From b5ef4ac0cb97853d9581b5c0e0a0594161059222 Mon Sep 17 00:00:00 2001 From: Dillard Blom Date: Wed, 8 Jul 2026 20:38:58 +0200 Subject: [PATCH] Admin-scoped user accounts, secure qr code storage, PHP 8.4 upgrade Admin-scoped users (answers: who can create a 'user' account, only super or also an admin within their own scope?): - New owner_admin_id column on users (migration 004). NULL means created by super (company-wide, previous behavior); otherwise scoped to that admin's own codes. - Users::addUser/editUser/deleteUser now allow an 'admin' session, but force type='user' and owner_admin_id to their own id regardless of submitted input. user.php/users.php open up to admins with a restricted UI (no type picker, listing limited to their own created users). - New qr_compute_scope_owner_id()/qr_apply_owner_scope()/qr_has_full_visibility() helpers in includes/security.php, replacing the ad-hoc type==='admin' checks in index.php, dynamic_qrcodes.php, static_qrcodes.php and bulk_action.php. A 'user' account created by an admin is now scoped to that admin's codes instead of seeing everything company-wide. Qr code storage hardening: images were served as plain static files under the document root with no auth check at all. Storage now lives outside the web root; qrcode_image.php and qrcode_zip_download.php gate access with the same permission model as the list pages, and the bulk zip download is bound to the session that generated it. PHP 8.4 + chillerlan/php-qrcode 6.0.1: bumped since this is a dockerized app, so the PHP version shipped doesn't matter to end users. Note: the 6.0.1 tag itself only requires PHP 8.2 - the earlier "needs 8.4" read was from an unpinned clone of master, which has since moved past the tag. Fixed along the way, surfaced by testing on 8.4: - The hardcoded Imagick build (an old pinned master commit, workaround for 3.7.0 being broken on PHP 8.3+) no longer compiles on 8.4. Imagick 3.8.1 is now a normal stable release, so the workaround is gone. - config.php had display_errors=On + error_reporting(E_ALL), so PHP 8.4's new deprecation notices got dumped straight into the response before session_start() could run, breaking login outright. Also an info-disclosure risk on its own. Now logged instead of displayed. - MysqliDb::insertMulti() had an implicit nullable parameter, now explicit. - includes/auth_validate.php redirected unauthenticated requests but never called exit(), so the rest of the script kept running. - Dockerfile.fpm was missing both git (needed to clone chillerlan/php-qrcode) and the imagick extension entirely. Also removes the unused sample qr code images that shipped in the original repo; storage now lives outside the document root so they were never going to be served again. Co-Authored-By: Claude Sonnet 5 --- .env.example | 2 +- Dockerfile | 21 +++--- Dockerfile.fpm | 17 +++-- db/init.sql | 5 +- db/migrations/002_security_hardening.sql | 12 ++-- db/migrations/003_user_role.sql | 4 +- db/migrations/004_admin_scoped_users.sql | 14 ++++ docker-compose.prod.yml | 15 ++-- nginx.conf | 8 +-- src/authenticate.php | 1 + src/bulk_action.php | 21 +++--- src/config/config.php | 14 ++-- src/dynamic_qrcodes.php | 8 +-- src/forms/form_users.php | 40 ++++++++--- src/forms/table_dynamic.php | 4 +- src/forms/table_static.php | 4 +- src/includes/auth_validate.php | 3 +- src/includes/security.php | 43 ++++++++++++ src/includes/sidebar.php | 2 +- src/index.php | 25 +++---- src/lib/MysqliDb/MysqliDb.php | 2 +- src/lib/Users/Users.php | 84 ++++++++++++++++++----- src/login.php | 1 + src/qrcode_image.php | 63 +++++++++++++++++ src/qrcode_zip_download.php | 34 +++++++++ src/saved_qrcode/Amazon.png | Bin 545 -> 0 bytes src/saved_qrcode/Apple.jpg | Bin 16052 -> 0 bytes src/saved_qrcode/Boat party.png | Bin 1262 -> 0 bytes src/saved_qrcode/Call me.png | Bin 295 -> 0 bytes src/saved_qrcode/Email.jpg | Bin 6758 -> 0 bytes src/saved_qrcode/Facebook.png | Bin 558 -> 0 bytes src/saved_qrcode/Free wifi.png | Bin 447 -> 0 bytes src/saved_qrcode/Google.png | Bin 539 -> 0 bytes src/saved_qrcode/John Doe.png | Bin 1122 -> 0 bytes src/saved_qrcode/New York.png | Bin 398 -> 0 bytes src/saved_qrcode/Pay here.png | Bin 895 -> 0 bytes src/saved_qrcode/Save me.svg | 10 --- src/saved_qrcode/Send BTC.jpg | Bin 21888 -> 0 bytes src/saved_qrcode/Send sms.png | Bin 462 -> 0 bytes src/saved_qrcode/Text qr code.png | Bin 298 -> 0 bytes src/saved_qrcode/Youtube.png | Bin 629 -> 0 bytes src/saved_qrcode/wa.me.svg | 10 --- src/saved_qrcode/zip/.gitkeep | 0 src/static_qrcodes.php | 8 +-- src/user.php | 11 ++- src/users.php | 11 ++- 46 files changed, 357 insertions(+), 140 deletions(-) create mode 100644 db/migrations/004_admin_scoped_users.sql create mode 100644 src/qrcode_image.php create mode 100644 src/qrcode_zip_download.php delete mode 100644 src/saved_qrcode/Amazon.png delete mode 100644 src/saved_qrcode/Apple.jpg delete mode 100644 src/saved_qrcode/Boat party.png delete mode 100644 src/saved_qrcode/Call me.png delete mode 100644 src/saved_qrcode/Email.jpg delete mode 100644 src/saved_qrcode/Facebook.png delete mode 100644 src/saved_qrcode/Free wifi.png delete mode 100644 src/saved_qrcode/Google.png delete mode 100644 src/saved_qrcode/John Doe.png delete mode 100644 src/saved_qrcode/New York.png delete mode 100644 src/saved_qrcode/Pay here.png delete mode 100644 src/saved_qrcode/Save me.svg delete mode 100644 src/saved_qrcode/Send BTC.jpg delete mode 100644 src/saved_qrcode/Send sms.png delete mode 100644 src/saved_qrcode/Text qr code.png delete mode 100644 src/saved_qrcode/Youtube.png delete mode 100644 src/saved_qrcode/wa.me.svg delete mode 100644 src/saved_qrcode/zip/.gitkeep diff --git a/.env.example b/.env.example index 6674ac2..3b6df6e 100644 --- a/.env.example +++ b/.env.example @@ -1,4 +1,4 @@ -# Kopieer naar .env en pas de waarden aan. .env wordt niet gecommit (zie .gitignore). +# Copy to .env and adjust the values. .env is not committed (see .gitignore). TYPE=docker QRCODE_GENERATOR=internal-chillerlan.qrcode diff --git a/Dockerfile b/Dockerfile index 3e07eeb..81d1fa4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM php:8.3 +FROM php:8.4 RUN if [ "$(grep '^VERSION_ID=' /etc/os-release | cut -d '=' -f 2 | tr -d '"')" -eq "9" ]; then \ sed -i -e 's/deb.debian.org/archive.debian.org/g' \ @@ -51,16 +51,12 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get update -q \ sockets \ xsl \ zip \ + imagick \ " \ && case "$PHP_VERSION" in \ 5.6.*) PHP_EXTENSIONS="$PHP_EXTENSIONS mcrypt mysql";; \ 7.0.*|7.1.*) PHP_EXTENSIONS="$PHP_EXTENSIONS mcrypt";; \ esac \ - # Install Imagick from master on PHP >= 8.3, because imagick 3.7.0 broke on latest PHP releases and Imagick maintainers don't care to tag a newer release - && if [ $(php -r 'echo PHP_VERSION_ID;') -lt 80300 ]; then \ - PHP_EXTENSIONS="$PHP_EXTENSIONS imagick"; \ - else PHP_EXTENSIONS="$PHP_EXTENSIONS https://api.github.com/repos/Imagick/imagick/tarball/28f27044e435a2b203e32675e942eb8de620ee58"; \ - fi \ && install-php-extensions $PHP_EXTENSIONS \ && if command -v a2enmod; then a2enmod rewrite; fi @@ -86,10 +82,10 @@ RUN docker-php-ext-install sockets && docker-php-ext-enable sockets RUN mkdir -p /opt && chmod 777 /opt WORKDIR /opt -# Vastgezet op 5.0.5 (laatste 5.x-release): vanaf 6.0.0 vereist de library PHP >= 8.4, -# terwijl deze image op PHP 8.3 draait. Een ongepinde clone van master is bovendien -# een reproduceerbaarheids-/supply-chain-risico (build kan zonder waarschuwing breken). -RUN git clone --branch 5.0.5 --depth 1 https://github.com/chillerlan/php-qrcode.git \ +# Pinned to a specific release tag instead of an unpinned clone of master, which is a +# reproducibility/supply-chain risk (the build can break silently when upstream moves on, +# as happened when master started requiring PHP 8.4 while this image was still on 8.3). +RUN git clone --branch 6.0.1 --depth 1 https://github.com/chillerlan/php-qrcode.git \ && chmod -R 777 ./php-qrcode RUN cp ./php-qrcode/composer.json /var/www/html/composer.json RUN mkdir -p /var/www/html/test && chmod 777 /var/www/html/test @@ -100,5 +96,10 @@ WORKDIR /var/www/html RUN composer update COPY ./src ./ RUN chmod 755 *; + +# Qr code storage lives outside the document root so files can only be reached through +# the authenticated qrcode_image.php / qrcode_zip_download.php endpoints. +RUN mkdir -p /var/www/qrcode-storage/zip && chmod -R 777 /var/www/qrcode-storage + EXPOSE 80 CMD ["php", "-S", "0.0.0.0:80"] diff --git a/Dockerfile.fpm b/Dockerfile.fpm index 01c9edc..f8d373a 100644 --- a/Dockerfile.fpm +++ b/Dockerfile.fpm @@ -1,4 +1,4 @@ -FROM php:8.3-fpm +FROM php:8.4-fpm RUN if [ "$(grep '^VERSION_ID=' /etc/os-release | cut -d '=' -f 2 | tr -d '"')" -eq "9" ]; then \ sed -i -e 's/deb.debian.org/archive.debian.org/g' \ @@ -13,6 +13,7 @@ RUN chmod +x /usr/local/bin/install-php-extensions RUN DEBIAN_FRONTEND=noninteractive apt-get update -q \ && DEBIAN_FRONTEND=noninteractive apt-get install -qq -y \ curl \ + git \ libzip-dev \ libjpeg62-turbo-dev \ libpng-dev \ @@ -21,6 +22,7 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get update -q \ && install-php-extensions \ gd \ gettext \ + imagick \ intl \ mysqli \ opcache \ @@ -41,8 +43,8 @@ RUN cd /opt \ RUN mkdir -p /opt && chmod 777 /opt WORKDIR /opt -# Zie Dockerfile: vastgezet op 5.0.5, want 6.0.0+ vereist PHP >= 8.4. -RUN git clone --branch 5.0.5 --depth 1 https://github.com/chillerlan/php-qrcode.git \ +# See Dockerfile: pinned to a specific release tag instead of an unpinned clone of master. +RUN git clone --branch 6.0.1 --depth 1 https://github.com/chillerlan/php-qrcode.git \ && chmod -R 777 ./php-qrcode RUN cp ./php-qrcode/composer.json /var/www/html/composer.json RUN cp -R ./php-qrcode/src /var/www/html/ @@ -52,8 +54,13 @@ RUN composer update COPY ./src ./ RUN chown -R www-data:www-data /var/www/html \ && find /var/www/html -type f -exec chmod 644 {} \; \ - && find /var/www/html -type d -exec chmod 755 {} \; \ - && chmod -R 775 /var/www/html/saved_qrcode + && find /var/www/html -type d -exec chmod 755 {} \; + +# Qr code storage lives outside the document root so files can only be reached through +# the authenticated qrcode_image.php / qrcode_zip_download.php endpoints. +RUN mkdir -p /var/www/qrcode-storage/zip \ + && chown -R www-data:www-data /var/www/qrcode-storage \ + && chmod -R 775 /var/www/qrcode-storage EXPOSE 9000 CMD ["php-fpm"] diff --git a/db/init.sql b/db/init.sql index 80e0ded..9ff0e87 100644 --- a/db/init.sql +++ b/db/init.sql @@ -18,6 +18,7 @@ CREATE TABLE IF NOT EXISTS `users` ( `password_changed_at` datetime DEFAULT NULL, `can_view_static` tinyint(1) NOT NULL DEFAULT 0, `can_view_dynamic` tinyint(1) NOT NULL DEFAULT 0, + `owner_admin_id` int(25) DEFAULT NULL, PRIMARY KEY (`id`), UNIQUE KEY `username` (`username`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=0 ; @@ -60,7 +61,7 @@ CREATE TABLE IF NOT EXISTS `static_qrcodes` ( PRIMARY KEY (`id`) ) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=0 ; --- Security hardening (Fase 1): rate limiting op login pogingen +-- Security hardening (Fase 1): rate limiting on login attempts CREATE TABLE IF NOT EXISTS `login_attempts` ( `id` int(10) unsigned NOT NULL AUTO_INCREMENT, `username` varchar(50) NOT NULL, @@ -72,7 +73,7 @@ CREATE TABLE IF NOT EXISTS `login_attempts` ( KEY `ip_attempted_at` (`ip_address`, `attempted_at`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8; --- Security hardening (Fase 1): audit log van gevoelige acties +-- Security hardening (Fase 1): audit log of sensitive actions CREATE TABLE IF NOT EXISTS `audit_log` ( `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT, `user_id` int(25) DEFAULT NULL, diff --git a/db/migrations/002_security_hardening.sql b/db/migrations/002_security_hardening.sql index edb5099..a7ec093 100644 --- a/db/migrations/002_security_hardening.sql +++ b/db/migrations/002_security_hardening.sql @@ -1,7 +1,7 @@ --- Fase 1 security hardening migratie. --- Voer uit tegen een bestaande database (gebruikt de originele --- giandonatoinverso/php-dynamic-qr-code-db image of een oudere init.sql). --- Kolommen/tabellen worden alleen toegevoegd als ze nog niet bestaan. +-- Fase 1 security hardening migration. +-- Run against an existing database (using the original +-- giandonatoinverso/php-dynamic-qr-code-db image or an older init.sql). +-- Columns/tables are only added if they don't already exist. SET @db := DATABASE(); @@ -23,8 +23,8 @@ SET @sql := IF(@col_exists = 0, 'SELECT 1'); PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt; --- Bestaand superadmin account met het fabriekswachtwoord (superadmin/superadmin) --- moet bij eerstvolgende login het wachtwoord wijzigen. +-- An existing superadmin account with the factory password (superadmin/superadmin) +-- must change its password on next login. UPDATE `users` SET `must_change_password` = 1 WHERE `username` = 'superadmin' diff --git a/db/migrations/003_user_role.sql b/db/migrations/003_user_role.sql index db063bb..a96d059 100644 --- a/db/migrations/003_user_role.sql +++ b/db/migrations/003_user_role.sql @@ -1,5 +1,5 @@ --- Fase 2: read-only 'user' rol met twee zichtbaarheids-toggles. --- type='user' vereist geen schemawijziging (varchar(10), geen enum-constraint). +-- Fase 2: read-only 'user' role with two visibility toggles. +-- type='user' requires no schema change (varchar(10), no enum constraint). SET @db := DATABASE(); diff --git a/db/migrations/004_admin_scoped_users.sql b/db/migrations/004_admin_scoped_users.sql new file mode 100644 index 0000000..759aa7c --- /dev/null +++ b/db/migrations/004_admin_scoped_users.sql @@ -0,0 +1,14 @@ +-- Option 2: an admin may create their own 'user' accounts within their own scope. +-- owner_admin_id = NULL means: created by super, company-wide (previous behavior). +-- owner_admin_id = means: created by that admin, sees only that admin's own codes. + +SET @db := DATABASE(); + +SET @col_exists := ( + SELECT COUNT(*) FROM information_schema.COLUMNS + WHERE TABLE_SCHEMA = @db AND TABLE_NAME = 'users' AND COLUMN_NAME = 'owner_admin_id' +); +SET @sql := IF(@col_exists = 0, + 'ALTER TABLE `users` ADD COLUMN `owner_admin_id` INT(25) DEFAULT NULL', + 'SELECT 1'); +PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt; diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml index fec6531..178d2d4 100644 --- a/docker-compose.prod.yml +++ b/docker-compose.prod.yml @@ -4,11 +4,10 @@ services: restart: "unless-stopped" ports: - "80:80" - # 443 pas openzetten zodra SSL-certificaten zijn gemount (bv. via certbot-volume - # of een losse reverse proxy zoals Caddy/Traefik ervoor). Zie infra-fase van het plan. + # Only open 443 once SSL certificates are mounted (e.g. via a certbot volume, + # or a separate reverse proxy like Caddy/Traefik in front). See the infra phase of the plan. volumes: - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro - - php_dynamic_qrcode_saved_qrcode_data:/var/www/html/saved_qrcode:ro depends_on: - php-dynamic-qrcode networks: @@ -22,19 +21,19 @@ services: environment: TYPE: "docker" QRCODE_GENERATOR: "${QRCODE_GENERATOR:-internal-chillerlan.qrcode}" - BASE_URL: "${BASE_URL:?zet BASE_URL in .env, bv. https://qr.ensembia.com}" + BASE_URL: "${BASE_URL:?set BASE_URL in .env, e.g. https://qr.ensembia.com}" DATABASE_HOST: "php-dynamic-qrcode-db" DATABASE_PORT: "3306" DATABASE_NAME: "${DATABASE_NAME:-qrcode}" DATABASE_USER: "${DATABASE_USER:-qrcode}" - DATABASE_PASSWORD: "${DATABASE_PASSWORD:?zet DATABASE_PASSWORD in .env}" + DATABASE_PASSWORD: "${DATABASE_PASSWORD:?set DATABASE_PASSWORD in .env}" DATABASE_PREFIX: "${DATABASE_PREFIX:-}" DATABASE_CHARSET: "${DATABASE_CHARSET:-utf8}" depends_on: php-dynamic-qrcode-db: condition: service_healthy volumes: - - php_dynamic_qrcode_saved_qrcode_data:/var/www/html/saved_qrcode + - php_dynamic_qrcode_saved_qrcode_data:/var/www/qrcode-storage networks: - php-dynamic-qrcode-network @@ -45,10 +44,10 @@ services: - php_dynamic_qrcode_db_data:/var/lib/mysql - ./db/init.sql:/docker-entrypoint-initdb.d/init.sql:ro environment: - MYSQL_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD:?zet MYSQL_ROOT_PASSWORD in .env}" + MYSQL_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD:?set MYSQL_ROOT_PASSWORD in .env}" MYSQL_DATABASE: "${DATABASE_NAME:-qrcode}" MYSQL_USER: "${DATABASE_USER:-qrcode}" - MYSQL_PASSWORD: "${DATABASE_PASSWORD:?zet DATABASE_PASSWORD in .env}" + MYSQL_PASSWORD: "${DATABASE_PASSWORD:?set DATABASE_PASSWORD in .env}" healthcheck: test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${MYSQL_ROOT_PASSWORD}"] interval: 5s diff --git a/nginx.conf b/nginx.conf index 8c33173..d79c755 100644 --- a/nginx.conf +++ b/nginx.conf @@ -21,12 +21,8 @@ server { fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; } - # Statisch gegenereerde qrcodes mogen gedownload worden, maar niet als PHP uitgevoerd. - location /saved_qrcode/ { - location ~ \.php$ { - deny all; - } - } + # Generated qr codes are stored outside the document root and are only served + # through the authenticated qrcode_image.php / qrcode_zip_download.php endpoints. location ~ /\. { deny all; diff --git a/src/authenticate.php b/src/authenticate.php index 59ca016..3c76e44 100644 --- a/src/authenticate.php +++ b/src/authenticate.php @@ -42,6 +42,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') $_SESSION['must_change_password'] = !empty($row['must_change_password']); $_SESSION['can_view_static'] = !empty($row['can_view_static']); $_SESSION['can_view_dynamic'] = !empty($row['can_view_dynamic']); + $_SESSION['scope_owner_id'] = qr_compute_scope_owner_id($row); $_SESSION['last_activity'] = time(); audit_log('login_success'); diff --git a/src/bulk_action.php b/src/bulk_action.php index 8e4041e..2183f43 100644 --- a/src/bulk_action.php +++ b/src/bulk_action.php @@ -46,22 +46,18 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') { foreach ($params as $param) { $db->where('id', $param); - if ($_SESSION['type'] === 'admin') { - $db->where('id_owner', $_SESSION['user_id']); - $db->orWhere('id_owner', NULL, 'IS'); - } + qr_apply_owner_scope($db); $row = $db->getOne("{$type}_qrcodes"); if ($row !== NULL) { - $files[] = SAVED_QRCODE_FOLDER . $row['qrcode']; + $files[] = SAVED_QRCODE_DIRECTORY . $row['qrcode']; } } $zip = new ZipArchive(); - $uniqid = uniqid(); - $relative_dir = SAVED_QRCODE_FOLDER . 