dillard
6387d24846
Admin-scoped users (answers: who can create a 'user' account, only super or also an admin within their own scope?): - New owner_admin_id column on users (migration 004). NULL means created by super (company-wide, previous behavior); otherwise scoped to that admin's own codes. - Users::addUser/editUser/deleteUser now allow an 'admin' session, but force type='user' and owner_admin_id to their own id regardless of submitted input. user.php/users.php open up to admins with a restricted UI (no type picker, listing limited to their own created users). - New qr_compute_scope_owner_id()/qr_apply_owner_scope()/qr_has_full_visibility() helpers in includes/security.php, replacing the ad-hoc type==='admin' checks in index.php, dynamic_qrcodes.php, static_qrcodes.php and bulk_action.php. A 'user' account created by an admin is now scoped to that admin's codes instead of seeing everything company-wide. Qr code storage hardening: images were served as plain static files under the document root with no auth check at all. Storage now lives outside the web root; qrcode_image.php and qrcode_zip_download.php gate access with the same permission model as the list pages, and the bulk zip download is bound to the session that generated it. PHP 8.4 + chillerlan/php-qrcode 6.0.1: bumped since this is a dockerized app, so the PHP version shipped doesn't matter to end users. Note: the 6.0.1 tag itself only requires PHP 8.2 - the earlier "needs 8.4" read was from an unpinned clone of master, which has since moved past the tag. Fixed along the way, surfaced by testing on 8.4: - The hardcoded Imagick build (an old pinned master commit, workaround for 3.7.0 being broken on PHP 8.3+) no longer compiles on 8.4. Imagick 3.8.1 is now a normal stable release, so the workaround is gone. - config.php had display_errors=On + error_reporting(E_ALL), so PHP 8.4's new deprecation notices got dumped straight into the response before session_start() could run, breaking login outright. Also an info-disclosure risk on its own. Now logged instead of displayed. - MysqliDb::insertMulti() had an implicit nullable parameter, now explicit. - includes/auth_validate.php redirected unauthenticated requests but never called exit(), so the rest of the script kept running. - Dockerfile.fpm was missing both git (needed to clone chillerlan/php-qrcode) and the imagick extension entirely. Also removes the unused sample qr code images that shipped in the original repo; storage now lives outside the document root so they were never going to be served again.
46 lines
1.6 KiB
PHP
Executable File
46 lines
1.6 KiB
PHP
Executable File
<?php
|
|
//Note: This file should be included first in every php page.
|
|
require_once ('environment.php');
|
|
|
|
// Never display errors/warnings/deprecations in the response body: besides leaking
|
|
// internal file paths, it can inject output before session_start() runs and break
|
|
// login entirely (seen with PHP 8.4's new deprecation notices). Log them instead.
|
|
error_reporting(E_ALL);
|
|
ini_set('display_errors', 'Off');
|
|
ini_set('log_errors', 'On');
|
|
define('BASE_PATH', dirname(dirname(__FILE__)));
|
|
define('CURRENT_PAGE', basename($_SERVER['REQUEST_URI']));
|
|
define('SCRIPT_NAME', ltrim(dirname($_SERVER['SCRIPT_NAME']), '/'));
|
|
|
|
if(SCRIPT_NAME === "")
|
|
define('SCRIPT_FOLDER', "");
|
|
else
|
|
define('SCRIPT_FOLDER', "/" . SCRIPT_NAME);
|
|
|
|
require_once BASE_PATH . '/lib/MysqliDb/MysqliDb.php';
|
|
require_once BASE_PATH . '/helpers/helpers.php';
|
|
|
|
/* SAVED QR CODES */
|
|
// Storage lives outside the document root so files can only be reached through the
|
|
// authenticated qrcode_image.php / qrcode_zip_download.php endpoints, never as a direct
|
|
// static URL. See db/migrations and the "saved_qrcode" hardening note in the OSS repo.
|
|
define('SAVED_QRCODE_DIRECTORY', dirname(BASE_PATH).'/qrcode-storage/');
|
|
|
|
//You can change the page name for the redirect and the search parameter (the default is "id")
|
|
define('READ_PATH', base_url().'/read.php?id=');
|
|
|
|
|
|
/**
|
|
* Get instance of DB object
|
|
*/
|
|
function getDbInstance() {
|
|
return new MysqliDb (Array (
|
|
'host' => DATABASE_HOST,
|
|
'username' => DATABASE_USER,
|
|
'password' => DATABASE_PASSWORD,
|
|
'db'=> DATABASE_NAME,
|
|
'port' => DATABASE_PORT,
|
|
'prefix' => DATABASE_PREFIX,
|
|
'charset' => DATABASE_CHARSET));
|
|
}
|