mirror of https://github.com/itflow-org/itflow
Permissions overhaul - Define permissions in the database
2nd attempt at this one! Similar to #1008 but separately defining the roles, modules and associated permissions in the database. Also has admin being a defined role automatically having full access. Parent issue: #530
This commit is contained in:
wrongecho
parent
6975d6ef44
commit
271019b16b
|
|
@ -0,0 +1,58 @@
|
|||
<div class="modal" id="addRoleModal" tabindex="-1">
|
||||
<div class="modal-dialog">
|
||||
<div class="modal-content bg-dark">
|
||||
<div class="modal-header">
|
||||
<h5 class="modal-title"><i class="fas fa-fw fa-user-shield mr-2"></i>Add new role</h5>
|
||||
<button type="button" class="close text-white" data-dismiss="modal">
|
||||
<span>×</span>
|
||||
</button>
|
||||
</div>
|
||||
<form action="post.php" method="post" enctype="multipart/form-data" autocomplete="off">
|
||||
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
|
||||
<div class="modal-body bg-white">
|
||||
<div class="tab-content">
|
||||
|
||||
<div class="form-group">
|
||||
<label>Name <strong class="text-danger">*</strong></label>
|
||||
<div class="input-group">
|
||||
<div class="input-group-prepend">
|
||||
<span class="input-group-text"><i class="fa fa-fw fa-user-shield"></i></span>
|
||||
</div>
|
||||
<input type="text" class="form-control" name="role_name" placeholder="Role Name" required>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="form-group">
|
||||
<label>Description <strong class="text-danger">*</strong></label>
|
||||
<div class="input-group">
|
||||
<div class="input-group-prepend">
|
||||
<span class="input-group-text"><i class="fa fa-fw fa-chevron-right"></i></span>
|
||||
</div>
|
||||
<input type="text" class="form-control" name="role_description" placeholder="Role Description" required>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="form-group">
|
||||
<label>Admin Access <strong class="text-danger">*</strong></label>
|
||||
<div class="input-group">
|
||||
<div class="input-group-prepend">
|
||||
<span class="input-group-text"><i class="fa fa-fw fa-tools"></i></span>
|
||||
</div>
|
||||
<select class="form-control select2" name="role_is_admin" required>
|
||||
<option value="0">No - edit after creation to set permissions</option>
|
||||
<option value="1">Yes - this role should have full admin access</option>
|
||||
</select>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
<div class="modal-footer bg-white">
|
||||
<button type="submit" name="add_role" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Save</button>
|
||||
<button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
|
||||
</div>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
|
@ -0,0 +1,119 @@
|
|||
<div class="modal" id="editRoleModal<?php echo $role_id; ?>" tabindex="-1">
|
||||
<div class="modal-dialog">
|
||||
<div class="modal-content bg-dark">
|
||||
<div class="modal-header">
|
||||
<h5 class="modal-title"><i class="fas fa-fw fa-user-shield mr-2"></i>Editing role:
|
||||
<strong><?php echo $role_name; ?></strong></h5>
|
||||
<button type="button" class="close text-white" data-dismiss="modal">
|
||||
<span>×</span>
|
||||
</button>
|
||||
</div>
|
||||
<form action="post.php" method="post" enctype="multipart/form-data" autocomplete="off">
|
||||
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
|
||||
<input type="hidden" name="role_id" value="<?php echo $role_id; ?>">
|
||||
<div class="modal-body bg-white">
|
||||
|
||||
<ul class="nav nav-pills nav-justified mb-3">
|
||||
<li class="nav-item">
|
||||
<a class="nav-link active" data-toggle="pill" href="#pills-role-details<?php echo $role_id; ?>">Details</a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" data-toggle="pill" href="#pills-role-access<?php echo $role_id; ?>">Access</a>
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
<hr>
|
||||
|
||||
<div class="tab-content">
|
||||
|
||||
<div class="tab-pane fade show active" id="pills-role-details<?php echo $role_id; ?>">
|
||||