'zip/qrcodes_' . $uniqid . '.zip'; - @unlink($relative_dir); - $url_path = SAVED_QRCODE_URL . 'zip/qrcodes_' . $uniqid . '.zip'; - $zip->open($relative_dir, ZipArchive::CREATE); + $zip_filename = 'qrcodes_' . uniqid() . '.zip'; + $zip_path = SAVED_QRCODE_DIRECTORY . 'zip/' . $zip_filename; + @unlink($zip_path); + $zip->open($zip_path, ZipArchive::CREATE); foreach ($files as $file) { $download_file = @file_get_contents($file, true); @@ -70,10 +66,13 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') { $zip->close(); + // Proof-of-generation: only this session may download this specific zip file. + $_SESSION['generated_zips'][] = $zip_filename; + audit_log('bulk_download', $type, implode(',', $params)); echo json_encode([ - 'data' => $url_path, + 'data' => 'qrcode_zip_download.php?file=' . rawurlencode($zip_filename), 'status' => 200 ]); exit(); diff --git a/src/config/config.php b/src/config/config.php index e3633e7..2e064fa 100755 --- a/src/config/config.php +++ b/src/config/config.php @@ -2,8 +2,12 @@ //Note: This file should be included first in every php page. require_once ('environment.php'); +// Never display errors/warnings/deprecations in the response body: besides leaking +// internal file paths, it can inject output before session_start() runs and break +// login entirely (seen with PHP 8.4's new deprecation notices). Log them instead. error_reporting(E_ALL); -ini_set('display_errors', 'On'); +ini_set('display_errors', 'Off'); +ini_set('log_errors', 'On'); define('BASE_PATH', dirname(dirname(__FILE__))); define('CURRENT_PAGE', basename($_SERVER['REQUEST_URI'])); define('SCRIPT_NAME', ltrim(dirname($_SERVER['SCRIPT_NAME']), '/')); @@ -17,10 +21,10 @@ require_once BASE_PATH . '/lib/MysqliDb/MysqliDb.php'; require_once BASE_PATH . '/helpers/helpers.php'; /* SAVED QR CODES */ -//You can change the folder where the qr code will be saved -define('SAVED_QRCODE_FOLDER', './saved_qrcode/'); -define('SAVED_QRCODE_DIRECTORY', BASE_PATH.'/saved_qrcode/'); -define('SAVED_QRCODE_URL', base_url(). SCRIPT_FOLDER .'/saved_qrcode/'); +// Storage lives outside the document root so files can only be reached through the +// authenticated qrcode_image.php / qrcode_zip_download.php endpoints, never as a direct +// static URL. See db/migrations and the "saved_qrcode" hardening note in the OSS repo. +define('SAVED_QRCODE_DIRECTORY', dirname(BASE_PATH).'/qrcode-storage/'); //You can change the page name for the redirect and the search parameter (the default is "id") define('READ_PATH', base_url().'/read.php?id='); diff --git a/src/dynamic_qrcodes.php b/src/dynamic_qrcodes.php index bfb8962..a790939 100644 --- a/src/dynamic_qrcodes.php +++ b/src/dynamic_qrcodes.php @@ -18,11 +18,9 @@ require_once BASE_PATH . '/includes/search_order.php'; $page = filter_input(INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS) ?? 1; $db->pageLimit = 15; -// 'user' ziet, net als 'super', alle codes (heeft zelf geen eigen codes om op te scopen). -if($_SESSION['type'] === 'admin') { - $db->where("id_owner", $_SESSION['user_id']); - $db->orWhere ("id_owner", NULL, 'IS'); -} +// Scoped to one admin's own codes for an admin (or a 'user' created by that admin); +// full visibility for super and company-wide 'user' accounts. +qr_apply_owner_scope($db); $rows = $db->arraybuilder()->paginate('dynamic_qrcodes', $page, $select); $total_pages = $db->totalPages; diff --git a/src/forms/form_users.php b/src/forms/form_users.php index d65c272..d261be5 100644 --- a/src/forms/form_users.php +++ b/src/forms/form_users.php @@ -6,12 +6,12 @@
- + - +
@@ -19,21 +19,22 @@
- + minlength="10" autocomplete="off">
+
- +
- +
@@ -47,17 +48,17 @@
- +
> - +
> - +
- Alleen van toepassing op het type 'User'. Reports/statistieken zijn voor 'User' altijd zichtbaar. + Only applies to the 'User' type. Reports/statistics are always visible for 'User'.
@@ -78,9 +79,28 @@ updateToggleVisibility(); })(); + + + + +
+ +
+
+ > + +
+
+ > + +
+ Reports/statistics are always visible for this account. +
+
+ - \ No newline at end of file + diff --git a/src/forms/table_dynamic.php b/src/forms/table_dynamic.php index 054297b..7ccb5d0 100644 --- a/src/forms/table_dynamic.php +++ b/src/forms/table_dynamic.php @@ -70,7 +70,7 @@ - '; ?> + '; ?> @@ -88,7 +88,7 @@ > - + diff --git a/src/forms/table_static.php b/src/forms/table_static.php index ee311d6..d551bd3 100644 --- a/src/forms/table_static.php +++ b/src/forms/table_static.php @@ -68,7 +68,7 @@ - '; ?> + '; ?> @@ -84,7 +84,7 @@ > - + diff --git a/src/includes/auth_validate.php b/src/includes/auth_validate.php index 5bcfba2..88ba33b 100644 --- a/src/includes/auth_validate.php +++ b/src/includes/auth_validate.php @@ -3,8 +3,9 @@ //If User is logged in the session['user_logged_in'] will be set to true //if user is Not Logged in, redirect to login.php page. -if (!isset($_SESSION['user_logged_in'])) { +if (empty($_SESSION['user_logged_in'])) { header('Location:login.php'); + exit; } ?> \ No newline at end of file diff --git a/src/includes/security.php b/src/includes/security.php index a28ba65..31e5c40 100644 --- a/src/includes/security.php +++ b/src/includes/security.php @@ -143,6 +143,49 @@ function qr_is_login_locked_out($username) { return $count !== null && $count >= LOGIN_MAX_ATTEMPTS; } +/** + * Compute the owner-scope for a freshly authenticated user row (see qr_scope_owner_id() + * below for the meaning of the returned value). Call once at login and store the result + * in $_SESSION['scope_owner_id']. + */ +function qr_compute_scope_owner_id($user_row) { + if ($user_row['type'] === 'admin') { + return (int) $user_row['id']; + } + + if ($user_row['type'] === 'user' && !empty($user_row['owner_admin_id'])) { + return (int) $user_row['owner_admin_id']; + } + + return null; +} + +/** + * Owner-scope for the qr code lists/reports, set at login time in $_SESSION['scope_owner_id']: + * - null: full visibility (super, or a company-wide 'user' account created by super) + * - int: restricted to codes owned by this admin id (an admin's own account, or a + * 'user' account created by that admin) + */ +function qr_scope_owner_id() { + return $_SESSION['scope_owner_id'] ?? null; +} + +function qr_has_full_visibility() { + return qr_scope_owner_id() === null; +} + +/** + * Apply the current session's owner scope to a MysqliDb query builder in place. + * No-op when the session has full visibility. + */ +function qr_apply_owner_scope($db) { + $scope_owner_id = qr_scope_owner_id(); + if ($scope_owner_id !== null) { + $db->where('id_owner', $scope_owner_id); + $db->orWhere('id_owner', NULL, 'IS'); + } +} + /** * Audit log */ diff --git a/src/includes/sidebar.php b/src/includes/sidebar.php index cf05094..45acde4 100644 --- a/src/includes/sidebar.php +++ b/src/includes/sidebar.php @@ -87,7 +87,7 @@ - +
  • > diff --git a/src/index.php b/src/index.php index edd8be2..50dcbe9 100644 --- a/src/index.php +++ b/src/index.php @@ -4,31 +4,22 @@ require_once 'includes/auth_validate.php'; $db = getDbInstance(); -// Reports/statistieken zijn voor de 'user'-rol altijd volledig zichtbaar (net als 'super'), -// ongeacht de can_view_static/can_view_dynamic toggles die alleen de qrcode-lijsten regelen. -$is_full_visibility = in_array($_SESSION['type'], ['super', 'user'], true); +// Full visibility (super, or a company-wide 'user' account) vs. scoped to one admin's +// own codes (an admin, or a 'user' account created by that admin). +$is_full_visibility = qr_has_full_visibility(); //Get Dynamic qr code rows -if(!$is_full_visibility) { - $db->where("id_owner", $_SESSION['user_id']); - $db->orWhere ("id_owner", NULL, 'IS'); -} +qr_apply_owner_scope($db); $numQrcode_dynamic = $db->getValue("dynamic_qrcodes", "count(*)"); //Get Static qr code rows -if(!$is_full_visibility) { - $db->where("id_owner", $_SESSION['user_id']); - $db->orWhere ("id_owner", NULL, 'IS'); -} +qr_apply_owner_scope($db); $numQrcode_static = $db->getValue("static_qrcodes", "count(*)"); $total = $numQrcode_dynamic + $numQrcode_static; //Get Total scan -if(!$is_full_visibility) { - $db->where("id_owner", $_SESSION['user_id']); - $db->orWhere ("id_owner", NULL, 'IS'); -} +qr_apply_owner_scope($db); $numScan = $db->getOne("dynamic_qrcodes", "sum(scan) as numScan"); /* CREATED CHART */ @@ -36,7 +27,7 @@ $numScan = $db->getOne("dynamic_qrcodes", "sum(scan) as numScan"); //Get the number of DYNAMIC qr code created in 7 days and total scan if(!$is_full_visibility) - $createdQrcode_dynamic = $db->query("select `created_at`, `scan` from " . DATABASE_PREFIX . "dynamic_qrcodes where `created_at` > curdate()-7 AND (`id_owner`= " . $_SESSION['user_id'] . " OR `id_owner` IS NULL);"); + $createdQrcode_dynamic = $db->query("select `created_at`, `scan` from " . DATABASE_PREFIX . "dynamic_qrcodes where `created_at` > curdate()-7 AND (`id_owner`= " . (int) qr_scope_owner_id() . " OR `id_owner` IS NULL);"); else $createdQrcode_dynamic = $db->query("select `created_at`, `scan` from ".DATABASE_PREFIX."dynamic_qrcodes where `created_at` > curdate()-7;"); @@ -59,7 +50,7 @@ foreach ($createdQrcode_dynamic as $row) { /* SCAN CHART */ //Get the number of STATIC qr code created in 7 days if(!