Admin-scoped user accounts, secure qr code storage, PHP 8.4 upgrade

Admin-scoped users (answers: who can create a 'user' account, only super or
also an admin within their own scope?):
- New owner_admin_id column on users (migration 004). NULL means created by
  super (company-wide, previous behavior); otherwise scoped to that admin's
  own codes.
- Users::addUser/editUser/deleteUser now allow an 'admin' session, but force
  type='user' and owner_admin_id to their own id regardless of submitted
  input. user.php/users.php open up to admins with a restricted UI (no type
  picker, listing limited to their own created users).
- New qr_compute_scope_owner_id()/qr_apply_owner_scope()/qr_has_full_visibility()
  helpers in includes/security.php, replacing the ad-hoc type==='admin' checks
  in index.php, dynamic_qrcodes.php, static_qrcodes.php and bulk_action.php.
  A 'user' account created by an admin is now scoped to that admin's codes
  instead of seeing everything company-wide.

Qr code storage hardening: images were served as plain static files under the
document root with no auth check at all. Storage now lives outside the web
root; qrcode_image.php and qrcode_zip_download.php gate access with the same
permission model as the list pages, and the bulk zip download is bound to the
session that generated it.

PHP 8.4 + chillerlan/php-qrcode 6.0.1: bumped since this is a dockerized app,
so the PHP version shipped doesn't matter to end users. Note: the 6.0.1 tag
itself only requires PHP 8.2 - the earlier "needs 8.4" read was from an
unpinned clone of master, which has since moved past the tag. Fixed along the
way, surfaced by testing on 8.4:
- The hardcoded Imagick build (an old pinned master commit, workaround for
  3.7.0 being broken on PHP 8.3+) no longer compiles on 8.4. Imagick 3.8.1 is
  now a normal stable release, so the workaround is gone.
- config.php had display_errors=On + error_reporting(E_ALL), so PHP 8.4's new
  deprecation notices got dumped straight into the response before
  session_start() could run, breaking login outright. Also an info-disclosure
  risk on its own. Now logged instead of displayed.
- MysqliDb::insertMulti() had an implicit nullable parameter, now explicit.
- includes/auth_validate.php redirected unauthenticated requests but never
  called exit(), so the rest of the script kept running.
- Dockerfile.fpm was missing both git (needed to clone chillerlan/php-qrcode)
  and the imagick extension entirely.

Also removes the unused sample qr code images that shipped in the original
repo; storage now lives outside the document root so they were never going
to be served again.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/authenticate.php

@@ -42,6 +42,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST')
 		$_SESSION['must_change_password'] = !empty($row['must_change_password']);
 		$_SESSION['can_view_static'] = !empty($row['can_view_static']);
 		$_SESSION['can_view_dynamic'] = !empty($row['can_view_dynamic']);
+		$_SESSION['scope_owner_id'] = qr_compute_scope_owner_id($row);
 		$_SESSION['last_activity'] = time();
 
 		audit_log('login_success');

src/bulk_action.php

@@ -46,22 +46,18 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
 
         foreach ($params as $param) {
             $db->where('id', $param);
-            if ($_SESSION['type'] === 'admin') {
-                $db->where('id_owner', $_SESSION['user_id']);
-                $db->orWhere('id_owner', NULL, 'IS');
-            }
+            qr_apply_owner_scope($db);
             $row = $db->getOne("{$type}_qrcodes");
             if ($row !== NULL) {
-                $files[] = SAVED_QRCODE_FOLDER . $row['qrcode'];
+                $files[] = SAVED_QRCODE_DIRECTORY . $row['qrcode'];
             }
         }
 
         $zip = new ZipArchive();
-        $uniqid = uniqid();
-        $relative_dir = SAVED_QRCODE_FOLDER . 'zip/qrcodes_' . $uniqid . '.zip';
-        @unlink($relative_dir);
-        $url_path = SAVED_QRCODE_URL . 'zip/qrcodes_' . $uniqid . '.zip';
-        $zip->open($relative_dir, ZipArchive::CREATE);
+        $zip_filename = 'qrcodes_' . uniqid() . '.zip';
+        $zip_path = SAVED_QRCODE_DIRECTORY . 'zip/' . $zip_filename;
+        @unlink($zip_path);
+        $zip->open($zip_path, ZipArchive::CREATE);
 
         foreach ($files as $file) {
             $download_file = @file_get_contents($file, true);
@@ -70,10 +66,13 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
 