|
||||
<div class="form-group">
|
||||
<label>Name <strong class="text-danger">*</strong></label>
|
||||
<div class="input-group">
|
||||
<div class="input-group-prepend">
|
||||
<span class="input-group-text"><i class="fa fa-fw fa-user-shield"></i></span>
|
||||
</div>
|
||||
<input type="text" class="form-control" name="role_name" placeholder="Role Name" value="<?php echo $role_name; ?>" required>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="form-group">
|
||||
<label>Description <strong class="text-danger">*</strong></label>
|
||||
<div class="input-group">
|
||||
<div class="input-group-prepend">
|
||||
<span class="input-group-text"><i class="fa fa-fw fa-chevron-right"></i></span>
|
||||
</div>
|
||||
<input type="text" class="form-control" name="role_description" placeholder="Role Description" value="<?php echo $role_description; ?>" required>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="form-group">
|
||||
<label>Admin Access <strong class="text-danger">*</strong></label>
|
||||
<div class="input-group">
|
||||
<div class="input-group-prepend">
|
||||
<span class="input-group-text"><i class="fa fa-fw fa-tools"></i></span>
|
||||
</div>
|
||||
<select class="form-control select2" name="role_is_admin" required>
|
||||
<option value="1" <?php if ($role_admin) { echo 'selected'; } ?> >Yes - this role should have full admin access</option>
|
||||
<option value="0" <?php if (!$role_admin) { echo 'selected'; } ?>>No - use permissions on the next tab</option>
|
||||
</select>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
<div class="tab-pane fade" id="pills-role-access<?php echo $role_id; ?>">
|
||||
|
||||
<?php if ($role_admin) { ?>
|
||||
<div class="alert alert-warning"><strong>Module permissions do not apply to Admins.</strong></div>
|
||||
<?php } ?>
|
||||
|
||||
<?php
|
||||
|
||||
// Enumerate modules
|
||||
$sql_modules = mysqli_query($mysqli, "SELECT * FROM modules");
|
||||
while ($row_modules = mysqli_fetch_array($sql_modules)) {
|
||||
$module_id = intval($row_modules['module_id']);
|
||||
$module_name = nullable_htmlentities($row_modules['module_name']);
|
||||
$module_name_display = ucfirst(str_replace("module_","",$module_name));
|
||||
$module_description = nullable_htmlentities($row_modules['module_description']);
|
||||
|
||||
// Get permission level for module
|
||||
$module_permission_row = mysqli_fetch_array(mysqli_query($mysqli, "SELECT user_role_permission_level FROM user_role_permissions WHERE module_id = $module_id AND user_role_id = $role_id LIMIT 1"));
|
||||
$module_permission = 0;
|
||||
if ($module_permission_row) {
|
||||
$module_permission = $module_permission_row['user_role_permission_level'];
|
||||
}
|
||||
?>
|
||||
|
||||
<div class="form-group">
|
||||
<label> <?php echo $module_name_display ?> <strong class="text-danger">*</strong></label>
|
||||
<div class="input-group">
|
||||
<select class="form-control select2" name="<?php echo "$module_id##$module_name" ?>" required>
|
||||
<option value="0" <?php if ($module_permission == 0) { echo 'selected'; } ?> >None</option>
|
||||
<option value="1" <?php if ($module_permission == 1) { echo 'selected'; } ?> >Read</option>
|
||||
<option value="2" <?php if ($module_permission == 2) { echo 'selected'; } ?>>Modify (Read, Edit, Archive)</option>
|
||||
<option value="3" <?php if ($module_permission == 3) { echo 'selected'; } ?>>Full (Read, Edit, Archive, Delete)</option>
|
||||
</select>
|
||||
</div>
|
||||
<small class="form-text text-muted"><?php echo $module_description ?></small>
|
||||
|
||||
</div>
|
||||
|
||||
<?php } // End while ?>
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
<div class="modal-footer bg-white">
|
||||
<button type="submit" name="edit_role" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Save</button>
|
||||
<button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
|
||||
</div>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
|
@ -0,0 +1,140 @@
|
|||
<?php
|
||||
|
||||
// Default Column Sortby Filter
|
||||