$is_full_visibility) - $createdQrcode_static = $db->query("select `created_at` from " . DATABASE_PREFIX . "static_qrcodes where `created_at` > curdate()-7 AND (`id_owner`=" . $_SESSION['user_id'] . " OR `id_owner` IS NULL);"); + $createdQrcode_static = $db->query("select `created_at` from " . DATABASE_PREFIX . "static_qrcodes where `created_at` > curdate()-7 AND (`id_owner`=" . (int) qr_scope_owner_id() . " OR `id_owner` IS NULL);"); else $createdQrcode_static = $db->query("select `created_at` from ".DATABASE_PREFIX."static_qrcodes where `created_at` > curdate()-7;"); diff --git a/src/lib/MysqliDb/MysqliDb.php b/src/lib/MysqliDb/MysqliDb.php index 419179a..449bc17 100644 --- a/src/lib/MysqliDb/MysqliDb.php +++ b/src/lib/MysqliDb/MysqliDb.php @@ -830,7 +830,7 @@ class MysqliDb * @return bool|array Boolean indicating the insertion failed (false), else return id-array ([int]) * @throws Exception */ - public function insertMulti($tableName, array $multiInsertData, array $dataKeys = null) + public function insertMulti($tableName, array $multiInsertData, ?array $dataKeys = null) { // only auto-commit our inserts, if no transaction is currently running $autoCommit = (isset($this->_transaction_in_progress) ? !$this->_transaction_in_progress : true); diff --git a/src/lib/Users/Users.php b/src/lib/Users/Users.php index 006c1fa..b1ca492 100644 --- a/src/lib/Users/Users.php +++ b/src/lib/Users/Users.php @@ -13,7 +13,7 @@ class Users } /** - * Server-side validatie van username/type. Geeft een foutmelding terug (string) of null als geldig. + * Server-side validation of username/type. Returns an error message (string) or null if valid. */ private function validateUsernameAndType($username, $type) { if (!is_string($username) || strlen($username) < 3 || strlen($username) > 50) { @@ -57,6 +57,24 @@ class Users return $db->get(DATABASE_PREFIX.'users'); } + /** + * True if the logged-in admin is allowed to manage (edit/delete) this user record. + * Super can always manage everyone. + */ + private function canManage($target_user) { + if ($_SESSION['type'] === 'super') { + return true; + } + + if ($_SESSION['type'] === 'admin') { + return $target_user !== null + && $target_user['type'] === 'user' + && (int) $target_user['owner_admin_id'] === (int) $_SESSION['user_id']; + } + + return false; + } + public function getUser($id) { $db = getDbInstance(); @@ -70,12 +88,27 @@ class Users } /** - * Add user + * Add user. + * + * A 'super' account can create any type freely (owner_admin_id stays NULL: company-wide). + * An 'admin' account can only create their own read-only 'user' accounts + * (type is forced to 'user', owner_admin_id is forced to their own id). */ public function addUser($input_data) { $db = getDbInstance(); - $validation_error = $this->validateUsernameAndType($input_data['username'] ?? '', $input_data['type'] ?? ''); + $requested_type = $input_data['type'] ?? ''; + $owner_admin_id = null; + + if ($_SESSION['type'] === 'admin') { + $requested_type = 'user'; + $owner_admin_id = $_SESSION['user_id']; + } elseif ($_SESSION['type'] !== 'super') { + header('HTTP/1.1 403 Forbidden', true, 403); + exit('403 Forbidden'); + } + + $validation_error = $this->validateUsernameAndType($input_data['username'] ?? '', $requested_type); if ($validation_error !== null) { $this->failure($validation_error, 'Location: user.php'); } @@ -86,7 +119,8 @@ class Users $data_to_db["username"] = $input_data["username"]; $data_to_db['password'] = password_hash($input_data['password'], PASSWORD_DEFAULT); - $data_to_db["type"] = $input_data["type"]; + $data_to_db["type"] = $requested_type; + $data_to_db['owner_admin_id'] = $owner_admin_id; $data_to_db['can_view_static'] = !empty($input_data['can_view_static']) ? 1 : 0; $data_to_db['can_view_dynamic'] = !empty($input_data['can_view_dynamic']) ? 1 : 0; @@ -105,18 +139,30 @@ class Users } /** - * Edit user - * + * Edit user. + * + * An 'admin' may only edit their own 'user' accounts (checked via canManage()) and + * cannot change the type away from 'user'. A 'super' account can edit anyone freely. */ public function editUser($input_data) { $db = getDbInstance(); + $db->where('id', $input_data['id']); + $target = $db->getOne('users'); + + if (!$this->canManage($target)) { + header('HTTP/1.1 403 Forbidden', true, 403); + exit('403 Forbidden'); + } + $query_string = http_build_query(array( 'id' => $input_data["id"], 'edit' => "true", )); - $validation_error = $this->validateUsernameAndType($input_data['username'] ?? '', $input_data['type'] ?? ''); + $requested_type = $_SESSION['type'] === 'admin' ? 'user' : ($input_data['type'] ?? ''); + + $validation_error = $this->validateUsernameAndType($input_data['username'] ?? '', $requested_type); if ($validation_error !== null) { $this->failure($validation_error, 'Location: user.php?'.$query_string); } @@ -125,6 +171,7 @@ class Users $this->failure('Password must be at least 10 characters long.', 'Location: user.php?'.$query_string); } + $db = getDbInstance(); $db->where('username', $input_data['username']); $db->where('id', $input_data["id"], '!='); $row = $db->getOne('users'); @@ -134,11 +181,11 @@ class Users } $data_to_db["username"] = $input_data["username"]; - $data_to_db["type"] = $input_data["type"]; + $data_to_db["type"] = $requested_type; $data_to_db['can_view_static'] = !empty($input_data['can_view_static']) ? 1 : 0; $data_to_db['can_view_dynamic'] = !empty($input_data['can_view_dynamic']) ? 1 : 0; - // Alleen wachtwoord overschrijven als er een nieuwe waarde is opgegeven. + // Only overwrite the password if a new value was submitted. if (!empty($input_data['password'])) { $data_to_db['password'] = password_hash($input_data['password'], PASSWORD_DEFAULT); } @@ -152,17 +199,22 @@ class Users } else $this->failure('Failed to update User: ' . $db->getLastError()); } - + /** - * Delete user - * + * Delete user. + * + * An 'admin' may only delete their own 'user' accounts; 'super' can delete anyone. */ public function deleteUser($id) { - if($_SESSION['type']!='super'){ - header('HTTP/1.1 401 Unauthorized', true, 401); - exit("401 Unauthorized"); + $db = getDbInstance(); + $db->where('id', $id); + $target = $db->getOne('users'); + + if (!$this->canManage($target)) { + header('HTTP/1.1 403 Forbidden', true, 403); + exit('403 Forbidden'); } - + $db = getDbInstance(); $db->where('id', $id); $stat = $db->delete('users'); diff --git a/src/login.php b/src/login.php index 5d3eee2..1dbd7a1 100644 --- a/src/login.php +++ b/src/login.php @@ -42,6 +42,7 @@ if (isset($_COOKIE['series_id']) && isset($_COOKIE['remember_token'])) $_SESSION['must_change_password'] = !empty($row['must_change_password']); $_SESSION['can_view_static'] = !empty($row['can_view_static']); $_SESSION['can_view_dynamic'] = !empty($row['can_view_dynamic']); + $_SESSION['scope_owner_id'] = qr_compute_scope_owner_id($row); $_SESSION['last_activity'] = time(); audit_log('login_success_remember'); diff --git a/src/qrcode_image.php b/src/qrcode_image.php new file mode 100644 index 0000000..77a2897 --- /dev/null +++ b/src/qrcode_image.php @@ -0,0 +1,63 @@ +where('id', $id); +qr_apply_owner_scope($db); +$row = $db->getOne("{$type}_qrcodes"); + +if ($row === null) { + http_response_code(404); + exit('Not found'); +} + +$path = SAVED_QRCODE_DIRECTORY . $row['qrcode']; + +if (!is_file($path)) { + http_response_code(404); + exit('Not found'); +} + +$mime_types = [ + 'png' => 'image/png', + 'jpg' => 'image/jpeg', + 'jpeg' => 'image/jpeg', + 'gif' => 'image/gif', + 'svg' => 'image/svg+xml', + 'eps' => 'application/postscript', +]; +$extension = strtolower(pathinfo($path, PATHINFO_EXTENSION)); +$mime = $mime_types[$extension] ?? 'application/octet-stream'; + +$is_download = isset($_GET['download']) && $_GET['download'] === '1'; + +header('Content-Type: ' . $mime); +header('Content-Length: ' . filesize($path)); +header('Cache-Control: private, max-age=0, no-cache'); +header('Content-Disposition: ' . ($is_download ? 'attachment' : 'inline') . '; filename="' . basename($path) . '"'); + +readfile($path); +exit; diff --git a/src/qrcode_zip_download.php b/src/qrcode_zip_download.php new file mode 100644 index 0000000..a4717ed --- /dev/null +++ b/src/qrcode_zip_download.php @@ -0,0 +1,34 @@ +!Y~X)#ZXY@2suiQ21m@rPs5h>HwYdsLle@aHW-tOHwo!0YQ#RnEG|>9$W0>%wf&?|Aaj zFkR({D%1qAH(;oOkIP`?*v}{S225;kA1o~+szB^rm=Cu4t4oJz_8QM6L97QW2OTi0 z!g(ISKRqaky@Wl)!8f;@e$Ntn9rMLDsX$m2kcNNDYPhHn`#1*SP982A>HIbxzXf7# zn8h({9$d7iuP)$Y*lHoxkHI~s?Fb)o#$E7M4@zQ<*ck5FB3v|Hlq}{8u^z14{pO)a zwBQctu`d>}7R*dD4m#C28bp4z&JM;&YZZvKVJ;bXn%2F|%lSJEA=ZXzo_u*pQGF^k z#9qd7u~7wIbcHQW2}#W+)`2bI-%LZ0@$RvRpNKi1SQqBf?6;5bae=|d?KFhg=dnZG z`UuQ>ctNZgt1%Tnl5IN4KYkZt9oUqreaQ|+ZPOLIC&YTN#Rn{QwA)XxJwKs{iVm?GO{+?B+5`7@niESsKYAkyE jTKc9T#F{V$^(9v zlJo!E-{13lI!EgHJ^$;`b-J!|&V7I8`!(M0`*ScKF<+o#suxu*LU?!(ga`gXm_6u% zf|jD3wuY7jo0a7mTc;aVY;FSl=h(PiU2Gh!*i=-N*i^45DzUkV3ZCX;v%GQhx~u&i zHfPuC_BMAs4r2x(1&D-*h?t0wgqWC^l$7K!ISmCl85ub}74=aXW(HOkW(FoEHUvKx z+bKSFCMNFlr}@qa2n!3da*0ce2}H_`m+c)I*dc zczk$#_;{zFLzH;F-j7NnVV5s{O{>+lf)Fyl?Mr(2_z60C1`bXx z?$bQNBBJNT#3dB|QoN|7tfG2VTSr$<-@woUES8nEjjhWaS2y>&9-e;w0f9jefvBzeiEOMo{{-1D?2AQ??p*zS$RceRdvIg#-`?$x2;s0w|;QxP3Y~Q>n!MqL;5a1IK!}G#BNY}Q=byNPeLOfl~(+klwC+`h1UFb*Wu#`;ZcsS@YMd9*?