Admin-scoped user accounts, secure qr code storage, PHP 8.4 upgrade
Admin-scoped users (answers: who can create a 'user' account, only super or also an admin within their own scope?): - New owner_admin_id column on users (migration 004). NULL means created by super (company-wide, previous behavior); otherwise scoped to that admin's own codes. - Users::addUser/editUser/deleteUser now allow an 'admin' session, but force type='user' and owner_admin_id to their own id regardless of submitted input. user.php/users.php open up to admins with a restricted UI (no type picker, listing limited to their own created users). - New qr_compute_scope_owner_id()/qr_apply_owner_scope()/qr_has_full_visibility() helpers in includes/security.php, replacing the ad-hoc type==='admin' checks in index.php, dynamic_qrcodes.php, static_qrcodes.php and bulk_action.php. A 'user' account created by an admin is now scoped to that admin's codes instead of seeing everything company-wide. Qr code storage hardening: images were served as plain static files under the document root with no auth check at all. Storage now lives outside the web root; qrcode_image.php and qrcode_zip_download.php gate access with the same permission model as the list pages, and the bulk zip download is bound to the session that generated it. PHP 8.4 + chillerlan/php-qrcode 6.0.1: bumped since this is a dockerized app, so the PHP version shipped doesn't matter to end users. Note: the 6.0.1 tag itself only requires PHP 8.2 - the earlier "needs 8.4" read was from an unpinned clone of master, which has since moved past the tag. Fixed along the way, surfaced by testing on 8.4: - The hardcoded Imagick build (an old pinned master commit, workaround for 3.7.0 being broken on PHP 8.3+) no longer compiles on 8.4. Imagick 3.8.1 is now a normal stable release, so the workaround is gone. - config.php had display_errors=On + error_reporting(E_ALL), so PHP 8.4's new deprecation notices got dumped straight into the response before session_start() could run, breaking login outright. Also an info-disclosure risk on its own. Now logged instead of displayed. - MysqliDb::insertMulti() had an implicit nullable parameter, now explicit. - includes/auth_validate.php redirected unauthenticated requests but never called exit(), so the rest of the script kept running. - Dockerfile.fpm was missing both git (needed to clone chillerlan/php-qrcode) and the imagick extension entirely. Also removes the unused sample qr code images that shipped in the original repo; storage now lives outside the document root so they were never going to be served again.
This commit is contained in:
+30
-10
@@ -6,12 +6,12 @@
|
||||
<div class="input-group-prepend">
|
||||
<span class="input-group-text"><i class="fa fa-user"></i></span>
|
||||
</div>
|
||||
|
||||
|
||||
<input type="text" name="username" placeholder="Username" class="form-control" required="required" value="<?php echo ($edit) ? $user['username'] : ''; ?>" autocomplete="off">
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="col-sm-4">
|
||||
<div class="form-group">
|
||||
<label for="password">Password *</label>
|
||||
@@ -19,21 +19,22 @@
|
||||
<div class="input-group-prepend">
|
||||
<span class="input-group-text"><i class="fa fa-lock"></i></span>
|
||||
</div>
|
||||
|
||||
|
||||
<input type="password" name="password" placeholder="<?php echo ($edit) ? 'Leave blank to keep current password' : 'Password'; ?>" class="form-control" <?php echo ($edit) ? '' : 'required="required"'; ?> minlength="10" autocomplete="off">
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<?php if ($_SESSION['type'] === 'super'): ?>
|
||||
<div class="col-sm-4">
|
||||
<label for="user-type">User type *</label>
|
||||
|
||||
|
||||
<div class="form-group">
|
||||
<div class="radio">
|
||||
<label class="radio">
|
||||
<input type="radio" name="type" value="super" required="required" <?php echo ($edit && $user['type'] =='super') ? "checked": "" ; ?>/> Super admin</label>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="radio">
|
||||
<label class="radio">
|
||||
<input type="radio" name="type" value="admin" required="required" <?php echo ($edit && $user['type'] =='admin') ? "checked": "" ; ?>/> Admin</label>
|
||||
@@ -47,17 +48,17 @@
|
||||
</div>
|
||||
|
||||
<div class="col-sm-12 mt-2" id="user-view-toggles">
|
||||
<label>Zichtbaarheid voor 'User'-rol</label>
|
||||
<label>Visibility for the 'User' role</label>
|
||||