$sort = "user_role_is_admin";
|
||||
$order = "DESC";
|
||||
|
||||
require_once "inc_all_admin.php";
|
||||
|
||||
|
||||
//Rebuild URL
|
||||
$url_query_strings_sort = http_build_query($get_copy);
|
||||
|
||||
$sql = mysqli_query(
|
||||
$mysqli,
|
||||
"SELECT SQL_CALC_FOUND_ROWS * FROM user_roles
|
||||
WHERE (user_roles.user_role_name LIKE '%$q%' OR user_roles.user_role_description LIKE '%$q%')
|
||||
AND user_roles.user_role_archived_at IS NULL
|
||||
ORDER BY $sort $order LIMIT $record_from, $record_to"
|
||||
);
|
||||
|
||||
$num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
||||
|
||||
?>
|
||||
<div class="alert alert-danger"><strong>Roles are not yet active/enforced - do not use.</strong><hr></div>
|
||||
|
||||
<div class="card card-dark">
|
||||
<div class="card-header py-2">
|
||||
<h3 class="card-title mt-2"><i class="fas fa-fw fa-user-shield mr-2"></i>Roles</h3>
|
||||
<div class="card-tools">
|
||||
<div class="btn-group">
|
||||
<button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addRoleModal">
|
||||
<i class="fas fa-fw fa-user-plus mr-2"></i>New Role
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="card-body">
|
||||
<form class="mb-4" autocomplete="off">
|
||||
<div class="row">
|
||||
<div class="col-md-4">
|
||||
<div class="input-group">
|
||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) {echo stripslashes(nullable_htmlentities($q));} ?>" placeholder="Search Roles">
|
||||
<div class="input-group-append">
|
||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-md-8">
|
||||
<div class="float-right">
|
||||
<!--<button type="button" class="btn btn-default" data-toggle="modal" data-target="#exportRoleModal"><i class="fa fa-fw fa-download mr-2"></i>Export</button>-->
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</form>
|
||||
<hr>
|
||||
<div class="table-responsive-sm">
|
||||
<table class="table table-striped table-borderless table-hover">
|
||||
<thead class="text-dark <?php if ($num_rows[0] == 0) { echo "d-none"; } ?>">
|
||||
<tr>
|
||||
<th class="text-center"><a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=user_role_name&order=<?php echo $disp; ?>">Name</a></th>
|
||||
<th class="text-center"><a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=user_role_description&order=<?php echo $disp; ?>">Description</a></th>
|
||||
<th><a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=user_role_is_admin&order=<?php echo $disp; ?>">Admin</a></th>
|
||||
<th><a class="text-dark">User count</a></th>
|
||||
|
||||
<th class="text-center">Action</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<?php
|
||||
|
||||
while ($row = mysqli_fetch_array($sql)) {
|
||||
$role_id = intval($row['user_role_id']);
|
||||
$role_name = nullable_htmlentities($row['user_role_name']);
|
||||
$role_description = nullable_htmlentities($row['user_role_description']);
|
||||
$role_admin = intval($row['user_role_is_admin']);
|
||||
$role_archived_at = nullable_htmlentities($row['user_role_archived_at']);
|
||||
|
||||
// Count number of users that have each role
|
||||
$sql_role_user_count = mysqli_query($mysqli, "SELECT COUNT(users.user_id) FROM users LEFT JOIN user_settings on users.user_id = user_settings.user_id WHERE user_role = $role_id AND user_archived_at IS NULL");
|
||||
$role_user_count = mysqli_fetch_row($sql_role_user_count)[0];
|
||||
|
||||
?>
|
||||
<tr>
|
||||
<td class="text-center">
|
||||
<a class="text-dark" href="#" data-toggle="modal" data-target="#editRoleModal<?php echo $role_id; ?>">
|
||||
<div class="text-secondary"><?php echo $role_name; ?></div>
|
||||
</a>
|
||||
</td>
|
||||
<td><?php echo $role_description; ?></td>
|
||||
<td><?php echo $role_admin ? 'Yes' : 'No' ; ?></td>
|
||||
<td><?php echo $role_user_count ?></td>
|
||||
<td>
|
||||
<?php if ($role_id !== 3) { ?>
|
||||
<div class="dropdown dropleft text-center">
|
||||
<button class="btn btn-secondary btn-sm" type="button" data-toggle="dropdown">
|
||||
<i class="fas fa-ellipsis-h"></i>
|
||||
</button>
|
||||
<div class="dropdown-menu">