         $zip->close();
 
+        // Proof-of-generation: only this session may download this specific zip file.
+        $_SESSION['generated_zips'][] = $zip_filename;
+
         audit_log('bulk_download', $type, implode(',', $params));
 
         echo json_encode([
-            'data' => $url_path,
+            'data' => 'qrcode_zip_download.php?file=' . rawurlencode($zip_filename),
             'status' => 200
         ]);
         exit();

src/config/config.php

@@ -2,8 +2,12 @@
 //Note: This file should be included first in every php page.
 require_once ('environment.php');
 
+// Never display errors/warnings/deprecations in the response body: besides leaking
+// internal file paths, it can inject output before session_start() runs and break
+// login entirely (seen with PHP 8.4's new deprecation notices). Log them instead.
 error_reporting(E_ALL);
-ini_set('display_errors', 'On');
+ini_set('display_errors', 'Off');
+ini_set('log_errors', 'On');
 define('BASE_PATH', dirname(dirname(__FILE__)));
 define('CURRENT_PAGE', basename($_SERVER['REQUEST_URI']));
 define('SCRIPT_NAME', ltrim(dirname($_SERVER['SCRIPT_NAME']), '/'));
@@ -17,10 +21,10 @@ require_once BASE_PATH . '/lib/MysqliDb/MysqliDb.php';
 require_once BASE_PATH . '/helpers/helpers.php';
 
 /* SAVED QR CODES */
-//You can change the folder where the qr code will be saved
-define('SAVED_QRCODE_FOLDER', './saved_qrcode/');
-define('SAVED_QRCODE_DIRECTORY', BASE_PATH.'/saved_qrcode/');
-define('SAVED_QRCODE_URL', base_url(). SCRIPT_FOLDER .'/saved_qrcode/');
+// Storage lives outside the document root so files can only be reached through the
+// authenticated qrcode_image.php / qrcode_zip_download.php endpoints, never as a direct
+// static URL. See db/migrations and the "saved_qrcode" hardening note in the OSS repo.
+define('SAVED_QRCODE_DIRECTORY', dirname(BASE_PATH).'/qrcode-storage/');
 
 //You can change the page name for the redirect and the search parameter (the default is "id")
 define('READ_PATH', base_url().'/read.php?id=');

src/dynamic_qrcodes.php

@@ -18,11 +18,9 @@ require_once BASE_PATH . '/includes/search_order.php';
 $page = filter_input(INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS) ?? 1;
 $db->pageLimit = 15;
 
-// 'user' ziet, net als 'super', alle codes (heeft zelf geen eigen codes om op te scopen).
-if($_SESSION['type'] === 'admin') {
-    $db->where("id_owner", $_SESSION['user_id']);
-    $db->orWhere ("id_owner", NULL, 'IS');
-}
+// Scoped to one admin's own codes for an admin (or a 'user' created by that admin);
+// full visibility for super and company-wide 'user' accounts.
+qr_apply_owner_scope($db);
 
 $rows = $db->arraybuilder()->paginate('dynamic_qrcodes', $page, $select);
 $total_pages = $db->totalPages;

src/forms/form_users.php

@@ -6,12 +6,12 @@
                 <div class="input-group-prepend">
                     <span class="input-group-text"><i class="fa fa-user"></i></span>
                 </div>
-                
+
                 <input type="text" name="username" placeholder="Username" class="form-control" required="required" value="<?php echo ($edit) ? $user['username'] : ''; ?>" autocomplete="off">
             </div>
         </div>
     </div>
-    
+
     <div class="col-sm-4">
         <div class="form-group">
             <label for="password">Password *</label>
@@ -19,21 +19,22 @@
                 <div class="input-group-prepend">
                     <span class="input-group-text"><i class="fa fa-lock"></i></span>
                 </div>
-                
+
                 <input type="password" name="password" placeholder="<?php echo ($edit) ? 'Leave blank to keep current password' : 'Password'; ?>" class="form-control" <?php echo ($edit) ? '' : 'required="required"'; ?> minlength="10" autocomplete="off">
             </div>
         </div>
     </div>
 
