dillard
b5ef4ac0cb
Admin-scoped users (answers: who can create a 'user' account, only super or also an admin within their own scope?): - New owner_admin_id column on users (migration 004). NULL means created by super (company-wide, previous behavior); otherwise scoped to that admin's own codes. - Users::addUser/editUser/deleteUser now allow an 'admin' session, but force type='user' and owner_admin_id to their own id regardless of submitted input. user.php/users.php open up to admins with a restricted UI (no type picker, listing limited to their own created users). - New qr_compute_scope_owner_id()/qr_apply_owner_scope()/qr_has_full_visibility() helpers in includes/security.php, replacing the ad-hoc type==='admin' checks in index.php, dynamic_qrcodes.php, static_qrcodes.php and bulk_action.php. A 'user' account created by an admin is now scoped to that admin's codes instead of seeing everything company-wide. Qr code storage hardening: images were served as plain static files under the document root with no auth check at all. Storage now lives outside the web root; qrcode_image.php and qrcode_zip_download.php gate access with the same permission model as the list pages, and the bulk zip download is bound to the session that generated it. PHP 8.4 + chillerlan/php-qrcode 6.0.1: bumped since this is a dockerized app, so the PHP version shipped doesn't matter to end users. Note: the 6.0.1 tag itself only requires PHP 8.2 - the earlier "needs 8.4" read was from an unpinned clone of master, which has since moved past the tag. Fixed along the way, surfaced by testing on 8.4: - The hardcoded Imagick build (an old pinned master commit, workaround for 3.7.0 being broken on PHP 8.3+) no longer compiles on 8.4. Imagick 3.8.1 is now a normal stable release, so the workaround is gone. - config.php had display_errors=On + error_reporting(E_ALL), so PHP 8.4's new deprecation notices got dumped straight into the response before session_start() could run, breaking login outright. Also an info-disclosure risk on its own. Now logged instead of displayed. - MysqliDb::insertMulti() had an implicit nullable parameter, now explicit. - includes/auth_validate.php redirected unauthenticated requests but never called exit(), so the rest of the script kept running. - Dockerfile.fpm was missing both git (needed to clone chillerlan/php-qrcode) and the imagick extension entirely. Also removes the unused sample qr code images that shipped in the original repo; storage now lives outside the document root so they were never going to be served again. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
64 lines
1.8 KiB
PHP
64 lines
1.8 KiB
PHP
<?php
|
|
/**
|
|
* Authenticated view/download endpoint for a generated qr code image.
|
|
* Replaces the previous direct static URL under saved_qrcode/, which any visitor
|
|
* could reach without logging in. Enforces the same visibility rules as the list
|
|
* pages (dynamic_qrcodes.php / static_qrcodes.php).
|
|
*/
|
|
require_once 'includes/bootstrap.php';
|
|
require_once BASE_PATH . '/includes/auth_validate.php';
|
|
|
|
$type = $_GET['type'] ?? '';
|
|
$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
|
|
|
|
if (!in_array($type, ['static', 'dynamic'], true) || !$id) {
|
|
http_response_code(404);
|
|
exit('Not found');
|
|
}
|
|
|
|
if ($_SESSION['type'] === 'user') {
|
|
$view_flag = $type === 'dynamic' ? 'can_view_dynamic' : 'can_view_static';
|
|
if (empty($_SESSION[$view_flag] ?? null)) {
|
|
http_response_code(403);
|
|
exit('Forbidden');
|
|
}
|
|
}
|
|
|
|
$db = getDbInstance();
|
|
$db->where('id', $id);
|
|
qr_apply_owner_scope($db);
|
|
$row = $db->getOne("{$type}_qrcodes");
|
|
|
|
if ($row === null) {
|
|
http_response_code(404);
|
|
exit('Not found');
|
|
}
|
|
|
|
$path = SAVED_QRCODE_DIRECTORY . $row['qrcode'];
|
|
|
|
if (!is_file($path)) {
|
|
http_response_code(404);
|
|
exit('Not found');
|
|
}
|
|
|
|
$mime_types = [
|
|
'png' => 'image/png',
|
|
'jpg' => 'image/jpeg',
|
|
'jpeg' => 'image/jpeg',
|
|
'gif' => 'image/gif',
|
|
'svg' => 'image/svg+xml',
|
|
'eps' => 'application/postscript',
|
|
];
|
|
$extension = strtolower(pathinfo($path, PATHINFO_EXTENSION));
|
|
$mime = $mime_types[$extension] ?? 'application/octet-stream';
|
|
|
|
$is_download = isset($_GET['download']) && $_GET['download'] === '1';
|
|
|
|
header('Content-Type: ' . $mime);
|
|
header('Content-Length: ' . filesize($path));
|
|
header('Cache-Control: private, max-age=0, no-cache');
|
|
header('Content-Disposition: ' . ($is_download ? 'attachment' : 'inline') . '; filename="' . basename($path) . '"');
|
|
|
|
readfile($path);
|
|
exit;
|