%@M-~X?f{rALv&T9Z7 z$HxPkhffK~K$|<<={|@54_{L0A-sKaPfzkDYbtuy(iB~|+QyC2OMe)2dXjc-1H9JH zJW#A?!Bzr^S4>L+>)hf zs%aYk36dpBSiIsXy^&0O@q|B@wMQM(%hO;FyzK*rP< zNRHMqvg5+nv%8@u%vO&6fOOUE?mphTNQT-X-t*zjUqSCa{8qOj^MkyP+V1(!cj(h& zX4`c9bzfL_pp3@4)pI7udYN@R17WsXX)_lXFi_Or=sjW#l$J0lrG|mn3DLXw7)X}3 zZ_92^@w?d;>t3LpVdUZ+OYHYG-+#7bVis68VOEBL?t_8f3?y9_$3S#ocBW@{zR0X| z7I{{)V!bUiBSyYGWwx_~T&K6!G=HV;L&;Ui!%|Ek*<0`2h{ zmvFOa#UrHAmS!dottUTazdUQao>9%(Al{uSU^>jCymjfd-z zUOpPUIvcp+=TcTr)Pjv!2GeE8)!oq8CL6{;Xm>G^$dq)}e<=QAclu)0{#91#4WHN$*{YFvSCl--kkUR86SAXt}Vv_}DE%6(()w2T_s2&5Y3n^i5 zR#~p7mYkx;W-xN%S~UjpLCzeiuA@M{t+T^GAP71?94AY}K%vNqvnPHyvF=doqWtP6 zD9`?Im)SYouXph0U7aSEP*@wjZ~u!t6R3xH%U9fYeL28ROoO;K9J9lHPuD;7o5p|F zY4;5C<-ic`%qswmc>l)cCjo%p4NvaM+sT@yC`B4k;Q}}$;1{_j4rKdOD}G|s_L%@7 zjb4@wHi#JsiWtmxefjF`gK3i#d4zl-*w(r2<%b?TP`)3w08@{*8@TDG>~G>IZ7~C>y_2-njeQub2sY z+rCEZ28@9X1z{s^JDm@(JYGCWJ9rnni95oYPRe8VEHKc?yLIzEU_J?D_m~0df|2u8 z;GOP^n%{pH?mGwWS3Kn#!kv1Q8z4QzoePUK02gaIO~Nb?!fkJ(zb1WkPkys*<1>hP zc2hqrF!AogVz&7$^Wj`DB(IU3B@DDfiIT%bFHRt=En>B+=Dfgw#o4vQfIlM@AOCRD z_(7nF)g{koiZJ%~zh|5LJ78UKMr=}n4b#dbtWI&i3VI$ljYaT(-1C5i54ZjhOlx!8 z&x?K|Dd-eUMc=6ktPsNG2^Q?A?9Xgd%WcGtB$qyTcZw%z^zyqDn*hiEd$(TR`l$v* zfg$|DV0SamrH63izsEpjB1g9|5a6Y{4|^iBv9R0%NOyd{dIbZed`ErX9T`{pmX(Hq zWH!wJ<}zlVX&Z*~31 z%|UkjK>ygg^)>I24oL;pd(@@8luw?>-7P~5G!lz}4zDdQsw?avm+F?+kYSg{Kdy82 z*qeMBZu=Y`u15DL8p)%vP%E={?+kLe4Fd&uY~qZGOx?|!zw7fuA$k8|al|5xK=$pn zQ|UaX0(9sO6G5~F>w_oU++S4Ow1{rzK%}%4>LuG6#;)2vwtif3IA6#oT^FKg8TO}0 z_J5EQ@*qv;;-ULKgdR)Ja?Ln%-GaTG@=C-Gb6kUlyyvTWOj6WJ-Ob;3rtw`?kyP|p z!Vc;*(x5*Li*`x}hqXxb_Dylz^DIKGh^|Eu0NpX zO7_t^Ge(yYWLy=_-7n1Olyi=_O;Sf0wR|#EiFW8~>P+rQ=x_R*XK^Z-f@sGTN2zS4cd`@LM;+}2__I}qa@qT}6LD}RkWi7#@EXx{bSF^JI zLOpFz1&k``la)Bvl=Q4%jM(zACMJo=_s$oKQwIa&d@g7Xl<@XUJ}*g7K$J&<4yCTe zY>idQ{Bl)-x%GSv4*443SgHQp(@e+^lw;wBax__d`c)DRE%^+|r`^x@MRnmg>o!>v z@OQ*}{(Z=Xa@`6BW0Z8M;PWRw9ds69`SUuR$=M=U!I^;_{ic3D9%o~qjsVn;ZL^gk zg(lsV!MP{|r4rQ>Ii3(2D;G~qC+iQ`agR0|H3}{gt}^wojP-9Ma^rI@^R^4f9j&dd zkdHL}Kot|6dr~u{;UTF|FE>i)f4b8~Kl8%?cY0*QKa`x097qV-#Xz5tBU2cNAy?6W zI3FF4foyGA*Dw$eFyzx+Yn&!iG0=@!474^1?8e`EyF6|zqu3Kd3GHigofR8sj6~BZ zNbJUKpLts01VMWOwH%Jq=6yfkBV4ylV1Psu0KHM<6id8t0F<6Te_oPuxh%m>84;%( zl{9?LAQ*~PVM-Xqad9|?G0pePDV|g5+&Y>*sn_sKZLmy1`vE-&d`|iVIDsjS3z1-h zZ?2Qsi;AM9`Zfyi4Im^Vv2^FNXw&*jB`;pLn*pR2RMD5a7L7$SLlT}10Op9Vzj6*5 zvaT#NFL^0h^78miae#Q?*cng9r{+5*8MU!5VYUfY;j;c#B-1FMbfn6KNwdIObo9!# zqmSIuzjXE7^=xQ&I5ME(z!ufMP|{2)Bd{FOv-hqC15G!e_jXZRdPz-44{~#{qUkVV zMHLeKl@Bu5k*64RyXAp-IP>i(u?+oAhlbR8R_;X;cWlv0?_6|PzH^tKKQ+W-#BG*C z_Weh5B9-Y>+F}~bH*_%InQ4ij-O~b@&KFMB)xadcTQx3MaX9)IV1b(zrIJQopIOKr z=A24)|6HwdMM#wHezeC7q0PJNR>Fbs$UAiJzUKPcq=wTTccuQR5HSFKhGxHXFsy(J zmA8(K3@a2Fx4@J#7yu?S$y{P`KImCAyaJXsOiS+ouLvwF`c8{u!!iHM@-_ibbd!!f z-?CWjZyr)C_EppPPFX)nj8!=tx<|7^mODp_qj>gPx?^@>{Cdd-9M=W#k{&WSm>D+X zcqBFF+J}3zFUl&rCp{L^U^L!+179_SyA29nu8sk0RS6tiFonnjxcyCAnJ}&vI~}K@ ze@WKLyoFJ(KM?WZEH*MUC~8D!v`8|7Ra&*LfO}N_<(dxt%Q=PcyzjV#(+Mt&?0R^z zv0?N~aNsC*>-z*wFb|0hV(v=}Qs1#d1(&2Uuq9e|#-54?=WgD>y1E)a&FVnLs__tU z6HO}lLq5t7beDD}R%f45`oB&u3kXQuaV_XEltaAuD|G3r?|Wr}XypksGZN`Rl;KK# z-lc`+c6BUD*HAjN9?!F0=h5>NW(?tyDrUo5=*& zs8rZvbY)(wW1#JoGGIt}_h@iz;poO0)ol^AQnf)CotnH5(fG2m7wN&{;1$6_|GFd@ znfUs=K~|}+ie)hU=W)U(k)(*I)}j+yit1X6l=6A+zi`t*j>27M4%zCx4S_X31MjZ_ zh&9R0kh!pSDT1)6mr_G==`$jS{wcX^tJM0T?4CP=C%PAz7YaWm&~SvRsz@r8-QJn( zYl9UR<4{1GVf>b8MFhX_bkS~BcD={ zN#Ma)n1x&yAh(9V=BWCu|1OH~gz9ZZHnWE;-R-=i9qA)O-nWe7e=U1BlClHGA~bt4 z6Lv(ZAE|0fjeFtwIL8deZ1=ZdW1wb^aWMbRX~Oqir^R`qY3X-)OI8XS(Lk)FUZ^&h z<4YbF8+cXvq(@Lng)hM^gGp3Sq~Ic36PqNSIJ+407HjM^b!U+`L4XaeoumI)+%j$& zFA`e_J{X|aCx?Omw@CBdykSOfErc)k7_bYP@}Wz&RIM3=cX@BvIX`P#8&u#WeL(&- z5cE^l_2w1@;2-WWt=l>@+#RF(rr2c>Z7Cfu*IRji!FmpS02uAi@T2MoOE((5eQIon zI$#p|)aR|!Lloee3NALeu{lGhdQAq)6$^8v&4RMa$pG3ZToVZzR4&P5zf<&Nd7Aa{)nn`B8;-CMHrG-akj|;(a0ygb z-KNw$>qx78jXTx{e=QF{zJ0;q$pkRveMu^`0K1B?-v;7ciFV1FEkFBgK=PAOi7+>8 z@!cY9`Hxq<;e2-QK@RZcdFN+!bxtlZqK-1y$#)=!MK134o$h-jy)qj`Xf524ky z!jrAXcTPKJO|A9nFKw71=wQpfJOAQ$3VGqzIpkmD&IlBMRa}CH9B)g@J~QINS8~la zK-OsN7$_>W>42)`7yT^z_08JzO+~hz$)pmW>!3sIiRGH($l?itaIVJlo00R61z?vf zI;tfPZ7bRLTVbzsEtL_OIPl)UXM4gfA)MFmmrirjgxxN%#Ho}@+Hgc=y1e9@M(noK z+Mu5({>eb7zP>$zl})~|tNGnxq+!E7ebnOpJZ`b5`KwNi=uV~zfo5aYG1c?{5bd!g zSkhfOTwlR`H}Birh;}fnqvw2e5IjOvwY-T5V|GDD0eUuGWWnt-_>M6VtjdrO~et)l-9&yME=rff<&SyosfneUe&}oQ@@B|qx zt}(xE*IGHIw$Q>;h|amXV~(`sWR&GH$qw6xKGsWsAxPb2~kd=R~C3A*beC zNd5z>M53G!yLt-FNONE*CZ0BlEegsu9Z+y}zV*su+yLRQa9)T!#>crAePaJeggJw7 z70Wgs+hPxWJYZb1jy5$x=hInpB7fa(4qIB(o*Uo=%#QTd60O4zxm zNmA!B)Ji|Yd+Soq8IiCHyx+I(&BwdcZql}s;`_+X5S|ID@_N(VDjMW~cp(hZ+{B5L zC!2*5Ap--9lCHi4pQx;CClW2E>-wvtT|mzPqGS_JNkEG&xCt*A+?wZnP&aziBs`XwDM;VthGey47s5wf?(Dluie?A_$z zEBob`1fFqwl>W4M_KACEuGp8D_-cl!_n9PpoA_90kfy*eRx6?#htn zoWz|Nvx^m4!Ky)tx2~N#BItD+DFL3^kn~4^f>X*iB?f9P7I_$7N>*Cd!}|9AIF;ZR zQT=G4xYij$#=sVJY(hIIY1d|5iJk*#@g}Gy_U!V6O>VTOor{~(5NKE=wq|l&+{lU) zb!9mqb(k5g2n6gy;|xp+NdH$*5+!}hrCXPDOSY|zoEd4>dMdvawY+ghO9Un%DzrSp zIe3nAiq%WQ&P9~_zeHc^`yQ2v+1}q6Xq5pO;EG%cvteBWS$Y)ft~D;ijk9+V)pff+ zz%wdgP$v7^f3a#tST6ytZ5?NRpTM1-<7b5Z;h#D%>^pykf122} z$W~O(#c*)Q-j|d?3~ip2mkn8luG2>Fp@cj5f?Qr6w+OXNR@cXVq9TGmh(R>W-Nm2O zDC8*|R%Gt)RXm*W?y8R%bAE1F=lcAhvSZPi%?>F$L|AR$)b(hmBN7RZ_b3b5_q=6R z*)dR<%WvtY)63Ca;IGJrsEeYY0zlsmebK%53h-Y1B%nPox~X%mQpp>R4SF!6DO3$3 zZi+RlKncal8C?HS2PTsq$=Jobtl%3SH$1XDEG3gZmM~c$R_$K>6n=DyUh2#h_msRNHKyVKDuG;fGUlJ z*9MnkzgAT|ZzqyuwViU6zPzl|%kljA)7J8bjMUclmWMppk~6!HUIir_Y}Pk+`xWjc zuYz1erXmQ|UTvGX0cv?eIXG+VjwSy7M=h|PUiP9TSdu)PdOB{wOf>vPjBdd@|G@!N zbQL?$(qG>(>fMm6WxW#D&~S@$fX`k%tvHf&!q+p#MD*AG4F+z;+Z5P*H5+*|ZTv22 zxw6PfnduO*Ebr}K=rvH-dHA=FAPwCU6vJU~9)-c_bwuLZg^hN*gGq+4Jln!pyKw|*9ERWWLCHwZImO`LKO>oId{}z*75w)ROsJXt{*C#`PMoAEy6W7J4Hg-LbuhJ z8yY9O-G@8oS6=|;E8OUJqgxwAecN|62ZhS58 zuSa`G&&O2*G2^W&bXXFVBM4)%E56)!)kpB6=V5OQ^uSfwl`$uy8ulX*XD&mCBYm}Y zX|w3^$j`<`%gJ~9RT#Y}-oHV7VR98F^A5Md=C7M-yr8F(LrYCh#_73Yv_={u=gw;a zB2b;n5U(e=ZxR+1R9aO!Z(vzAv`i($DiEjwC9gMCy>A+0)}qtmUMdHa!D5(*SHEa7 z>5mdkvIC3;tdetRG@ghO_A1#lQ32kf8+eeWZ6$_(U*%C$Z z@0UZei~7-RYnN8vx`PY}u*^hX7?v^8IURkVBkTWARx0W?PeA$t(GEnqwF6n`M0qzz zJCFu$I)qj!E*o-^)U!z&`rwiA8ukdEtDX}%HM;F+-C$2fi+s4)p`T2`FZ$P0*eA64 z4SDqk#%CGYG2GMJT-inoPJ1o!CQ=bY_d5@FRROMj7ntnjz541r5cc{Oi$&eV!nBeK zeKvL2XQ(t^_WEI6sefkwXLf#APrU>GH>9TdJh__E+7r+U82q>Iliq_*y~sx&0A5K( zpGhm}=Ys8&!$1`m{S~htc1l-!m)5=IjmSuAo>~_div~8!az&HQsb3!gvv=xg|2}!o z(H<|6+->Ko{Ee3mE}HPrD`7tdtXJYD%f@+}cpp5-%IHZK87Wv5XuvBzSa$oeVCv>h zCqoi4aJk5pLPEtcbB#$=n>p3l$IIKcZwesv5=XV)d#9Ij!*9ZCBWiErJXY2F%8ByM zo)c)YlZgvtYqY=GuDm3j>&lxJGp5GqAfp-1tG`<+K*a7WH4zSAJB*XRJX9(VGAs2e zRF~TBR$wSs9hD`fGd_~pzmXJHo>5!|`Hyq@N3qI^sEA+!ATGrcSp0RubI$WTpE%@8;_|U~MkJ*t~UEa8ZMwCP0*O*ZIEhVRgwqVbY&X2NKL!7aEHyXGa@m#9xa+tB>&G`a!lw?Oa?sKC_}f*G^m=NlG#G1 zT&1pN#kC~Xiob$fgX+G`i&vpr6u|xgk zn~ZF}7sEw9X4~f0)3Zwxy2Vk|47e7&V21OoW^jM^X~E22%*%QQb~ah4c=BT_uJ9X* z_IG|7EP!pkq#k0NOM0)Y=^%D8x%{gbUs7!ja2}Yd%K0=;{hF{DP82?711Ls#ihKa* z0`P=0kk9$WFicoBI*j+@@Ji%UNoJu-rTxNNsO8bMq8sg-LwaI}BY60!v{eoc6iL;u z57`F`!8mgnnK$)v0EP&#-3i81mljPzoMV#5hqG`LOVM`*=PXo3+Ki_wY+-;a+H`bS z5DH{3{+4^^Hx^1aJNNUJJ|2SFcDpsV?;syx|vizrppvm>o zMScf~euFdal8vFTeUas=l@1=_I{@p2mFddYl`|LtCxAkV6L$y#NVY&3rF>4i6Y-(S zryy6KgZ+q-YZ;XuY%?Hb=3GbJ7WK2hlz;@H4E8O6HZ-_utrcvItIFyDzf?376=_-z zFWiwndby_S%Rd%m@k4DO@G%$qT5z%^!KjWo&!pjq9JTA$&&N0%7v=2y_?BQ*PFkfv z@@YJZpTT3~9xCjEkI?<_5!Eg%Uosp7d}D$XHJrVChVv)7@Rk9eq49kAK~SVw?1xQK z{J={Zz>qDq43njBVkZ0al=@3Rnmk95g?A)aK>lUDq9OfHwgl22bC7@$LaLmLRqnL;Sv1CIMIQ>GniohF((H; zp_O?rwic^Qi~EEX``K&h4yhx2@=HYyBpSrjU?IZ6nI9Ja8p{F1-2x5-C5zT= zzC(W1>CkfkD(?o4{zw>XQ_+4C|%j)14fja{j>H*mUJ%x?onT`exswglKa^500B ztfXLn%qBRFnC^bT@s(pLN$BGn8VcGHx+~Sujc4)2r0?dQy{F@S%iH;oqNA?30Upn% zda;fC;=7I=ngM6C;#}h<|7xf7fhxG@nZ+}DO#`iPM_a%foG>xEQyitXNX=)a|H+ zPC2}GiD~ouVb|p_YUE{|DzDmnA5Yqeh}ZWg46oeJ&`<^qr9FG&%2$&AYQg^+F}YH9 znaRGL7V)zfQ~PkCT~a^&ew2{!oXSMZ{IW@Slm{n#Cr{qXrMGhT-%$SGb|AEn^oF%x^p}{#sE-k3v>32>#rL-r!yI1a%_b$D^vP z=(71j{%tm2F#|(3_+kXO_yzFW0^kf^80yFB$gYk_Nl8T0xu^3}){|j1k!)ggOq(4t z0?+0ozmZ9b?Or8)_3CE0{$T4N{QLJi?yapceD1mP@y^SezC=;6iBlp{k ztmq2qzsnlL|8;h}$Fgw@iQPBr%9A<|j+@;#nc73CoWAwvb$$EXSu@gfWv7_3~4y_Z8!h08^3%7tw$ylfmsV#F+Ey`L_j zkBhEV;$;RK-|s=(teMAhEZqt>D{v{Nkj#N)#H_;P^6aF_bo=B3pA4G;fk+Km$!>$Y zy3J$F!|rikgrj(25)hizaddqcc4)Npop$gSKSskVYRqq(+ew&J7L`(K)sOBcA5l@~ zS%93z_iy6?543Xaph0aGM-lRKy3Zndg)1GO>F9ZXA~`2!F7u4swuS!Z$>?nTt>`t4 zlJI`+RLe_Ws-ry+JKxb7-lH$2`rEXv5+9=&#nwPK4KcYNl@R z&KW)$0MsDST#$1N(1m64#7=+t0kAJ?@6URQGO=;{KtS2h)^7ZmAo0tQM$aqk>HFz7 zKWp~+EVvBxB!1i2*TqK?Z`K%v8%sqG<$AOF_)Iy+}DGzQSX-jj3FsB`Ih1N|{w1w3?=qEZ`~m+y_%iG1MhX0LK&XfBB(^NyVR} zyQdNs!&;XS9Eq%ExMafueoz2T&!ZG*G;n^%A@b}Ntc2F706ajJfKtnG7uIexlBnoUS`uv3i)AsASH>3sGf)qEfjh0@IWy_;Cl%d} zo6;6n7FWO?0iilUWNaC_qj$#Z@ZgBCtbc5{uB?VJeuy4(m>rVV%xF*%_6NcwKz^Z? zLJQ+dXdt#eYu%Q+m?LqGs|j-qNW{4T0JzrS(w z448PV^-cl^9vxmie$PO0(QioOl4+VtfwA=oiY&uS4FbA>ZeRT+#&9RuISt#_uWDkh z)I`te=(sn_lOKUtyQ`o6hNpV#aJKx3LENs$&!1Wd4=z)DnmZ9~0s}h~cnj#LhHdlj zfUUTXpK=Mi%vV=6$S(2O>sW>;t_3IFcyV_z{DP*|r%x?oPt-Togl{(wD<5MbKjJl= z@}$ekiZ$f=dG!0PcZ?ovvQFp3my`dtFsgQZdgQTvr);-i$zzVUTw?goSsszYHun!s zR^7|Ax_ddAggqcO{fL_H<=aZ;(mdb%a@F(nYt{;E-<_5{c1*y>D`x&;TH0H?0ecCP zRXKd+wk~4OfjIkfme?+wy5k>y5pu!T=&|b=BD8ju!F2SE8?rtpAq&JNaeskLHE6X2 zZWZtX8{ma{Po1`Z{etUX;H+ldy5xFvd)y8K-K)Srw1&7l5wTAXbnd9f$L?F;{V75I zzJvgNrhv0br4*M?xVkMq3V!7lfzF|3YL2E#@^z^mi)3tsl-y*W$^i!=ggG&LGB_o;AszkJ;YcO5-1_%Pne!x3M3@-2B~tN1!t100tx8PY8BEBuR#IPJiFPVjBaf|u=p z!@^w|+)Rky_kG|2>@bPK9gu1Kt;2(Wji_KUn)eaVN3#GHtBQj~KOAP1m=skNzl*fL zjwciJkDbi@k2`10kl?8}kr4QpqBk!OXe<%1`Rn<8rU%fDa%zFs0kHj;?jtszWIiri z=^)s5>MmPz|0Ajvry&<#Vl6LiGi;kzf%?