcode = new StaticQrcode();
 
@@ -12,7 +18,8 @@ require_once BASE_PATH . '/includes/search_order.php';
 $page = filter_input(INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS) ?? 1;
 $db->pageLimit = 15;
 
-if($_SESSION['type'] !==  'super') {
+// 'user' ziet, net als 'super', alle codes (heeft zelf geen eigen codes om op te scopen).
+if($_SESSION['type'] === 'admin') {
     $db->where("id_owner", $_SESSION['user_id']);
     $db->orWhere ("id_owner", NULL, 'IS');
 }
@@ -49,6 +56,7 @@ $total_pages = $db->totalPages;
             <h1 class="m-0 text-dark">Static Qr codes</h1>
           </div><!-- /.col -->
           
+          <?php if ($_SESSION['type'] !== 'user'): ?>
           <div class="col-sm-6">
             <ol class="breadcrumb float-sm-right">
                 <li class="breadcrumb-item">
@@ -56,6 +64,7 @@ $total_pages = $db->totalPages;
                 </li>
             </ol>
           </div><!-- /.col -->
+          <?php endif; ?>
         </div><!-- /.row -->
       </div><!-- /.container-fluid -->
     </div><!-- /.content-header -->