+    <?php if ($_SESSION['type'] === 'super'): ?>
     <div class="col-sm-4">
         <label for="user-type">User type *</label>
-        
+
         <div class="form-group">
             <div class="radio">
                 <label class="radio">
                 <input type="radio" name="type" value="super" required="required" <?php echo ($edit && $user['type'] =='super') ? "checked": "" ; ?>/> Super admin</label>
             </div>
-            
+
             <div class="radio">
                 <label class="radio">
                 <input type="radio" name="type" value="admin" required="required" <?php echo ($edit && $user['type'] =='admin') ? "checked": "" ; ?>/> Admin</label>
@@ -47,17 +48,17 @@
     </div>
 
     <div class="col-sm-12 mt-2" id="user-view-toggles">
-        <label>Zichtbaarheid voor 'User'-rol</label>
+        <label>Visibility for the 'User' role</label>
         <div class="form-group">
             <div class="icheck-primary d-inline-block mr-4">
                 <input type="checkbox" name="can_view_static" id="can_view_static" value="1" <?php echo ($edit && !empty($user['can_view_static'])) ? "checked": "" ; ?>>
-                <label for="can_view_static">Mag statische QR-codes bekijken</label>
+                <label for="can_view_static">Can view static qr codes</label>
             </div>
             <div class="icheck-primary d-inline-block">
                 <input type="checkbox" name="can_view_dynamic" id="can_view_dynamic" value="1" <?php echo ($edit && !empty($user['can_view_dynamic'])) ? "checked": "" ; ?>>
-                <label for="can_view_dynamic">Mag dynamische QR-codes bekijken</label>
+                <label for="can_view_dynamic">Can view dynamic qr codes</label>
             </div>
-            <small class="form-text text-muted">Alleen van toepassing op het type 'User'. Reports/statistieken zijn voor 'User' altijd zichtbaar.</small>
+            <small class="form-text text-muted">Only applies to the 'User' type. Reports/statistics are always visible for 'User'.</small>
         </div>
     </div>
 
@@ -78,9 +79,28 @@
             updateToggleVisibility();
         })();
     </script>
+    <?php else: ?>
+    <!-- An 'admin' can only create/manage their own read-only 'user' accounts. -->
+    <input type="hidden" name="type" value="user">
+
+    <div class="col-sm-12 mt-2">
+        <label>Visibility for this user</label>
+        <div class="form-group">
+            <div class="icheck-primary d-inline-block mr-4">
+                <input type="checkbox" name="can_view_static" id="can_view_static" value="1" <?php echo ($edit && !empty($user['can_view_static'])) ? "checked": "" ; ?>>
+                <label for="can_view_static">Can view static qr codes</label>
+            </div>
+            <div class="icheck-primary d-inline-block">
+                <input type="checkbox" name="can_view_dynamic" id="can_view_dynamic" value="1" <?php echo ($edit && !empty($user['can_view_dynamic'])) ? "checked": "" ; ?>>
+                <label for="can_view_dynamic">Can view dynamic qr codes</label>
+            </div>
+            <small class="form-text text-muted">Reports/statistics are always visible for this account.</small>
+        </div>
+    </div>
+    <?php endif; ?>
 
     <?php if($edit) { ?>
         <input type="hidden" name="id" value="<?php echo $user['id'];?>"/>
         <input type="hidden" name="edit" value="true"/>
     <?php } ?>
-</fieldset>
+</fieldset>

src/forms/table_dynamic.php

@@ -70,7 +70,7 @@
                 <td><?php echo htmlspecialchars($row['identifier']); ?></td>
                 <td><?php echo htmlspecialchars($row['link']); ?></td>
                 <td>
-                    <?php echo '<img src="'.SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']).'" width="100" height="100">'; ?>
+                    <?php echo '<img src="qrcode_image.php?type=dynamic&id='.$row['id'].'" width="100" height="100">'; ?>
                 </td>
                 <td><?php echo htmlspecialchars($row['scan']); ?></td>
                 <td><?php echo htmlspecialchars($row['state']); ?></td>
@@ -88,7 +88,7 @@
                     ><i class="fas fa-trash"></i></a>
                     <?php endif; ?>
                     <!-- DOWNLOAD -->
-                    <a href="<?php echo SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']); ?>" class="btn btn-primary" download><i class="fa fa-download"></i></a>
+                    <a href="qrcode_image.php?type=dynamic&id=<?php echo $row['id']; ?>&download=1" class="btn btn-primary"><i class="fa fa-download"></i></a>
                 </td>
             </tr>
             <?php endforeach; ?>