^;=k3#v>@^)WkIOkTKF4oQk?P tW<_tGENKz(NKf$qrPkRv0O1b<{0`9TLe=a88qhmU4j1wMFJG8X{|^MU`M&@F diff --git a/src/saved_qrcode/Boat party.png b/src/saved_qrcode/Boat party.png deleted file mode 100644 index d0c519a17c32adf8e228ebe0a43d6ae476f554ef..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1262 zcmVvtH!GQb4dr}HsSpXV{LY~|P{D(D0){cbm)?k*fk58MX$F9xj3&^e)5gjqP>`|r@CT*y&>drBGTtv<|j8Eg! zLJ@O2m=P~2QG3zEjpEbcf*G{QRl1#;C?Gn*nV4=k>y2NoKATPlF|o|a&hrYTu&)1o4XrMctzNkY+V3-b^Df*O(i^gQaETQu@ zB_X^$z;$BpQ%&V8O}XirQAjMN686sV8P)s3xP6StN{LoeaZkIq<(?I7yaB)z)l0BS(R@-ooBO)#y zn3^N@KUECl*j{)M5~|);(-dci3c>UYx#t_*Gx~Xg^Fe2o|4rZ)T3jb?dUUQ@K>o+i YKSkT0=da#}ssI2007*qoM6N<$g1yyY@c;k- diff --git a/src/saved_qrcode/Call me.png b/src/saved_qrcode/Call me.png deleted file mode 100644 index be74ddd1b51c8d7e3901e0e273671163617ca279..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 295 zcmV+?0oeYDP)*_0NhDLK~!jg?bzE5gD?<8(e1$fcj*os5wDlwm2W1xqbP#);cJiyi6DeH zWK?=Y8{4EGhcG)P2P&_tFe5fAE^{8joS9Y+`wtc&m%yCa{XKA5h1sym0_oQfX2(wX zu>^Brd+*=O$@cJ_ADAI4x&Jnv?YF!f=E$~5&&Kn6okqY6SzD{iYw3ISFdtT@qxNSx zt-y@f>5?(B_jwP%9NDP!OYbmKrkn6_bIuz8X2`O4ImqX)1m?=5ZtWdr%=Bdz=FD#9 tZN1Fi?c}hxvx-*#@Rt;PwWPRn&d@ ze@zzk{od9gDZHfDp?=FAsZXI~Fx{6&7`!rz$Mo;vzhJEY>!*7G7^XS=_uV z-r9Tm65JvIMF0;30)uezz+f;wJ{|$l17adVLLypn3epFRbj(bQbPNnE90J@dY<%nt z3=buE_=JQZ5C}83l#HYZR6rCW^3Nt%`1trlghVvN#55wT46GvmXSwYJ$nXGbz#1Ei z4Y)^!g-wQa+Y2z?apGeAOMw3ntb5ovxF9edJ^|sKLH&K;9u_wCJsfOYTpXM`>%hBp z0EY~hoK^S53Adni5u6*Ubl9VZv}L!L(vF>wh= zDQQKer^+g-YU(du>ggL88W~&N9hTi2dj}6sFK-{1uU}YrL}XMnJSI8iLuy)j#>dPr z`2~eV#a~Ol)zsG2Hy|3Dn!9^?`}zk4hlVGore|j7<`))GYwH`ETiZLkdzju2OM4- ztaVTtpYNOp_iXo|yQmWWmdNy1ZhiX#H=^HC3;`B>nObK9qhha}AhT!0CFi8irzTHl zSJ3vNqmZw)n$`DY-(vqJ7v1q&e*kOmHfrbG<9Bl^;mQq0@j$x#9gClNmhh!W;3yX- zwywWlii_F4WdRy z8(&)0NG*o=GAqKyw0ji+vXge`%LU{(E@sNpN%nwWkg5Nr|7M!uW@3h0JD0M29z8#o zk09^^RM^n8Zm}LHu;OS+_q+QtYY8gR?CGI8q43q1og;i7wc-@4(q=k8ndF8g7B<}>FP^wGkjNFi~M zGrmHA!zdvQuvAz2s1J6Y>XfP=<7mt5(V9GYMovtsnbJ>H=@bkqX8N2q$AzO4VttYO zdrE2m?fseb#g8C12Q!xXnE*MQOtFsmlV6bt;bl?I!XCZ~nqF*LL%bg;on7qp24Mq1 z;uz;za+qAt#Qd(4wE*sF^nMZC#%Y-yHeZ5kr240aS$zZQg8Ca2Oa;@Ld)1uMzlJ(W zW|TUZQ2_Evy<6EWV5Ln`8%Uw{w={WTVK;$JVo~_J zyNJl)F)S(StqwT;2%ev#&=9dPu@zB|t2&xz&<} z{EC-thCI&3Q~&N%*Tud^hHTi3F)(Ql}oTf)T8}JXwe798kVIL zCaM*+kp^khujM5WQBKXOdS(t!p+>DdH976=4TX{u_qxQ z0YvJu3R+lPAu_rB#^Z24F?vEdQrRe~D~-~TlKL>V0S4EMNJZB5zs_2)&b`OzOGGa- zlYI`uwAi2*bJS&Fc~tso_>^6akGXKSAXb%#w!1X5`uwzKJlmA!)XDOr0lk_D0mw7m zZt-UVhdv13f{^QpR1u;icH;RlNy$D}@^en86neeSSSv-Ksch9@)%tkt76^AgTy;qm zUmxKChiY?p9%TZTvM~=olk%R|R+{e2QRTl3v>oW)hd0~;3XQ52qg&=@&zc4fTdNGO zJ79t`rE!yiu(YG`BUMg@nX04C4}h)GCHvRY%9stz>z< zX*m00@;LnpdKp*PI*3DnT`R3R?9EF&;E+Qff_LrchLU0LYvwRMZCmH3e{s_rL*eh} z`jHIe0bj-zRW;Q*_*^0>`^U-z6Wsd@{HmdT#_|Vh`p^UPp_(>x?7CrePu{8f^%kYF zYc#e-%AnZT8~ywqStj&pyyLnIy=F_+3+af_rAcLH$U^3r63iMABqUtbB9izW)agia z3n<+J5!Gc5D_o)c23qa8+G&@BqQw_KmIAYN*%@AdLCW0DZp^sR+t@6OcR$4WA7+|e zzoP23kq(lD^2DinuPM$PDY{E$;X=4Ldnmho{zb+C>)5Q-CzIC606CO49?Y&&`tRu3 zHHV6h#(Y#%LqW3ov3io)*6_F1fYM~ed!_TXO$o%N4$|QF*P^F_DJyw5AqLql@qTvc=>aP zXF7#d9`g5QJQwTrwVm(T)=~2V=3;v}I znh=$q`vOl}%pckc_r0-OKx^tVW;})@)z`P|z|mLiL-NtH&=reqK71Nt5zPW|N#Sq~ z=OxG5It+t^KHXRmad9~Gd8tg*N4g!;6{YI-$z!DYedSoHS4p=3-;l?d?>ZD*WaOAR z7Yq4yKu7HE|Enc>&Ls0xL&Nd7R)sYppwNcM8?tVz1(H2{1{k(u&SGUbV6+?)oHxVG zlQzHqjFkGCEn7vy#YHIHN9n#)dv#eNy~9TRn8PeF%rUae;#q6Fu`O&vr1SOh0^8Q< z`afBX6l+DJoC+HL=qkR)8l+D@DC;Y8SPX2aZvORRYBNg}evo8U4NE19mE$~vP9Pq+ zK1i@yOEeEqMUSPI8qP1Czw;`Z6>u)jnNy%xTuDEkgC(Uu5=j4@|DhIEt;$|_tMVulOqO7iRWc$F`ZOg^G&-ZUmY|1QVFAGrj4yFBVMp$ybV_O38a zc_ut~^EJgjX_fml+TKVhLqA?VE|L8LK|}>US1lipF{47ytmIpj?VWn8IvA{&!HYX5 zYmgj=reA!$DFgFrXdh)CAPW&zHqhsEQzzia0W_xXVc*8gkyM_7xVRnr1f@Hz{BhBh>QUR{ksCu9B%X2+E&$ z3l*e{D7$+mQ03cZK4vD{r7C9OU++Q)g6PrPk*$FhuQUqIv-EBOIP`f&wW?L0vvTm8GPv9>5Kn@@8CKZ0d3dd(@gsE|+Dt#-b2^>eT zrhi^vpM+#nuSL}7hPMg_<~s`eR@=XDh<#YwlB5)h%8sptSn?N%GLdXuH1@eM@y@u2 z`O7>Kq?p(KdX73==cVYj;0XsqAN9FW?4(JH*9wLQaXH?wAf^ry$BV`pk3Qlg z@%p-1E^%bxKWDw_!QLG3h$=oe*PFRE&)*e+u?;9^{u)1C>oD1|XhPCjHP%Jk=!l4u z4bcu(YD^pj++P&0^>8V2FfN7*CI|8w22w`!p5ac@9)5`pn!uJ@4*YEWt`0i}7(}m> zljMjklMZCs*eU|kY>^MQV)A4z&InlOL?x=sUW8Kb;Vh_=bmSNsx6A3;xFdk+C~e? z$|(!tX$?H(4{a?+hpj{8k$NX`@F0oFYcG%d^Gem}%E{TGe3L+SO};sjnusfd(YgY@kYTeZu^(#epJsg;ojr=x7@Lk-Gt%sg?{t*-+%*&nCd zjqdq@QrEP}&cVv>Z-L&GXXPuoF6^ULE*ug)8~V(10-=K*%FA1EJ`=Q*3} zFxkEok5X$pF`DMeV<>#hx1wf|zF8q_Y^xZI-nk!G+Awt#uSl1+ZqNl11 ziwXLr$TZ%nDKc?%TKxUVJM^cLVHCw2XC~4R_B7>%e_dS@t6+Rdyiw61bqHep>+%Navto#kKE9a*ikPd)?9zzvgRZ)*GJ!3~U+jL7bB|XT-1xtzS%GV% z4JoRVEG?Z@yaOKF_vvpVre_OK93ei_p?A9yO)De7IBgSO=_v zx&@+cSTLY$JJ%pi^T2i|*~M$$*}I|#F8S8?MO{{k_kjMqfvb6j)xBzgx{(eFScf78 z6dTA47aNg?JhEIYgin`SW^8SKtoo|>&ZR1}SBd#B>G?8@c_7p09aPbdq@)lQIdd~= zc2*?x(WUnsoogJFLB!q%TK?9gb57;@#J|`-Y;Wtq z(4^QbrLVkX!UgA%ff7d5PT@I|(cIU~#luuEA zT~NIuyNInmelu&^G*g93`b8nr;ESj+jHi z&ofR(63BVwGZEEl-c1q_CwvBvWd9!^(8plMFTcq5%;?Y411rxXuc#&rhiss7jvuFc zDAYI#@{UKMu)3JJB*z@xhrIq87)*N+OZ1C4bll&s>vHhitTM51P{Ldcj;TiKWEGe_ z!Aa~%ePx3F^LM*fL-gCI57h5q?%IFnvN!yV4^mD4IPY<$X>=A6yqN+nBv@VW>veMo zqQImz5xKV-q*2(f+E1do5u;Z0Rt`}FU$s>~M!k@ygi5)s;{`C5TtgA)SLt+-SvF$X z(>+G-#o|m4lMDyW7(!qhNueSw(Z%Qdb=vnG&FFrJX&?`HP0=R^ZpKeR+>FxJFCb5l`6W&q0XANzaT98}ql-9P&7EXjgF&hHc4`Y~g=O?Q>`_ zetVTA4n7`c%l2my!b^sx@~;!&96F=TF5*J&tIOaDUKbVg$>nOSn8__b{G`MX#%t*B z)6jvw#u!Pr@@|Sh|7iHMsfbUUT)l+$5P*sHT-r=^gdH9hR81Z+U+J#Pw;_`8?LqI?|ZBkI*MFw?J&U*u6~K67I}1*G^8oH&1&W+SuqNR_Wfqh_ZiM zMa_z#hjI69T@5r-Wfj9cy{EqXIEnRo{R7&sEmW~i)!nVf9<&x528IBp0}^p{%#mnC z6kH53RaP8xrJ+%aA0JR>Xl4Y0=CSp2n9eUr;x^}Wbm?fO{f3RQB|gc2^DN)!sb|rG z7mWoWpO2-Q5W5aUd!ROWsSG5jC)eQ5qX343$?H)?j#Nl4-dY#PiJg$BuaB=vIo~ zqD=f@L-n{lo&3_!LjjxL8~PUu)I>_JfMS4Y=;;F;Fmu`Y@NrMSHtLs*biX#Qx^&r` z&*Hm=_maI4Gz?0Ag-EnOqPydQ&X>;y!cuy4c4Zmb(38tZlUGlQ&XY~jW5=6x%9HNP z1tMNIj^Ul&wP&KG8{&%sUUWpgn(nAA_YwpTy+$x8j@EBvcV6gN|Gek#`Rmm{s14dB ziakYbGQi?*ZD6TGvq3ubsrBqtKxw_zh&2;FG-;~+4d4>(mk{n1+uu^tK7HausF$lX zSq_beTtr&dy$PDcvP)Dl4QK$fBB%x_nZimO%t$et`*h&Q`fS1{7z*U>Z2Z^78hVpR zEPeA8(28DM8T)c1_>)z<8>;DAW}VU87?YFa9l-s!+AF{&?UJV~B;8%<$d+<>DP4!= zb$kyCu2f2=wAeP>(-h=?3*2`=_!t)!ZXC{?fj0RA;FBz;!>*Q%y&+{yP8lvA4u4{c z?)wcSK=sPbbzP`_Noc(?+>?+)zn5>=<6lvU6D??xe2 zo-zI)qphZ$l)ilfE{;d`g5>MihV%1JC1b5OeCXxA-UcQP%=_A62Riy}p7N1VnW6$# z$=`=;FCT};H%e0vJ&#}73K4}GlshBH>lNAxhRLzMraUnh|G)R|B<35Q>n+Nrr z@nJe@NNnCSo42lR11CGJ;%h3}KbarMg+sEX?>bv;r=>+^#!qF|-`G?tQOlZ-eOHguyaiZb z?l=}NLy?1bffqxeGR^nX2nx5jYA*gQMjr9DyZ^OkDk0A#J*doOY(2 zr;RcG*jVEEA&3x&KOA$hSc!&f#}^kGb$(g^md7?7`1U?r`C=&>=|wC6Yr=TbZ$9e^ zV`ZmavT$Ai){1daYmt|2Jo@tKd0?#=jfc#a%OqI<_AX2Z$pUY_O7m{>x&W*Ns|TG( zv}g!tfhGFegA&+F*gdqSH7&!FRbVMhH=Ct`WcA z1z;(RgNlWC^QOgZek8I0EQzs?klA7e!x}`Q%vHNrU`<%{ zZDaLu&ol&B4!dhe__uv<3DM_QU`-g=-HUCv6gjD%vm%cy083)jyM|cz*sztRvxWfs zVQjpYd}r?YAc}V(k_9Y-Ma;Wjc$-?pm1nd=TcGZ?HsEyvHt9FlowP2eL@(ma^ zPk-={eH5Og23Q7*AABYmv)Me;kOJ&|80n^mhL}MC_8zRZIkm{ea6EKDfh92=>JL84 wLP&H6tPzV7(Cu;kwNxH$9Y9c0MJ^D;l?VxNB{r;07*qoM6N<$g1~Y1Qvd(} diff --git a/src/saved_qrcode/Free wifi.png b/src/saved_qrcode/Free wifi.png deleted file mode 100644 index e083189ae0a543c658e7c6e554885da115b0edb8..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 447 zcmV;w0YLtVP)XtT63)KJs0dz@3K~z|U?U=ER!!Qg*X{1o;5j09RlkLqkibrs%A~5fN()Jm-?hrsM z!a@l2QhZS4r(}_D{4YjDyyVH>X~i;eV~s&7me;5c)u9oW^DhyIYK3auY&)$b=^lze z^(NZ#9*{7pbx*o92}SI*2~mOj-#X|?tV=+s8tGi$`llzk!iejAi*AIfs|$zNL2=-D zX)%aA(IR5b2h~H%v*g*ecPAq)*_}_DOf5ru2}10g9~+&Idjf;eIS4sjna*b&Jp4|x z?gY84!VXq1L$#!aAUNuCl&R^(ye%Tp2{%}&?unM`JqYpXyLmzAV$D;+5ZzFq%qzrB zaKl6%gH-ox<(h0Z&l-h8J&;jQKLL^qvDV-SzAT54^Iq^o~=ljB~6 zF?_g72}F3>e4CARI91PKh`%vh_%-Ar5qqAgU6k9sw?mM};VzUMhlss@?A?eNo2mN# pEubgyE}?eo-R!T&5ab)5jUSla4vg!XU&8> zqa0y{SwU-UN6fQk9`!JPbdh82kIg=MJdM}!VoV~l-K5Np9oq63yz zF#gv>NvsNcl0#;|&st*jm|wPsW>vF7so&BX_8zhCVR)G03$=&p>{^JmVB(j(G%2bdV+gTLSaj5jcv+kw z#3x2qVl7yN3|(ZvF&^B>Q;2QHRKvNW3kl51<8=%n_6Ab`_4?)R_PP002ovPDHLkV1h9s`Ro7y diff --git a/src/saved_qrcode/John Doe.png b/src/saved_qrcode/John Doe.png deleted file mode 100644 index b7813f962f3c81c3b9e725c7daa667290f57d3ae..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1122 zcmV-o1fBbdP)pBod$6%n$Y=8jUP^OmX228pEt0iY@g8&=QW)29= zJJjyQjXiIJ_YADz^${$3e!ls}BLCrsQ?1gTvljQ9dv?1>j;m_1ks?iXpW7bNES`UB zj?eM7iLCGOa;d(jIj-(0LG-yaGik*goVwoU>f1wmZvTcSAR11F&U36mlp@VOHbm7!QcA%lsJ8B=~uEXSxLDp zLE6_AY((-)Qn*e$rMaowr=CJ4z$W4-8&Tb=*JI(r3(4o`vHUWTBq0a?Ci~+AdQ2hl zq&9NaC>8HYzt17LuT2uSjW!~Ab8AgYTl<~Mh;jAtOP!J2rz&oz5p{j{9Bvd;T(>GV za^OmZ88YJFSDAskqik&h+hnzyL(t+2mJP$XT0-<-O~i)u~Nm=N13 zq6Tv3uih61b6I+d2j4K#Nk$?IQ|2lm(cqj~n1yY91ta0Wd#9tN&Fvgel`zBsD6<-aUfNOJ-;fm9u=1Srom-$ zHbQULVRa}^?!&7^_b&5y*MClAi7Ou+gb7b{9vgG|n8)|AkUO8r644Y_gTIlf`|xvu z&k1!9*Lp()`-L&D4;`8=)kZMtHDfu6C}H*C@{){-jZ<651-W;_2;#VuuYVfkQ;{qL zznVq}NzUR{E@U}bwHe8MimTl5Z*rZ6NKA+i4K6lvdH2+YN2+533q!?Fwo!=&!U9M1 zNV!L^!6U4ssToP(O@xM9T-YSAgku4ap>Gy~38!LM>Kf~7!CT^Kj&q;;Rl?T5MwS^h z_4eZFIz|nQdvdQk@clVF~6A(mN}i-QQzMx zW+N24uI+)I(dwss|NMesA;mG1bG_5sqb6}Ri!+iUV=-zl&U oQAgQm&#Z_9;wN*TlK<{9 diff --git a/src/saved_qrcode/New York.png b/src/saved_qrcode/New York.png deleted file mode 100644 index 8ba6aa7c56dc28137047a72511793d334bbb4e2d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 398 zcmV;90df9`P)mWt?7Mg;yDp&uYql&Bm*}5Fkx&=m%6x*zejie}C)>Tq zw&n&bw;`q-=F@&vl~2<9)bg1Q&F8&?U6K(apJl^)e2|zz)cNehhx6_3iONBwX+Dxk zqFlQ6P1LDPA<{iWq7+H6Tx(x-RPH$Ju1jv6Q)Z$e#uOsG%6^IRiSk= z^iHs{HI=|_8Jr&DoM7bBc>c*0RNND-Lg1uI&LOH=6Zj@0c<{mYg1q*^N69(+t4 diff --git a/src/saved_qrcode/Pay here.png b/src/saved_qrcode/Pay here.png deleted file mode 100644 index dbdab9d3f2211346bb75d0df50d35cbc7924cd96..