<div class="form-group">
|
||||
<div class="icheck-primary d-inline-block mr-4">
|
||||
<input type="checkbox" name="can_view_static" id="can_view_static" value="1" <?php echo ($edit && !empty($user['can_view_static'])) ? "checked": "" ; ?>>
|
||||
<label for="can_view_static">Mag statische QR-codes bekijken</label>
|
||||
<label for="can_view_static">Can view static qr codes</label>
|
||||
</div>
|
||||
<div class="icheck-primary d-inline-block">
|
||||
<input type="checkbox" name="can_view_dynamic" id="can_view_dynamic" value="1" <?php echo ($edit && !empty($user['can_view_dynamic'])) ? "checked": "" ; ?>>
|
||||
<label for="can_view_dynamic">Mag dynamische QR-codes bekijken</label>
|
||||
<label for="can_view_dynamic">Can view dynamic qr codes</label>
|
||||
</div>
|
||||
<small class="form-text text-muted">Alleen van toepassing op het type 'User'. Reports/statistieken zijn voor 'User' altijd zichtbaar.</small>
|
||||
<small class="form-text text-muted">Only applies to the 'User' type. Reports/statistics are always visible for 'User'.</small>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -78,9 +79,28 @@
|
||||
updateToggleVisibility();
|
||||
})();
|
||||
</script>
|
||||
<?php else: ?>
|
||||
<!-- An 'admin' can only create/manage their own read-only 'user' accounts. -->
|
||||
<input type="hidden" name="type" value="user">
|
||||
|
||||
<div class="col-sm-12 mt-2">
|
||||
<label>Visibility for this user</label>
|
||||
<div class="form-group">
|
||||
<div class="icheck-primary d-inline-block mr-4">
|
||||
<input type="checkbox" name="can_view_static" id="can_view_static" value="1" <?php echo ($edit && !empty($user['can_view_static'])) ? "checked": "" ; ?>>
|
||||
<label for="can_view_static">Can view static qr codes</label>
|
||||
</div>
|
||||
<div class="icheck-primary d-inline-block">
|
||||
<input type="checkbox" name="can_view_dynamic" id="can_view_dynamic" value="1" <?php echo ($edit && !empty($user['can_view_dynamic'])) ? "checked": "" ; ?>>
|
||||
<label for="can_view_dynamic">Can view dynamic qr codes</label>
|
||||
</div>
|
||||
<small class="form-text text-muted">Reports/statistics are always visible for this account.</small>
|
||||
</div>
|
||||
</div>
|
||||
<?php endif; ?>
|
||||
|
||||
<?php if($edit) { ?>
|
||||
<input type="hidden" name="id" value="<?php echo $user['id'];?>"/>
|
||||
<input type="hidden" name="edit" value="true"/>
|
||||
<?php } ?>
|
||||
</fieldset>
|
||||
</fieldset>
|
||||
|
||||
@@ -70,7 +70,7 @@
|
||||
<td><?php echo htmlspecialchars($row['identifier']); ?></td>
|
||||
<td><?php echo htmlspecialchars($row['link']); ?></td>
|
||||
<td>
|
||||
<?php echo '<img src="'.SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']).'" width="100" height="100">'; ?>
|
||||
<?php echo '<img src="qrcode_image.php?type=dynamic&id='.$row['id'].'" width="100" height="100">'; ?>
|
||||
</td>
|
||||
<td><?php echo htmlspecialchars($row['scan']); ?></td>
|
||||
<td><?php echo htmlspecialchars($row['state']); ?></td>
|
||||
@@ -88,7 +88,7 @@
|
||||
><i class="fas fa-trash"></i></a>
|
||||
<?php endif; ?>
|
||||
<!-- DOWNLOAD -->
|
||||
<a href="<?php echo SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']); ?>" class="btn btn-primary" download><i class="fa fa-download"></i></a>
|
||||
<a href="qrcode_image.php?type=dynamic&id=<?php echo $row['id']; ?>&download=1" class="btn btn-primary"><i class="fa fa-download"></i></a>
|
||||
</td>
|
||||
</tr>
|
||||
<?php endforeach; ?>
|
||||
|
||||
@@ -68,7 +68,7 @@
|
||||
<td><?php echo htmlspecialchars($row['type']); ?></td>
|
||||
<td><?php echo htmlspecialchars_decode($row['content']); ?></td>
|
||||
<td>
|
||||
<?php echo '<img src="'.SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']).'" width="100" height="100">'; ?>
|
||||
<?php echo '<img src="qrcode_image.php?type=static&id='.$row['id'].'" width="100" height="100">'; ?>
|
||||
</td>
|
||||
<td>
|
||||
<?php if (!$is_readonly_user): ?>
|
||||
@@ -84,7 +84,7 @@
|
||||
><i class="fas fa-trash"></i></a>
|
||||
<?php endif; ?>
|
||||
<!-- DOWNLOAD -->
|
||||
<a href="<?php echo SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']); ?>" class="btn btn-primary" download><i class="fa fa-download"></i></a>
|
||||
<a href="qrcode_image.php?type=static&id=<?php echo $row['id']; ?>&download=1" class="btn btn-primary"><i class="fa fa-download"></i></a>
|
||||
</td>
|
||||
</tr>
|
||||
<?php endforeach; ?>
|
||||
|
||||
Reference in New Issue
Block a user