src/forms/table_static.php

@@ -68,7 +68,7 @@
                 <td><?php echo htmlspecialchars($row['type']); ?></td>
                 <td><?php echo htmlspecialchars_decode($row['content']); ?></td>
                 <td>
-                    <?php echo '<img src="'.SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']).'" width="100" height="100">'; ?>
+                    <?php echo '<img src="qrcode_image.php?type=static&id='.$row['id'].'" width="100" height="100">'; ?>
                 </td>
                 <td>
                     <?php if (!$is_readonly_user): ?>
@@ -84,7 +84,7 @@
                     ><i class="fas fa-trash"></i></a>
                     <?php endif; ?>
                     <!-- DOWNLOAD -->
-                    <a href="<?php echo SAVED_QRCODE_FOLDER.htmlspecialchars($row['qrcode']); ?>" class="btn btn-primary" download><i class="fa fa-download"></i></a>
+                    <a href="qrcode_image.php?type=static&id=<?php echo $row['id']; ?>&download=1" class="btn btn-primary"><i class="fa fa-download"></i></a>
                 </td>
             </tr>
             <?php endforeach; ?>

src/includes/auth_validate.php

@@ -3,8 +3,9 @@
 //If User is logged in the session['user_logged_in'] will be set to true
 
 //if user is Not Logged in, redirect to login.php page.
-if (!isset($_SESSION['user_logged_in'])) {
+if (empty($_SESSION['user_logged_in'])) {
 	header('Location:login.php');
+	exit;
 }
 
  ?>

src/includes/security.php

@@ -143,6 +143,49 @@ function qr_is_login_locked_out($username) {
     return $count !== null && $count >= LOGIN_MAX_ATTEMPTS;
 }
 
+/**
+ * Compute the owner-scope for a freshly authenticated user row (see qr_scope_owner_id()
+ * below for the meaning of the returned value). Call once at login and store the result
+ * in $_SESSION['scope_owner_id'].
+ */
+function qr_compute_scope_owner_id($user_row) {
+    if ($user_row['type'] === 'admin') {
+        return (int) $user_row['id'];
+    }
+
+    if ($user_row['type'] === 'user' && !empty($user_row['owner_admin_id'])) {
+        return (int) $user_row['owner_admin_id'];
+    }
+
+    return null;
+}
+
+/**
+ * Owner-scope for the qr code lists/reports, set at login time in $_SESSION['scope_owner_id']:
+ * - null: full visibility (super, or a company-wide 'user' account created by super)
+ * - int:  restricted to codes owned by this admin id (an admin's own account, or a
+ *         'user' account created by that admin)
+ */
+function qr_scope_owner_id() {
+    return $_SESSION['scope_owner_id'] ?? null;
+}
+
+function qr_has_full_visibility() {
+    return qr_scope_owner_id() === null;
+}
+
+/**
+ * Apply the current session's owner scope to a MysqliDb query builder in place.
+ * No-op when the session has full visibility.
+ */
+function qr_apply_owner_scope($db) {
+    $scope_owner_id = qr_scope_owner_id();
+    if ($scope_owner_id !== null) {
+        $db->where('id_owner', $scope_owner_id);
+        $db->orWhere('id_owner', NULL, 'IS');
+    }
+}
+
 /**
  * Audit log
  */

src/includes/sidebar.php

@@ -87,7 +87,7 @@
                 </ul>
             </li>
             <?php endif; ?>
-          <?php if ($_SESSION['type'] === 'super'): ?>
+          <?php if (in_array($_SESSION['type'], ['super', 'admin'], true)): ?>
           <li class="nav-item">
             <a href="./users.php" <?php echo ((substr(CURRENT_PAGE, 0, 15) == 'users.php') || (substr(CURRENT_PAGE, 0, 14) == 'user.php')) ? ' class="nav-link active"' : ' class="nav-link"'; ?>>
                 <i class="fas fa-users nav-icon"></i>

src/index.php

@@ -4,31 +4,22 @@ require_once 'includes/auth_validate.php';
 
 $db = getDbInstance();
 