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 895 zcmV-_1AzRAP)6fisgJW>z9Pp2%aEum0D7=!l^D%vZR_%m={)bHE~xb(3eBfB1@hu?ji}up}$Bl&x$H+Rl))LGTg{< zQ?D+O8To+^Pnp`j+TYFnbxC$>k2l;72z)8!1Ln2%r><2AqZ)Uyud&`2Bs*7_d zCNw7eTSEUK$@GAHWu8{r+C(go#KC!oC!$|C*G-wg0~hoM*p}MwGf6jy1hnd;wVk&0 zJ1ZO>3H8>&6@vA`ZqIOX7O&!h+N>`xA(W+aHY0xXBVwbf_OZfy)UJp zN+1aO8A5~;tNiG3di=gzC31Sl2}0(PUpilphF6iEtqo*z$jDU<(f`~q;# Vnv%>04+;PP002ovPDHLkV1jW|vYr3{ diff --git a/src/saved_qrcode/Save me.svg b/src/saved_qrcode/Save me.svg deleted file mode 100644 index 13736cf..0000000 --- a/src/saved_qrcode/Save me.svg +++ /dev/null @@ -1,10 +0,0 @@ - - - - QR Code - MEBKM:TITLE:Google search;URL:https://google.it; - - - - - diff --git a/src/saved_qrcode/Send BTC.jpg b/src/saved_qrcode/Send BTC.jpg deleted file mode 100644 index 3fe7691ca8313bdf21e0ac25fa7c6b23dd325297..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 21888 zcmb`v2Ut_v*6+O#6|rFf>7W9F6cH&>#j*hb0qLCxNR9LkLTsQEK|w&N0@6#Qgx;hI z2uO|6d+)u3i?j~vh2IT=2(aCAG0>xJ$>M-Cq*JACK}85tQl`H`c?DNh_fcI-IqnX?p>jC9OQ zjC2eP=UK0?pTEe>!oa|B{WAAeJ^=v%W_A$?;cMbo_yw-vZ$d&&PJaB@ahek+Xs%sg zxNz;i{=rp3r;m_ulW>!gT!apsCLujdf~$d;K|c?X{P_d@pC6I~qz4ZjCOblY^ceU6 z>J)T24xT=A<^tcX!)KKZ$u8PaUVHjB?g-26>@QR*ZA+~D zM)uFhkDjBZp`~NH#LjVPG+g*)u#cIyOErIW;}Ayt2BszOlKry@T%;2}Js@Zh`;*)v;gtbsF^Rz`=v02g&gL zB01m!UZkfF9=gDH_{=S3GDEww7q2}%LV5dbT=o}o7Jii_DkJ;0qvu!!hS`?!UHh|V z|5?YL{a^L$e>(Pezj~nKq$FVSNKZqO(B=+D{F9^q4`1Seeq3m-(QBBB*~bIxnbzS0 zSa|k2%{Q~IBG2A|Jtda-GJC%@#AnIr$zdFHa0L4UJ2{GjpcPRrG)KZNDK^H7dFjrs z@osDohV<(!nhU%*zDkZyHmx5YoqLRfZpN2ZsNc)#+Hl#WA<;bR2ZSe{p9k1P9#~oGRADJe@<#4oL1D z)Qq;QSfMG$K}cW8H5LQ^M8sF7dTbeJ)ORVjpOU+^u-Vl94>;&R?E3fBOik<^>cRD8 zcI*qwX!mg{)vraL#^JoFsd_S~tB~HaffpFIMCf?O{FFd$HsWM15L#%!h+6&Lc4tIOvXL5n+>bv-(cL z<}5`q=m}ljvRH?3>VS>UYDHFNgZVF`U1PD*T*xgl>=V>m9V|Nzdh0ifCBZ=-d7K7l zz;DiIEEyOxlxy~vJsWzBSiy|m#m;p$-<|SvQS+W>FchNkD2x&gVxdA~NWoa^%$5>1 zq?ICk_t76y4!U7Gy}1SUv!fEBN4mz#=F!E4uEtoYUf32h)~D<1*8j93kDx(lf{#q$ zpmN0L`MI4%FPMuJkH?^c{~me|>E#uvv$F`SL7ecZXr$<}Bql%;wnVW<0?%5i$N1-0 zEJ^O2NG~7_m`GWQsyKk!?P;>vV!y(B!kk+Q%kJS^UJ|t!fP=>PDE2&%*cV+bnlhu3 z+sE(VAcI*j0D|x>e(cRv1iBhA#bqFIkGI=yHQ9sd9UoIQ8EwzxF)1*$=)I>nNJ)}n zi(PV~ep8Zpi|lQiL6H>m59YPiB{1L2z07?W#1NB=KKi-j7{&Fy$JepXP;YFAMeLCqZEtxKk>ja`%>^KcR7!P!ee@UX)P#1qaGU09#qQ|u^+%X&$zEI#cC%W^3W;)QRWN~fRtTfec zP3=m~EpC*oI#^g`db*$sjQwM0E9P(z#g&3VE1`~}Db%FF@4dnP2I1cAXzSWdQ(!{+KUDDIP(Cp3;UzX4$Y(tA56)+62J@Rzem)I4uNNhPh7!sYY%dr@r z3xFF=V7www81TXKZWXh`6>C(;=xT6PJA%I#3Ba(02?!#*OH@`+9b$#%CAJI==w>;| z)$k25kUZl~!@KF~e#ph(IN+uD;QG?w&QbI+B6IBsL6q@I8%H2YD%2jjwqoy`0tQhG z`lg_RCAg|vhR~UiL#^AS&A`G=0J3B{1B)87ko?dD!%8i0Gg471!~Sr6Dn)sp>@7M= z6aQ)%V_sPu--#Kp+qi*<8*|jmQkK~u+Y`q~4!!)#wa{70Qtl#NuysWn_ss%%E5!A_ z;X30RxlIc_=ovRg_whepKglqq+g{1e_#1uH44)wYw=@yp6$^8@t7mUa@)YR;e}`r& zhxT4pG<#&#r%V&Ec_xX-rY3ce7$4q>*%76^Bj_UEdQX)AwkD75-ng;vRi369UGv7B z97q(plb+!nc`JYxnBOD9vt8QPR$ z@eBdoLi>W@GXg{Y1Tl3?n~K<+l)5ER2s>+CxF@ExBy@qn4Mo}Uj zAUayBu}2V(5DuU%PaYC5_BR-QtEV+*CMft~e2Wn|fYwEP5&irgt}w#8%+-rp@8fDC ziae`nYp~;puO)CC1j51hp1iLW18i98?F8}Otz+ml(=w`m=T{zDkE?r)*zbh(6?E@K zmoVu+X3mMDD@B(TyJ(6G5*qM->;_^KAUMflT4r$23UAO?Vvi|m1Ymn4tuUX~m@I)D z2cT>8v6xFuu{QvtPQj8jOXzG{hu*B2^w&T3Q;V87`lh_0WoW(tUH>iRK9HDxK!(<6r{m2Wc1;A6>Z#a~gw1Myeb z*l+&a7^!C8DgPCCF6?FRwbo-v#+<;L27$2fJ=Ms8vibI2So5Z^-TT&zmEC;QP7Lhd zVb=N=wKNok$Qhf#=nZl?t%|Ym&L2rbQ1G^5o~!>>QZ=O@`N@KIP_k;{71v`iq!nkM zZ!86fWZGPuAaXfEO{GkvSdbqpA9%iqHh{0XS#>UFzpsE(DRz&G{~Hmuf~J}q}qwo14o4iYeqkO`-tny9!$41HpG1aC8_W9Hou_C-%r2(A^lcujtQ(axJo zhx24wmxTuXPL3Fq&ej0C%){fF z<+~R7(ba^XE~#c-xzYpFBhZXO35367x=&XQZCi@NuGb;0(Yb?Il0e?GuG|vk)bP#x zNG7Kd#5PS<#Srt(0kr;b&^EOdVhFKAugUV8_s{7A7ow}!*u=gI%&^%Fl?)$qC?~LM zO%b4StX?&gp|sT|QF!0D-z*U-cv2p(A^wE777qFscgT@{;rl;OMs3RaTHNU~U7pDj zSlE){BMsyE=@t9lNq}dLc)tw_0q{Qrg!H_=3>L9avABwO&D>KQguy}mh`|XQM7IW; z%M`;t=0Pkr;vjD~r^n7>Cv?f1n#Bh8c9<1jAmz_`-0r@Du$++uasq@+trDf z#Li-I(Dkh@QLg8`YFM+)=$J;vw+_3S$~Y)?7rBcW95skDkTEEN-FmC2vJus?>y`XE zvW{;oXK{xKwwIoQgIa+)#o8<<5MATH7n+P{^+xV(!|Q$K22xSqV5uauc?>T~U`NmKWGEr~Q5`TZDB7oq{m27+f6&fc4VEa9|rd zDkiJYSPXJYt%()M>z9aK&gg#U{BlgKL!gOVApN=ry{YL_a^o|>ifyfOL+b)s>$){k zN7Kcge0)GsxU7LXaeL#0+zgG)6&62{Xyr31RBC4+i0P1XgjcM|jYzmaxATfTD@V)X zDeiAKS%YORy*x6C&Q2=QyY9Jj;N53LS!8keaAz)|``SjtBqNy8U41?6({c-svOR$M zTxS(J1&{p@CId|C|H&u zqOC=1ea@m>^JLl1srb(}JaO#GG;jdD~X^zk9wd#{OT_ym7(r77z|FpKQ!-h z2v0k-2>voGvghJF4jKuALAlkYq5@$^kg}fFs$|UYgDJvoq$0aMtw-@HKJbM5gs}15 z?^aduPskd@j!xD;;54L0sr2_MmG+Vc_*~e%&KRzmw=|cd^s!e~Ac!UUrd(?FJ}V;vj8tsrDJtm@gmYfPF=^{9{G~QOSVmAUO*Jw&xGN^kfWULRlnBh; z*_|p8wc&4L=VC)uvsmJo^U?VcA1UjKE2NsLZ|eW!mOUz~!exd-+0A1k*QGoHi2b;l z+7yE?G=cO@uf98~y?Y`F!7KjRP7Op(-s1KW3I|niVX2Hb5}xrf@O?5D<>Y|84iqoZ zdg=+vTyB}^F6eVG=6g3=9mbbi_SK|gF8NJ^V03Aqdu|Q6q%T#?Y=MiAXjg4nVomr0^W3-H*F5o}iv zXowsQSg>}@q&N%;2sS%gHhYKQ)^INQa0-cxYoBROuo?zRh@^Ydj$AzzU}Bc^Nil=N zX#7%EK+rySw$VI2;`Xq^iDNkX?Yxos9m=PEmmj^2I*FlZ%zw;gC)g6o)hZDDIqFF} zpYiMTdO(B~-6na(po%=Pu7sf3RfCAtf36Bm|iVgkc6J98$$ zfnqqz0EWiWpi*aCmH`yP(VPH%@fy&H`aslxMPNIC$DDS=K{nq8cJqm}>EE!Z;}5Mi zWlGMJ%KKNLHIVwAOS~-iDbb0ya=dorf(qy9*Ae2?zZFE6VfQ}2{W(zg^FyFK&AVVv zclCEtuc=PoP763h3Q@>i)gm`cYq1&__N$XF6aK=bm9b;;BCrJ@?VG(;&8Lvr_Cm%x z_sgEE6#D>Y9SJm3`{SLr`oSj<*;B>Nb+IkLbNSg&_2^1vF6i)Rz0O?T-i=02p>B(e z`LVFO%FzSowckIHWerrYQ zpsadrQ(G-p^X>vK9k1l;IXf?+Ei7Xq+-7%^OG$48XfOBy7h0i1A5ZWt?@K|=X|(iwlR#1f=qbOWD8L#oGP7k zCGVYy)!>M;B$1VmtoN2gGFpxdw2$bzp0)lFZ|_%hUlAIzm(5rtAhbr9Hv5|f5CLK` z=42&(k@WQMJ2Dld-?`~;;vgT1dsmJ+CXK7;HP*%wT;vkN7$&<$Z*l4Em_rFSxQ=hZ zGWMn8?q&RYxdm@q=J0&wTadD@rL+aHMBp`?qgQbsx53#50odh_X2{h5&9>=fl# z15P=Pq+q$P^fnq))kMj@ezWZWp#%(%!a>CqYVNeK-KsTH!bB%_q_?-kN`v*;jQP7t za;-5={-UChqOSnoZ$440{_$xn!=4J@^n+jx`U;cVr_d*r7Bt!Q$$}$Fd`jeWrxgS{ z*IAyyPt9I;++mFMxfrC<@i1aXpg7c&lga7i7u%E9JnRvoQ-;6LxwM$Rx8&jFL!E7a z*9_j$o~~JgRhnn@rd3K;Wx2?|o?tmA+*9gc5Tp6pTZT@&e7!)};W+oOdsGk17*9gS zl>>l;6hweRr~Fx*XdP31SC-6QKA1W;u^iyWU4nfXj)MqAB)pR|c|#)_2i-VVu{n;Y zDxD>ifq$5BBe#%|kxK>06gj?cl0HRl2-uc!8)2xWB&08AKh=T<9ip*(v|%H6p_Qmj zU83vEgiK{7GS2PohoOnfY83+>e9aaz=1jH`(HQd-z`(Stlya3M)7{a8%uV`LH>II{ zIYTe7GnplSn5jDztTL_>E{Sqt-Ud?*1VJ-aaH_{RFG4-C!kS8abEORr#X5UVhUZ?wmz9i-(p|Zw)$i49_McM>x|Z`gcZn$ zUmIC=VXcXrF?!DG1CYSJvh3(YcEZsuj8V{yZsbSpDWW1&$Ccml8aMU#$e1~E1AImW zd&1iso3B+Va5m!s45$N$n&;47D4}ppLSq>~xMhfg2C^2{OdzWBXpeQG^HXWLdNEDk zCidPjI2IDl2$w(Fdf|~%y1$3Kuho!3iIHz3=lCsQ(x(lVKJJI)ncs3OGg(D=T9i_g zMQ5->F(yg*c@>*Z`h=3amxTO{e>gup@NZbczsLItvz)G`lYSl##ODwvE#Sh~H3c&p zfSBb2N+VLvBcJ(^KHf}L>Zmmh5!Z=>gr$Y07>>TN#2Zv6Qu|_B- ztMYjDWE6$84+g<*I{1ifs-d}bu(7FwX!`vS_8CFs3SC=99P2znvd9GaR1KrJ$@_EE z&?tKW`)XR)_1#+@M_v2}u+Ow$sa`u?D|7a-M0x5AhL6%cERq%7me`rjcYig-`PdV? zklv8(ZZx5xC;JT0KfHX9uLdyFlF|(A*GnGOnW!4^X*=AQTTztiLer6-ZwSqlFgsK) z=IYuIz(Jv&^|AA2{h^YC!d_fxsrSO&3xRCxY{vH!Zj^#jz&_AMiSHvMtL3R>NA!qBhLR&D1`?t4Y5ivp3KJFXzF7v#t9B7CU zY--xULDgi0Sy&K3Fm~r9oQu-p(m7|k{IlT^E@iuGVz!~vMmFX;RV4(Odb_g0>;2Nx zz+;EF^&%9z1#68GeEh5oCJ+A#JYpAMDVJuEWYSqGdq#p*L;+$e|Cf z4hG*HLsO@K6xLGnezlt&gYvhTSHW-6KE8pVC63>v`tJ#IcfI$0kIbkPBXR>5i#oik z3JXL^lD9|+6{I^m;nInLlY#%=#VU;t%)8&pm?r{OZH9PZZ4qnAdd#m-pu#Zwez>&o z_2E8Fxtq)!b0<6xU#Di^5ftH?HLkB3j=5+}-YXv+^{WUfq&O|bfER#(R=wUpLcMdQ zf)U!1dSaL?fGf+_$#ejf5%|RNwl}weAkFQTO%PmN#Tn(!PQ1&?Gz=xK#{XJY)OiS7 zJcEOdVcKX5mZ*_aE%5!6=jUG@*2(s3LS5+!6f8Q+7$`o_Qx52H!si5mFP(|*IiVe4 z0|kcRBZexSosZfF7p|AGnONY{P>==#)dNyWkUgUnPLv9LRXJkpE8C#e$V)8K!d0e(t2=wDa%EN^VAH&R^YLAD4 zmDT!!2Q9Lwp&@DaanLUka1FL4Er8etMa-{AtN@~l57Z7@W3f_*B@KIo;Rxb`=OQLBXx@@Bb{K0k9bxhUDBH5vx%@X@;6z=N(NZ!@%m1%N#1NqZe~l z=UOt(ok7tBse5V$rhk~9sL=SAAHFV(ew?=D5%a2GPe4vMcK|S?Tbn`@efI*XYF_ zrf?m6j+UwW(hI)3H1S~#w3UmMm~{E-(=w?RISQV1`f|Bc6rwL56q3v4o1s{Bsixi(^#Phv#Vzm>=gIHFl@jGipT*6< z%)Ua*_9NCVW#*DsX|d@9qvprJVl6j=34>~~@&H;0vyaLvGcY#E7@S^uZ)LXfJ%2># z@?{!cf4>RAaFuq9yRG$Ve-euxmNpJ}_=X%Q*m?0TSYk1zSH9$=95r;{ zCh{&3bMqT!xwUB5^|#UpTx|G(c%8Tqg@fEPffe zx^5{a5NBG@#`|@&<~vgHv=f`-Mpqd8d8fEk8orvy*xe}`t>$KFOLE>hVZYlJ%nR@c z?X(;#@wZxSrE6lbF)VujFbd?>S#n*IfnKdA*r^#8lgAyBLOF)1B^*B`7Qnvo{O%GN zeUwj=PGLcT!rM#z>A`lPWEI_I7de8DsL<4PN*zrQsbn~s-~{FcaL&#OPw9bbVVXJ5 zbUjm@w6*|?Pl;Wak{_)n0ymr(l6r%r_V`(Df6wdf2Q|r&-p9xi2OGmEK0qaNqUe(4 zqSnPLU?r_DsTA3O@~1y*{^;Rh@i$5;ma&9JI;vHAf@&^JwKO5YSvQlmbLmGhvgfw5 zl6v~jXcr6%og@ZK^_V7D$&@6rW)>Voej^*K55{hjOI8JK$*u=&gH_M3vRFzSlxM%V zy^e!|>oK+K+%^~tMjK6N(V6tRT8}b=2l|En_|Q|tPAjswo<&Mvq1b=VKGn6{;ZNzZC$pqvX-wQVwy%#4<`#ZvyN)N zV04o!8z=K%&qQ@d&u9NsC1aE3OEhoLnYZv1?1C3fX=t45d3=dp3zNrF__}7bqvE?J zGtuS?n=K>kk2`=t$r2|7ho4z(upQo zIYRL|!cW{b6zpU&_U<{k!QeFK36^gD-v6gh`|fK z`LX0a-I6@VtXb^D*A~~P>bD3tNNJWT0fz3pv+Zdek9)yKPq`W_7G$VbHV+_r72n{h zc`|bbr}=fkantvWH=2h(W^}A%Pnm34M$ME)cfk1Lm+D>{rho|JMD~8f=;NYc9SLZe z)46{PipF(Tihyu&ryQyQ|zbk3U?AlFy|aN=tV48 zua9lTyoenJ+lwle0)TO^f>rmoFbsU`s$Jd4c3HGWW`B8d`-q8mb#F`rI_DNK!GZ|% zsNh%N8vmnDkWxrE8TUEf$e-`DFu{e1WWmWe8Fyl(>(-RiWTMAIM-Q0 zi2vYYUSx4ga`q14j+XtRi3RUV$J7b8PpH0y+V|T5*Ob`H_=$#$`KR#L7L{ZH{4ntbPkXz7kcLc}Qb6XTcrXJXHmN=lW=scgd0{LAtUwau zhl56Ch+y=}gyx6Put4P8;5HR^(=kDdTNU88*EV9gT9bO3FZ3-Qiar zu6b@_Q|zKb32<|hTMH61i3266S_4WJHV!#QSj`jk{hZUHNP@4qQk5i5JG-|;pNmVm zGpR2hy;zuKD;G#Y`jM(j{ND20opQ#)7Sa5*UYWF#{`b-^Y>~YhvbA#sg9dTGyUvDa zJj{D~s!bk+ZA|B|wsbWB<&4O*7u~Ogv+;ShTXKBSu9qdwIx7@d86*irKbF##4(QQA zrRz9<|BALU%)!?XJ08jwSdM{SEv{$GMErwtTv^|Ne%+KRCHhJ{O>`@2umJU5mDeGuN?N089D!Xw+X+@VSL1u)Ze`K@hi9%of! z%^nkteO5GhcJ}&?S0aN@?zXw%ap_v|vB1$Enwn}h|0FlJ{?U+xxuwO>y}`Fy?