dillard
b5ef4ac0cb
Admin-scoped users (answers: who can create a 'user' account, only super or also an admin within their own scope?): - New owner_admin_id column on users (migration 004). NULL means created by super (company-wide, previous behavior); otherwise scoped to that admin's own codes. - Users::addUser/editUser/deleteUser now allow an 'admin' session, but force type='user' and owner_admin_id to their own id regardless of submitted input. user.php/users.php open up to admins with a restricted UI (no type picker, listing limited to their own created users). - New qr_compute_scope_owner_id()/qr_apply_owner_scope()/qr_has_full_visibility() helpers in includes/security.php, replacing the ad-hoc type==='admin' checks in index.php, dynamic_qrcodes.php, static_qrcodes.php and bulk_action.php. A 'user' account created by an admin is now scoped to that admin's codes instead of seeing everything company-wide. Qr code storage hardening: images were served as plain static files under the document root with no auth check at all. Storage now lives outside the web root; qrcode_image.php and qrcode_zip_download.php gate access with the same permission model as the list pages, and the bulk zip download is bound to the session that generated it. PHP 8.4 + chillerlan/php-qrcode 6.0.1: bumped since this is a dockerized app, so the PHP version shipped doesn't matter to end users. Note: the 6.0.1 tag itself only requires PHP 8.2 - the earlier "needs 8.4" read was from an unpinned clone of master, which has since moved past the tag. Fixed along the way, surfaced by testing on 8.4: - The hardcoded Imagick build (an old pinned master commit, workaround for 3.7.0 being broken on PHP 8.3+) no longer compiles on 8.4. Imagick 3.8.1 is now a normal stable release, so the workaround is gone. - config.php had display_errors=On + error_reporting(E_ALL), so PHP 8.4's new deprecation notices got dumped straight into the response before session_start() could run, breaking login outright. Also an info-disclosure risk on its own. Now logged instead of displayed. - MysqliDb::insertMulti() had an implicit nullable parameter, now explicit. - includes/auth_validate.php redirected unauthenticated requests but never called exit(), so the rest of the script kept running. - Dockerfile.fpm was missing both git (needed to clone chillerlan/php-qrcode) and the imagick extension entirely. Also removes the unused sample qr code images that shipped in the original repo; storage now lives outside the document root so they were never going to be served again. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
107 lines
4.9 KiB
PHP
107 lines
4.9 KiB
PHP
<fieldset>
|
|
<div class="col-sm-4">
|
|
<div class="form-group">
|
|
<label for="username">Username *</label>
|
|
<div class="input-group">
|
|
<div class="input-group-prepend">
|
|
<span class="input-group-text"><i class="fa fa-user"></i></span>
|
|
</div>
|
|
|
|
<input type="text" name="username" placeholder="Username" class="form-control" required="required" value="<?php echo ($edit) ? $user['username'] : ''; ?>" autocomplete="off">
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="col-sm-4">
|
|
<div class="form-group">
|
|
<label for="password">Password *</label>
|
|
<div class="input-group">
|
|
<div class="input-group-prepend">
|
|
<span class="input-group-text"><i class="fa fa-lock"></i></span>
|
|
</div>
|
|
|
|
<input type="password" name="password" placeholder="<?php echo ($edit) ? 'Leave blank to keep current password' : 'Password'; ?>" class="form-control" <?php echo ($edit) ? '' : 'required="required"'; ?> minlength="10" autocomplete="off">
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<?php if ($_SESSION['type'] === 'super'): ?>
|
|
<div class="col-sm-4">
|
|
<label for="user-type">User type *</label>
|
|
|
|
<div class="form-group">
|
|
<div class="radio">
|
|
<label class="radio">
|
|
<input type="radio" name="type" value="super" required="required" <?php echo ($edit && $user['type'] =='super') ? "checked": "" ; ?>/> Super admin</label>
|
|
</div>
|
|
|
|
<div class="radio">
|
|
<label class="radio">
|
|
<input type="radio" name="type" value="admin" required="required" <?php echo ($edit && $user['type'] =='admin') ? "checked": "" ; ?>/> Admin</label>
|
|
</div>
|
|
|
|
<div class="radio">
|
|
<label class="radio">
|
|
<input type="radio" name="type" value="user" required="required" id="type-user" <?php echo ($edit && $user['type'] =='user') ? "checked": "" ; ?>/> User (read-only)</label>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="col-sm-12 mt-2" id="user-view-toggles">
|
|
<label>Visibility for the 'User' role</label>
|
|
<div class="form-group">
|
|
<div class="icheck-primary d-inline-block mr-4">
|
|
<input type="checkbox" name="can_view_static" id="can_view_static" value="1" <?php echo ($edit && !empty($user['can_view_static'])) ? "checked": "" ; ?>>
|
|
<label for="can_view_static">Can view static qr codes</label>
|
|
</div>
|
|
<div class="icheck-primary d-inline-block">
|
|
<input type="checkbox" name="can_view_dynamic" id="can_view_dynamic" value="1" <?php echo ($edit && !empty($user['can_view_dynamic'])) ? "checked": "" ; ?>>
|
|
<label for="can_view_dynamic">Can view dynamic qr codes</label>
|
|
</div>
|
|
<small class="form-text text-muted">Only applies to the 'User' type. Reports/statistics are always visible for 'User'.</small>
|
|
</div>
|
|
</div>
|
|
|
|
<script>
|
|
(function () {
|
|
var typeRadios = document.querySelectorAll('input[name="type"]');
|
|
var toggles = document.getElementById('user-view-toggles');
|
|
|
|
function updateToggleVisibility() {
|
|
var userSelected = document.getElementById('type-user').checked;
|
|
toggles.style.display = userSelected ? '' : 'none';
|
|
}
|
|
|
|
typeRadios.forEach(function (radio) {
|
|
radio.addEventListener('change', updateToggleVisibility);
|
|
});
|
|
|
|
updateToggleVisibility();
|
|
})();
|
|
</script>
|
|
<?php else: ?>
|
|
<!-- An 'admin' can only create/manage their own read-only 'user' accounts. -->
|
|
<input type="hidden" name="type" value="user">
|
|
|
|
<div class="col-sm-12 mt-2">
|
|
<label>Visibility for this user</label>
|
|
<div class="form-group">
|
|
<div class="icheck-primary d-inline-block mr-4">
|
|
<input type="checkbox" name="can_view_static" id="can_view_static" value="1" <?php echo ($edit && !empty($user['can_view_static'])) ? "checked": "" ; ?>>
|
|
<label for="can_view_static">Can view static qr codes</label>
|
|
</div>
|
|
<div class="icheck-primary d-inline-block">
|
|
<input type="checkbox" name="can_view_dynamic" id="can_view_dynamic" value="1" <?php echo ($edit && !empty($user['can_view_dynamic'])) ? "checked": "" ; ?>>
|
|
<label for="can_view_dynamic">Can view dynamic qr codes</label>
|
|
</div>
|
|
<small class="form-text text-muted">Reports/statistics are always visible for this account.</small>
|
|
</div>
|
|
</div>
|
|
<?php endif; ?>
|
|
|
|
<?php if($edit) { ?>
|
|
<input type="hidden" name="id" value="<?php echo $user['id'];?>"/>
|
|
<input type="hidden" name="edit" value="true"/>
|
|
<?php } ?>
|
|
</fieldset>
|