-// Reports/statistieken zijn voor de 'user'-rol altijd volledig zichtbaar (net als 'super'),
-// ongeacht de can_view_static/can_view_dynamic toggles die alleen de qrcode-lijsten regelen.
-$is_full_visibility = in_array($_SESSION['type'], ['super', 'user'], true);
+// Full visibility (super, or a company-wide 'user' account) vs. scoped to one admin's
+// own codes (an admin, or a 'user' account created by that admin).
+$is_full_visibility = qr_has_full_visibility();
 
 //Get Dynamic qr code rows
-if(!$is_full_visibility) {
-    $db->where("id_owner", $_SESSION['user_id']);
-    $db->orWhere ("id_owner", NULL, 'IS');
-}
+qr_apply_owner_scope($db);
 $numQrcode_dynamic = $db->getValue("dynamic_qrcodes", "count(*)");
 
 //Get Static qr code rows
-if(!$is_full_visibility) {
-    $db->where("id_owner", $_SESSION['user_id']);
-    $db->orWhere ("id_owner", NULL, 'IS');
-}
+qr_apply_owner_scope($db);
 $numQrcode_static = $db->getValue("static_qrcodes", "count(*)");
 
 $total = $numQrcode_dynamic + $numQrcode_static;
 
 //Get Total scan
-if(!$is_full_visibility) {
-    $db->where("id_owner", $_SESSION['user_id']);
-    $db->orWhere ("id_owner", NULL, 'IS');
-}
+qr_apply_owner_scope($db);
 $numScan = $db->getOne("dynamic_qrcodes", "sum(scan) as numScan");
 
                                                 /* CREATED CHART */
@@ -36,7 +27,7 @@ $numScan = $db->getOne("dynamic_qrcodes", "sum(scan) as numScan");
 
 //Get the number of DYNAMIC qr code created in 7 days and total scan
 if(!$is_full_visibility)
-    $createdQrcode_dynamic = $db->query("select `created_at`, `scan` from " . DATABASE_PREFIX . "dynamic_qrcodes where `created_at` > curdate()-7 AND (`id_owner`= " . $_SESSION['user_id'] . " OR `id_owner` IS NULL);");
+    $createdQrcode_dynamic = $db->query("select `created_at`, `scan` from " . DATABASE_PREFIX . "dynamic_qrcodes where `created_at` > curdate()-7 AND (`id_owner`= " . (int) qr_scope_owner_id() . " OR `id_owner` IS NULL);");
 else
     $createdQrcode_dynamic = $db->query("select `created_at`, `scan` from ".DATABASE_PREFIX."dynamic_qrcodes where `created_at` > curdate()-7;");
 
@@ -59,7 +50,7 @@ foreach ($createdQrcode_dynamic as $row) {
                                                 /* SCAN CHART */
 //Get the number of STATIC qr code created in 7 days
 if(!$is_full_visibility)
-    $createdQrcode_static = $db->query("select `created_at` from " . DATABASE_PREFIX . "static_qrcodes where `created_at` > curdate()-7 AND (`id_owner`=" . $_SESSION['user_id'] . " OR `id_owner` IS NULL);");
+    $createdQrcode_static = $db->query("select `created_at` from " . DATABASE_PREFIX . "static_qrcodes where `created_at` > curdate()-7 AND (`id_owner`=" . (int) qr_scope_owner_id() . " OR `id_owner` IS NULL);");
 else
     $createdQrcode_static = $db->query("select `created_at` from ".DATABASE_PREFIX."static_qrcodes where `created_at` > curdate()-7;");
 

src/lib/MysqliDb/MysqliDb.php

@@ -830,7 +830,7 @@ class MysqliDb
      * @return bool|array Boolean indicating the insertion failed (false), else return id-array ([int])
      * @throws Exception
      */
-    public function insertMulti($tableName, array $multiInsertData, array $dataKeys = null)
+    public function insertMulti($tableName, array $multiInsertData, ?array $dataKeys = null)
     {
         // only auto-commit our inserts, if no transaction is currently running
         $autoCommit = (isset($this->_transaction_in_progress) ? !$this->_transaction_in_progress : true);

src/lib/Users/Users.php

@@ -13,7 +13,7 @@ class Users
     }
 
     /**
-     * Server-side validatie van username/type. Geeft een foutmelding terug (string) of null als geldig.
+     * Server-side validation of username/type. Returns an error message (string) or null if valid.
      */
     private function validateUsernameAndType($username, $type) {
         if (!is_string($username) || strlen($username) < 3 || strlen($username) > 50) {
@@ -57,6 +57,24 @@ class Users
         return $db->get(DATABASE_PREFIX.'users');
     }
 