|
||||
|
||||
<a class="dropdown-item" href="#" data-toggle="modal" data-target="#editRoleModal<?php echo $role_id; ?>">
|
||||
<i class="fas fa-fw fa-user-edit mr-2"></i>Edit
|
||||
</a>
|
||||
|
||||
<?php if (empty($role_archived_at) && $role_user_count == 0) { ?>
|
||||
<!-- To be added-->
|
||||
<!-- <div class="dropdown-divider"></div>-->
|
||||
<!-- <a class="dropdown-item text-danger confirm-link" href="post.php?archive_role=--><?php //echo $role_id; ?><!--&csrf_token=--><?php //echo $_SESSION['csrf_token'] ?><!--">-->
|
||||
<!-- <i class="fas fa-fw fa-archive mr-2"></i>Archive-->
|
||||
<!-- </a>-->
|
||||
<?php } ?>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
<?php } ?>
|
||||
</td>
|
||||
</tr>
|
||||
|
||||
<?php
|
||||
|
||||
require "admin_role_edit_modal.php";
|
||||
|
||||
|
||||
}
|
||||
|
||||
?>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
<?php require_once "pagination.php";
|
||||
?>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<?php
|
||||
|
||||
require_once "admin_role_add_modal.php";
|
||||
|
||||
require_once "footer.php";
|
||||
|
||||
|
|
@ -52,6 +52,9 @@ if ($session_user_role == 3) {
|
|||
} else {
|
||||
$session_user_role_display = "Accountant";
|
||||
}
|
||||
if (isset($row['user_role_is_admin']) && $row['user_role_is_admin'] == 1) {
|
||||
$session_is_admin = true;
|
||||
}
|
||||
$session_user_config_force_mfa = intval($row['user_config_force_mfa']);
|
||||
$user_config_records_per_page = intval($row['user_config_records_per_page']);
|
||||
|
||||
|
|
|
|||
|
|
@ -2165,10 +2165,54 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) {
|
|||
mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '1.4.9'");
|
||||
}
|
||||
|
||||
// if (CURRENT_DATABASE_VERSION == '1.4.9') {
|
||||
// // Insert queries here required to update to DB version 1.5.0
|
||||
if (CURRENT_DATABASE_VERSION == '1.4.9') {
|
||||
|
||||
// Add new "is admin" identifier on user roles
|
||||
mysqli_query($mysqli, "ALTER TABLE `user_roles` ADD `user_role_is_admin` INT(11) NOT NULL DEFAULT '0' AFTER `user_role_description`");
|
||||
mysqli_query($mysqli, "UPDATE `user_roles` SET `user_role_is_admin` = '1' WHERE `user_role_id` = 3");
|
||||
|
||||
// Add modules
|
||||
mysqli_query($mysqli, "CREATE TABLE `modules` (
|
||||
`module_id` INT(11) NOT NULL AUTO_INCREMENT,
|
||||
`module_name` VARCHAR(200) NOT NULL,
|
||||
`module_description` VARCHAR(200) NULL,
|
||||
PRIMARY KEY (`module_id`)
|
||||
)");
|
||||
|
||||
mysqli_query($mysqli, "INSERT INTO modules SET module_name = 'module_client', module_description = 'General client & contact management'");
|
||||
mysqli_query($mysqli, "INSERT INTO modules SET module_name = 'module_support', module_description = 'Access to ticketing, assets and documentation'");
|
||||
mysqli_query($mysqli, "INSERT INTO modules SET module_name = 'module_credential', module_description = 'Access to client credentials - usernames, passwords and 2FA codes'");
|
||||
mysqli_query($mysqli, "INSERT INTO modules SET module_name = 'module_sales', module_description = 'Access to quotes, invoices and products'");
|
||||
mysqli_query($mysqli, "INSERT INTO modules SET module_name = 'module_financial', module_description = 'Access to payments, accounts, expenses and budgets'");
|
||||
mysqli_query($mysqli, "INSERT INTO modules SET module_name = 'module_reporting', module_description = 'Access to all reports'");
|
||||
|
||||
// Add table for storing role<->module permissions
|
||||
mysqli_query($mysqli, "CREATE TABLE `user_role_permissions` (
|
||||
`user_role_id` INT(11) NOT NULL,
|
||||
`module_id` INT(11) NOT NULL,
|
||||
`user_role_permission_level` INT(11) NOT NULL
|
||||
)");
|
||||
|
||||
// Add default permissions for accountant role
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 1, module_id = 1, user_role_permission_level = 1"); // Read clients
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 1, module_id = 2, user_role_permission_level = 1"); // Read support