%!V< zxHo+O8z4UT$M;l^&|fdkrZm4DxZ#8 zTs73Bx-K-`kg}$kT|29(>gvACBT%p_PC*kIPO?(-HY#7~CKvpF7vqS(QxSM`wOYhC zHd#q0m}0EmpuuTZj!yW1Ga5O7-zMlW8351?{k6mO@d98k?+sY${3NsS# zgFTC!cbb?VpS7MORwg-IZA5kp1UaG3%}IS{Y^mF$Am(C)^{&2FRXz0Fz!&jBS7~V> z6i?u=61=jVxY}_3>_B1juO*7k60{Q+eZxG@g7d9|uPNc#ie0Ktu1PB$DCSZ)rcj>y zYyk+g)w-Ooy+5o?Y1zSwta&t@YiFwANCL+~4{FD;P?*`r~VYK2~P3f0ynXHF34_0|Ejfj{+I3 zWt9D{Q|;<>oxF2iMW5BnYK4Zz+zBQ4tW7D{=|>P|We8Q_v?C5WIjuUKpDPQ;E9)D^ z$Ad{EW?G3DJQGNI^_^NM*qK+xyCO0k@I@+b8hd06L6E*H6RE_MnbWLvp`CoMQ$j>j zT7dXgw_GvttEp4GlF-o{6JWc>8gd_I&&-V!Zv~;R<*t{x&)g+fFJ;VT9#beQ^6>Y! z!pp%8P!lnp*PAE-1r&Tzj~9g2T|bg(?|THfPpxsKA{})-{9oen`GZv0NX(NfhbE0C zEvLG$ziv0tiZRf_aMo}-tx==GbTKRWSQbD$UYI7~@6sUL_mB#(jr2G^{0gKP@hFr}^SC3|7WuPGn$pXzrZORuW+;+@NaFhF{+S>KqhMfI9bc zo9^>C>bC*p__V>fipgZ!SC;r)KQbB3RajHS|wK*qJo-k_rB^=k`UWF zWFOJhIlxpZufT(CC9PvKseGKxYQ_`t{bFWTxQeXO&h-2$EP+U>ebEL z=fS&0PY>wtJ{j>B{fP<{neHn&-%i|Pm&~&m=yijAU9;ONG!k(;+rEnl5+$-yBGwR> zNq*sTVMT5(^Y$(d3X#VIBD01nCI^RtL^BZt`6d-nZb@8JHBsWI>!`?$(46bpI~HT& z9b12RPX)-&xBr*TL1A0IAto2G3cM>UvxU6dn_DdZyOK>yiaT=)R2^t~eEHJ?CZRKj zG?3(K>2fw<3ODl2GKLjDX$q(s7>^Sv;v{ALiP+(OPW&b+9v88y0DM*ZCVQEc_m|Gv zh7>`kzNXW@K6IBGJnOQ+PPf00DAijsUF^bdjS8H#WNk?kM+rl3#8j{R*G27(M2)0t zoPl(TSLkPLu7ryhcKFa1quPVR`Vsuk!!%>eK+UD!pRewk(xndu{=`w0IQLo+mv^y; zd4TeNqG{(jU&(4rQv^ZU!IL#x92y2n+CYr6_M)6G*Qqg$4y5UWcVCZfgl&qQeWp$>7C1=% z**^sF{%L>Ez6BMBh<(bu4XPBcsynn|5dOI?Xnn=^nsGYTFL|r`xh&%P%|X-fhy|tg zetg?%oOhJ>E9`iqfNsFYD?mmw%Q@A6s7nRw_>Md zS!f}e?X0l2+XDNKN<8!Xm9Xy+&)DbG@X@H=WRC`N@nIzW+YBd zg7Zy%dN;OV^pOy#f0u`zFrUr;{1cy5fkdVkWv_VcsZ_=*73vp1su&Q~a z+NwDEL%sFv4_ym4BgNQ<_~L_ zI%MU#PvHk$_AFga(DOyYZf$7>YJ0(rCe4Xa5>CA!5so?GA6_izgD<>L;0rGvAU55Y zNZjX<`=%NiK|Z_-PA7z9vp%gd+*4!xX!pd!Q^88<^vkfz?EwJn2M)>#pE$ywNTs& zu?U8ABn7a!RT&4x2vux0A(qvVz*0@YMmCA8ip50mcTfp>!4J+Y#GqlD?Ko&zz!N5b zMbt>_d$aT+aPmzrGv|?%P9L^i6IG$g-R>=_7v+bpm~!(4V{IyZm z$@curVO_ZS$J=r>Pe~+f4|BaOTejLm?bVQ<$ks}Hcre`zdONGH|E}4=&_?VDomS{q z#%nhPyPl_dhstsuZB1?U^|^S}KW(9yA#u^)W*)h4{;ri@E!TNAUEza4I?svcTH}`^ zh~@TKhJLESsva@p;*4Ym`;>cYhy8ivD9a;sy~D=;XgU4lese>ej3S^b;S7JC$LJ!g ztSIqKe1m@yDHH04IXcIZPVKrXCs+C0i-RX=0&$Ss##Mh3-^Xdxp;>FMp2)Sk(DS%MI*ptZ*Rz_CKhTwe#im|LoQ5RC@J@j>h>rq5$Wki zK{o_vZY$ck=K|9pvIoIPr%b&q_wluoKYWLt)9c)qXRNksIl?GAui+GXc3^rZqx*BM z_18#SeOd7oiJ&t3&CMK3>Ky%hDOp=zZ{8dt8JvcRy{<8wG7wg85}4Z)#R^Ge@Eq-W zv`kl~nKq~ubxriM57`uD`4+Xbcrt-%F)Eg@L@j@B`OrY< zqwlvExWQF#Wko6(U#+DRpSgmG1f+{p(%8g=*>Ctd z`rC37z1#VlH}w-@wkIb9%aSbKOlveBJi)>xV*l`b)X>RFcg+(?uFn?b^3Bf&p3|@& z`}zsITjQ>2IJ~E5rBNk2snr#x@a`^} z+FafEZ_crwq$lcE{x8mvdi zHCmwhOh;;_GoOo!!dxQ81hVv=GzEmj%8l?E>cV$loeIvD`$|6h9I+KGfaJX>t z;K@%L$p%~b*dFZ2L7yKPDme$#bD!K@PuD2sDR^ZSqE_Oj;h?R zR<%^KYay@F(N(yYY1$|usUCrEN$<0&poWqCA6Qr@%?>ej;a+96k=tcB0UGYZVv;JA|=O32*5P zwzGN@VOIsdBSGv}brg?;aeh&+cGy+S-&5k}t5rodH2{qk_t)c^-XNMG{vr#>x_yO6E^?@Rs(3yb z(ByQ+$xkO1YFn$_8>TsQyf5mZ<3!=^4-Gs%Sn>35A3Ae+ByBW>O+-oN^XIjtP|sRM zjfqKO^UJ(j%4d>#JG?{QHm5J;L)F!zv_-;Sr<|g!rj&How{)G%vkpRfbRPz zxyDSEB^Dz2e*jmOdQ?YwRjeXU0UzrT@*7r`4wir_~lQd?qOd z4Nd|DM;8NLJRpNkj`n0*qtat3^vc7{--@3yhRcx~7g~#aAx)J?zpjygE-!6_ZMVR& zc)b{NY{M~|a#ZozW*2e?d&!0Hdnt4x{zLL*((i*WB;D&r{I!aSCaxvD6RnDwoU;^1 zRGfoR*pZlApjOkG;m5=-T79u6AHOxfo*u@;Ue+;}fb!wO$ADD!U?t;4-QNbE>%Z{n z{R2KZ>wJ1C9@Nyj^qJb>K6TL@R7Kh~$zgtQ68trCZ)FgpZr(GMKX4&mL1lhicCuys z)sqB^9=4%j%tEe3Ub3R!n*?XyMs|sQ%$OKNmy!Uh7Ai zET#YCSz)#UCNblncN&8)*F{i(t!BE~kXM~)oJ za~KrI)D`44Ut{F_`4J$}?8?0tXQN1dP{_@Gxt*KdO1+z$1HR?M!6;Eybu4&qQbS`u zkqSSvv7vPI9`_@4RzIm#->5UaL5$h;ja=Co(MotGH@1q0Z~;;aLB_0`WZn6-!}N-- zP8Q`!T94!uZs(SYF$g86HshslhGpYZDBu)dut&(OhGXj~eY|i4(z!+N17!$kSCE|e zEue>io(5|24~7p%*hN@AGlhCoW0~{19+w=*KZTiTnYfQeRqxs96StIprw;Q^T@CGHl%B@#d3f~jU-eT*1Yrsdl5s-X zG80Z}xlW*dPy)hq9>G7wIcn=<)q=EPVfkOwDGYn6Sq$r;j~JB4K{Y^}5@)iA^oiKk ztq&fLE4C4&|Nrh~zEf@iHvhc(*S)-vdRZ<+&qhn>Yik_MqL1xyDwuIF6;5;7b`yoI z{qkiR(;1~~hWMNoaaWMxmYT@TC4==9YCwZXEwaku@N+2&cgw z-L%}L|7jttC$g<>`0`9>)v@ut4SeH=7&!8|7UA5EFLR)Bz@bsT5H{=%jbP8m0R7F z_RDOo^ZN6DemK$ZOQ)X_`9eYA($;$kKGCcfztQD!zsr#Iy-T@37Joz*B=PK7Q0>FP zEu*IUWx+ER*7yXr@+8DqkK)|ATo>VLVzG{h9ig;Se%F(=$mG9*IZi>W)pUe@r@eo{ zUuNVnj%K|L)!+GITZr%SRZ)QI|5Sc!q zCpz2v@MVSvK%m>r>uh2{jOTq=45}6`b+@mQJ|P2d3Y}BNi`1%?uO9%n$3l8%wTD-- z^!^yv;0n?8-0?bu{>FQoGb&and>4heUDYUYqftyt`{!91myveRSx)w6{!Ctrh1CfK_ybkPmlXXq4}}wtrlSD=Q1B3OPnk zC42Gh;}Nri`J?rZ>{k4y1@;LynW_&N)E5x`fmWfX1kn9r>yREC7H^FOu5(t)K7J3@kP}CS1)GV&;JkP6+FEF diff --git a/src/saved_qrcode/Send sms.png b/src/saved_qrcode/Send sms.png deleted file mode 100644 index d83330c370b517899cbf3c9fc7d44d676664d7c1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 462 zcmV;<0WtoGP)z#3z27A4`w1z6vhK5WGEuz#=~SPjgiW=(=ol7q#}dI@P0DV^P4<^}VEtgyxlAdn%$C-oHpsHL zN&;ZjG5O>&gllPa3$-w#OTcPkwy}|Slx~)EE0*7GzXhxhOnaG4R~}`r#iB4Pz*=IS z-*j<|!XnY_z#3v@IQTf;tuO=D9X3C&5-h6dIGKR8!7iQojlE8`$>iU@9#{qJK3y@* zbd809b%vdDOTTb&nWubj|AAG;H0sl1-AIRP{GJAZHNpG}_``(@uud?Jj(_xvdji%D z^T_#!iXqJT4zLCoA5kyNJijeu1Ib%{1J(fsLD2X51Zz?~)y)PJtv^+y3&L`^K4CIDW+-m=Qu0 z;*q}o_Uj-_jFp>dy4}vggjmd)6B z*ZqHBd$X+jDD)xg1ruZ;^P9UiRL4kdXP6KhRgUV)04B$L?TTZ4 zPEgtzCd6ud9eMKcyTCSQ9*M(FISs)iSwG#(UT*VIm?*o}JvLF7l^mwX)|c1p)YmX! w=Kf>*1QTNEzw|Opj75T#wHl_#2qAmt1yH=I8L9vvn*aa+07*qoM6N<$f*(bO;Q#;t diff --git a/src/saved_qrcode/Youtube.png b/src/saved_qrcode/Youtube.png deleted file mode 100644 index ba2cb5e1afbdaea5e26d14b94721543684dd5869..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 629 zcmV-*0*d{KP)c0xC&FK~#90?b}Um+b|G@;W50>GDpZ!bTsQ|I*O0rB^O4g=KN5Mn#Pjq z1}ORtgg_AVB%2RI@h2h_MN$8LX{#bK=p^;0-bK##@GfI};RghAh}`m~$VGJ;)Nf{y z@m`;g`Q|$Wa+K7_-Na-0s7We`WZo-zw@gAHe@;A>^*Zb9mp~w|B#*k3$mD3Tgg{=-SVb%(+af@ zzms15f+fb1HPe33$$r8&UXQOS9J!`A$r%8rDwvg<5 znk&7My9wHMMNjLs4hZD06YG|eGYb#%EZHzMrmpKA3xRAWzC2R0VQP(~ela3LAbUs+ zqz%e#L>9^21kJKt)DQb&5Xdf)$((!wo2^fBEv{eYg+LAykEIL&gV-wEYIub}c9Tcz zd&|C;DOZTWk6ZDruFb$n P00000NkvXXu0mjf@=Pf6 diff --git a/src/saved_qrcode/wa.me.svg b/src/saved_qrcode/wa.me.svg deleted file mode 100644 index c86e2bb..0000000 --- a/src/saved_qrcode/wa.me.svg +++ /dev/null @@ -1,10 +0,0 @@ - - - - QR Code - https://wa.me/12563776756?text=Hey there! I am using WhatsApp - - - - - diff --git a/src/saved_qrcode/zip/.gitkeep b/src/saved_qrcode/zip/.gitkeep deleted file mode 100644 index e69de29..0000000 diff --git a/src/static_qrcodes.php b/src/static_qrcodes.php index 9b49b18..fdcc100 100644 --- a/src/static_qrcodes.php +++ b/src/static_qrcodes.php @@ -18,11 +18,9 @@ require_once BASE_PATH . '/includes/search_order.php'; $page = filter_input(INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS) ?? 1; $db->pageLimit = 15; -// 'user' ziet, net als 'super', alle codes (heeft zelf geen eigen codes om op te scopen). -if($_SESSION['type'] === 'admin') { - $db->where("id_owner", $_SESSION['user_id']); - $db->orWhere ("id_owner", NULL, 'IS'); -} +// Scoped to one admin's own codes for an admin (or a 'user' created by that admin); +// full visibility for super and company-wide 'user' accounts. +qr_apply_owner_scope($db); $rows = $db->arraybuilder()->paginate('static_qrcodes', $page, $select); $total_pages = $db->totalPages; diff --git a/src/user.php b/src/user.php index bd093cb..ccb860f 100644 --- a/src/user.php +++ b/src/user.php @@ -5,8 +5,8 @@ require_once BASE_PATH . '/lib/Users/Users.php'; $user_instance = new Users(); -if ($_SESSION['type'] !== 'super') - $user_instance->failure('Only a "super admin" account can access the admin listing page', 'Location: index.php'); +if (!in_array($_SESSION['type'], ['super', 'admin'], true)) + $user_instance->failure('Only "super admin" and "admin" accounts can access the user management page', 'Location: index.php'); if ($_SERVER['REQUEST_METHOD'] === 'POST') { csrf_verify_or_die(); @@ -16,6 +16,13 @@ $edit = false; if($_SERVER["REQUEST_METHOD"] === "GET" && isset($_GET["edit"]) && $_GET["edit"] == "true" && isset($_GET["id"])) { $edit = true; $user = $user_instance->getUser($_GET["id"]); + + // An admin may only open the edit form for their own 'user' accounts. + if ($_SESSION['type'] === 'admin' && ( + $user['type'] !== 'user' || (int) $user['owner_admin_id'] !== (int) $_SESSION['user_id'] + )) { + $user_instance->failure('You are not allowed to edit this user', 'Location: users.php'); + } } if($_SERVER["REQUEST_METHOD"] === "POST" && isset($_POST["del_id"])) { diff --git a/src/users.php b/src/users.php index 12181de..decaf45 100644 --- a/src/users.php +++ b/src/users.php @@ -6,14 +6,21 @@ require_once BASE_PATH . '/lib/Users/Users.php'; $db = getDbInstance(); $users = new Users(); -if ($_SESSION['type'] !== 'super') - $users->failure('Only a "super admin" account can access the admin listing page', 'Location: index.php'); +if (!in_array($_SESSION['type'], ['super', 'admin'], true)) + $users->failure('Only "super admin" and "admin" accounts can access the user management page', 'Location: index.php'); $select = array('id', 'username', 'type'); $search_fields = array('username'); require_once BASE_PATH . '/includes/search_order.php'; $page = filter_input(INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS) ?? 1; $db->pageLimit = 15; + +// An admin only sees the read-only 'user' accounts they created themselves. +if ($_SESSION['type'] === 'admin') { + $db->where('owner_admin_id', $_SESSION['user_id']); + $db->where('type', 'user'); +} + $rows = $db->arraybuilder()->paginate('users', $page, $select); $total_pages = $db->totalPages; ?>