+    /**
+     * True if the logged-in admin is allowed to manage (edit/delete) this user record.
+     * Super can always manage everyone.
+     */
+    private function canManage($target_user) {
+        if ($_SESSION['type'] === 'super') {
+            return true;
+        }
+
+        if ($_SESSION['type'] === 'admin') {
+            return $target_user !== null
+                && $target_user['type'] === 'user'
+                && (int) $target_user['owner_admin_id'] === (int) $_SESSION['user_id'];
+        }
+
+        return false;
+    }
+
     public function getUser($id) {
         $db = getDbInstance();
 
@@ -70,12 +88,27 @@ class Users
     }
     
     /**
-     * Add user
+     * Add user.
+     *
+     * A 'super' account can create any type freely (owner_admin_id stays NULL: company-wide).
+     * An 'admin' account can only create their own read-only 'user' accounts
+     * (type is forced to 'user', owner_admin_id is forced to their own id).
      */
     public function addUser($input_data) {
         $db = getDbInstance();
 
-        $validation_error = $this->validateUsernameAndType($input_data['username'] ?? '', $input_data['type'] ?? '');
+        $requested_type = $input_data['type'] ?? '';
+        $owner_admin_id = null;
+
+        if ($_SESSION['type'] === 'admin') {
+            $requested_type = 'user';
+            $owner_admin_id = $_SESSION['user_id'];
+        } elseif ($_SESSION['type'] !== 'super') {
+            header('HTTP/1.1 403 Forbidden', true, 403);
+            exit('403 Forbidden');
+        }
+
+        $validation_error = $this->validateUsernameAndType($input_data['username'] ?? '', $requested_type);
         if ($validation_error !== null) {
             $this->failure($validation_error, 'Location: user.php');
         }
@@ -86,7 +119,8 @@ class Users
 
         $data_to_db["username"] = $input_data["username"];
         $data_to_db['password'] = password_hash($input_data['password'], PASSWORD_DEFAULT);
-        $data_to_db["type"] = $input_data["type"];
+        $data_to_db["type"] = $requested_type;
+        $data_to_db['owner_admin_id'] = $owner_admin_id;
         $data_to_db['can_view_static'] = !empty($input_data['can_view_static']) ? 1 : 0;
         $data_to_db['can_view_dynamic'] = !empty($input_data['can_view_dynamic']) ? 1 : 0;
 
@@ -105,18 +139,30 @@ class Users
     }
     
     /**
-     * Edit user
-     * 
+     * Edit user.
+     *
+     * An 'admin' may only edit their own 'user' accounts (checked via canManage()) and
+     * cannot change the type away from 'user'. A 'super' account can edit anyone freely.
      */
     public function editUser($input_data) {
         $db = getDbInstance();
 
+        $db->where('id', $input_data['id']);
+        $target = $db->getOne('users');
+
+        if (!$this->canManage($target)) {
+            header('HTTP/1.1 403 Forbidden', true, 403);
+            exit('403 Forbidden');
+        }
+
         $query_string = http_build_query(array(
             'id' => $input_data["id"],
             'edit' => "true",
         ));
 
-        $validation_error = $this->validateUsernameAndType($input_data['username'] ?? '', $input_data['type'] ?? '');
+        $requested_type = $_SESSION['type'] === 'admin' ? 'user' : ($input_data['type'] ?? '');
+
+        $validation_error = $this->validateUsernameAndType($input_data['username'] ?? '', $requested_type);
         if ($validation_error !== null) {
             $this->failure($validation_error, 'Location: user.php?'.$query_string);
         }
@@ -125,6 +171,7 @@ class Users
             $this->failure('Password must be at least 10 characters long.', 'Location: user.php?'.$query_string);
         }
 
+        $db = getDbInstance();
         $db->where('username', $input_data['username']);
         $db->where('id', $input_data["id"], '!=');
         $row = $db->getOne('users');
@@ -134,11 +181,11 @@ class Users
         }
 
         $data_to_db["username"] = $input_data["username"];
-        $data_to_db["type"] = $input_data["type"];
+        $data_to_db["type"] = $requested_type;
         $data_to_db['can_view_static'] = !empty($input_data['can_view_static']) ? 1 : 0;
         $data_to_db['can_view_dynamic'] = !empty($input_data['can_view_dynamic']) ? 1 : 0;
 
-        // Alleen wachtwoord overschrijven als er een nieuwe waarde is opgegeven.
+        // Only overwrite the password if a new value was submitted.
         if (!empty($input_data['password'])) {
             $data_to_db['password'] = password_hash($input_data['password'], PASSWORD_DEFAULT);
         }
@@ -152,17 +199,22 @@ class Users
         } else
             $this->failure('Failed to update User: ' . $db->getLastError());
     }
-    
+
     /**
-     * Delete user
-     * 
+     * Delete user.
+     *
+     * An 'admin' may only delete their own 'user' accounts; 'super' can delete anyone.
      */
     public function deleteUser($id) {
-        if($_SESSION['type']!='super'){
-            header('HTTP/1.1 401 Unauthorized', true, 401);
-            exit("401 Unauthorized");
+        $db = getDbInstance();
+        $db->where('id', $id);
+        $target = $db->getOne('users');
+
+        if (!$this->canManage($target)) {
+            header('HTTP/1.1 403 Forbidden', true, 403);
+            exit('403 Forbidden');
         }
-        
+
         $db = getDbInstance();
         $db->where('id', $id);
         $stat = $db->delete('users');

src/login.php

@@ -42,6 +42,7 @@ if (isset($_COOKIE['series_id']) && isset($_COOKIE['remember_token']))
 			$_SESSION['must_change_password'] = !empty($row['must_change_password']);
 			$_SESSION['can_view_static'] = !empty($row['can_view_static']);
 			$_SESSION['can_view_dynamic'] = !empty($row['can_view_dynamic']);
+			$_SESSION['scope_owner_id'] = qr_compute_scope_owner_id($row);
 			$_SESSION['last_activity'] = time();
 
 			audit_log('login_success_remember');

src/qrcode_image.php

@@ -0,0 +1,63 @@
+<?php
+/**
+ * Authenticated view/download endpoint for a generated qr code image.
+ * Replaces the previous direct static URL under saved_qrcode/, which any visitor
+ * could reach without logging in. Enforces the same visibility rules as the list
+ * pages (dynamic_qrcodes.php / static_qrcodes.php).
+ */
+require_once 'includes/bootstrap.php';
+require_once BASE_PATH . '/includes/auth_validate.php';
+
+$type = $_GET['type'] ?? '';
+$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
+
+if (!in_array($type, ['static', 'dynamic'], true) || !$id) {
+    http_response_code(404);
+    exit('Not found');
+}
+
+if ($_SESSION['type'] === 'user') {
+    $view_flag = $type === 'dynamic' ? 'can_view_dynamic' : 'can_view_static';
+    if (empty($_SESSION[$view_flag] ?? null)) {
+        http_response_code(403);
+        exit('Forbidden');
+    }
+}
+
+$db = getDbInstance();
+$db->where('id', $id);
+qr_apply_owner_scope($db);
+$row = $db->getOne("{$type}_qrcodes");
+
+if ($row === null) {
+    http_response_code(404);
+    exit('Not found');
+}
+
+$path = SAVED_QRCODE_DIRECTORY . $row['qrcode'];
+
+if (!is_file($path)) {
+    http_response_code(404);
+    exit('Not found');
+}
+
+$mime_types = [
+    'png' => 'image/png',
+    'jpg' => 'image/jpeg',
+    'jpeg' => 'image/jpeg',
+    'gif' => 'image/gif',
+    'svg' => 'image/svg+xml',
+    'eps' => 'application/postscript',
+];
+$extension = strtolower(pathinfo($path, PATHINFO_EXTENSION));
+$mime = $mime_types[$extension] ?? 'application/octet-stream';
+
+$is_download = isset($_GET['download']) && $_GET['download'] === '1';
+
+header('Content-Type: ' . $mime);
+header('Content-Length: ' . filesize($path));
+header('Cache-Control: private, max-age=0, no-cache');
+header('Content-Disposition: ' . ($is_download ? 'attachment' : 'inline') . '; filename="' . basename($path) . '"');
+
+readfile($path);
+exit;

src/qrcode_zip_download.php

@@ -0,0 +1,34 @@
+<?php
+/**
+ * Authenticated download endpoint for a bulk-export zip generated by bulk_action.php.
+ * The zip's contents were already permission-filtered when it was built, so this only
+ * requires a valid session plus proof that this specific file was generated for it.
+ */
+require_once 'includes/bootstrap.php';
+require_once BASE_PATH . '/includes/auth_validate.php';
+
+$file = basename($_GET['file'] ?? '');
+
+if (!preg_match('/^qrcodes_[0-9a-f]+\.zip$/', $file)) {
+    http_response_code(404);
+    exit('Not found');
+}
+
+if (empty($_SESSION['generated_zips']) || !in_array($file, $_SESSION['generated_zips'], true)) {
+    http_response_code(403);
+    exit('Forbidden');
+}
+
+$path = SAVED_QRCODE_DIRECTORY . 'zip/' . $file;
+
+if (!is_file($path)) {
+    http_response_code(404);
+    exit('Not found');
+}
+
+header('Content-Type: application/zip');
+header('Content-Length: ' . filesize($path));
+header('Content-Disposition: attachment; filename="' . $file . '"');
+
+readfile($path);
+exit;

src/static_qrcodes.php

@@ -18,11 +18,9 @@ require_once BASE_PATH . '/includes/search_order.php';
 $page = filter_input(INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS) ?? 1;
 $db->pageLimit = 15;
 
-// 'user' ziet, net als 'super', alle codes (heeft zelf geen eigen codes om op te scopen).
-if($_SESSION['type'] === 'admin') {
-    $db->where("id_owner", $_SESSION['user_id']);
-    $db->orWhere ("id_owner", NULL, 'IS');
-}
+// Scoped to one admin's own codes for an admin (or a 'user' created by that admin);
+// full visibility for super and company-wide 'user' accounts.
+qr_apply_owner_scope($db);
 
 $rows = $db->arraybuilder()->paginate('static_qrcodes', $page, $select);
 $total_pages = $db->totalPages;

src/user.php

@@ -5,8 +5,8 @@ require_once BASE_PATH . '/lib/Users/Users.php';
 
 $user_instance = new Users();
 
-if ($_SESSION['type'] !== 'super')
-    $user_instance->failure('Only a "super admin" account can access the admin listing page', 'Location: index.php');
+if (!in_array($_SESSION['type'], ['super', 'admin'], true))
+    $user_instance->failure('Only "super admin" and "admin" accounts can access the user management page', 'Location: index.php');
 
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     csrf_verify_or_die();
@@ -16,6 +16,13 @@ $edit = false;
 if($_SERVER["REQUEST_METHOD"] === "GET" && isset($_GET["edit"]) && $_GET["edit"] == "true" && isset($_GET["id"])) {
     $edit = true;
     $user = $user_instance->getUser($_GET["id"]);
+
+    // An admin may only open the edit form for their own 'user' accounts.
+    if ($_SESSION['type'] === 'admin' && (
+        $user['type'] !== 'user' || (int) $user['owner_admin_id'] !== (int) $_SESSION['user_id']
+    )) {
+        $user_instance->failure('You are not allowed to edit this user', 'Location: users.php');
+    }
 }
 
 if($_SERVER["REQUEST_METHOD"] === "POST" && isset($_POST["del_id"])) {

src/users.php

@@ -6,14 +6,21 @@ require_once BASE_PATH . '/lib/Users/Users.php';
 $db = getDbInstance();
 $users = new Users();
 
-if ($_SESSION['type'] !== 'super')
-    $users->failure('Only a "super admin" account can access the admin listing page', 'Location: index.php');
+if (!in_array($_SESSION['type'], ['super', 'admin'], true))
+    $users->failure('Only "super admin" and "admin" accounts can access the user management page', 'Location: index.php');
 
 $select = array('id', 'username', 'type');
 $search_fields = array('username');
 require_once BASE_PATH . '/includes/search_order.php';
 $page = filter_input(INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS) ?? 1;
 $db->pageLimit = 15;
+
+// An admin only sees the read-only 'user' accounts they created themselves.
+if ($_SESSION['type'] === 'admin') {
+    $db->where('owner_admin_id', $_SESSION['user_id']);
+    $db->where('type', 'user');
+}
+
 $rows = $db->arraybuilder()->paginate('users', $page, $select);
 $total_pages = $db->totalPages;
 ?>