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 1, module_id = 4, user_role_permission_level = 1"); // Read sales
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 1, module_id = 5, user_role_permission_level = 2"); // Modify financial
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 1, module_id = 6, user_role_permission_level = 1"); // Read reports
|
||||
|
||||
// Add default permissions for tech role
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 2, module_id = 1, user_role_permission_level = 2"); // Modify clients
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 2, module_id = 2, user_role_permission_level = 2"); // Modify support
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 2, module_id = 3, user_role_permission_level = 2"); // Modify credentials
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 2, module_id = 4, user_role_permission_level = 2"); // Modify sales
|
||||
|
||||
mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '1.5.0'");
|
||||
}
|
||||
|
||||
// if (CURRENT_DATABASE_VERSION == '1.5.0') {
|
||||
// // Insert queries here required to update to DB version 1.5.1
|
||||
// // Then, update the database to the next sequential version
|
||||
// mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '1.5.0'");
|
||||
// mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '1.5.1'");
|
||||
// }
|
||||
|
||||
} else {
|
||||
|
|
|
|||
|
|
@ -5,4 +5,4 @@
|
|||
* It is used in conjunction with database_updates.php
|
||||
*/
|
||||
|
||||
DEFINE("LATEST_DATABASE_VERSION", "1.4.9");
|
||||
DEFINE("LATEST_DATABASE_VERSION", "1.5.0");
|
||||
|
|
|
|||
24
db.sql
24
db.sql
|
|
@ -889,6 +889,18 @@ CREATE TABLE `logs` (
|
|||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
|
||||
/*!40101 SET character_set_client = @saved_cs_client */;
|
||||
|
||||
--
|
||||
-- Table structure for table `modules`
|
||||
--
|
||||
|
||||
DROP TABLE IF EXISTS `modules`;
|
||||
CREATE TABLE IF NOT EXISTS `modules` (
|
||||
`module_id` int(11) NOT NULL AUTO_INCREMENT,
|
||||
`module_name` varchar(200) NOT NULL,
|
||||
`module_description` varchar(200) DEFAULT NULL,
|
||||
PRIMARY KEY (`module_id`)
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3 COLLATE=utf8mb3_general_ci;
|
||||
|
||||
--
|
||||
-- Table structure for table `networks`
|
||||
--
|
||||
|
|
@ -1959,6 +1971,7 @@ CREATE TABLE `user_roles` (
|
|||
`user_role_id` int(11) NOT NULL AUTO_INCREMENT,
|
||||
`user_role_name` varchar(200) NOT NULL,
|
||||
`user_role_description` varchar(200) DEFAULT NULL,
|
||||
`user_role_is_admin` int(11) NOT NULL DEFAULT 0,
|
||||
`user_role_created_at` datetime NOT NULL DEFAULT current_timestamp(),
|
||||
`user_role_updated_at` datetime DEFAULT NULL ON UPDATE current_timestamp(),
|
||||
`user_role_archived_at` datetime DEFAULT NULL,
|
||||
|
|
@ -1966,6 +1979,17 @@ CREATE TABLE `user_roles` (
|
|||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
|
||||
/*!40101 SET character_set_client = @saved_cs_client */;
|
||||
|
||||
--
|
||||
-- Table structure for table `user_role_permissions`
|
||||
--
|
||||
|
||||
DROP TABLE IF EXISTS `user_role_permissions`;
|
||||
CREATE TABLE IF NOT EXISTS `user_role_permissions` (
|
||||
`user_role_id` int(11) NOT NULL,
|
||||
`module_id` int(11) NOT NULL,
|
||||
`user_role_permission_level` int(11) NOT NULL
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3 COLLATE=utf8mb3_general_ci;
|
||||
|
||||
--
|
||||
-- Table structure for table `user_settings`
|
||||
--
|
||||
|
|
|
|||
|
|
@ -1341,3 +1341,49 @@ zgjRYR/zGN5l+az6RB3+0mJRdZdv/y2aRkBlwTxx2gOrPbQAco4a/IOmkE3EbHe7
|
|||
|
||||
return false;
|
||||
}
|
||||
|
||||
// When provided a module name (e.g. module_support), returns the associated permission level (false=none, 1=read, 2=write, 3=full)
|
||||
function lookupUserPermission($module) {
|
||||
global $mysqli, $session_is_admin, $session_user_role;
|
||||
|
||||
if (isset($session_is_admin) && $session_is_admin === true) {
|
||||
return 3;
|
||||
}
|
||||
|
||||
$module = sanitizeInput($module);
|
||||
|
||||
$sql = mysqli_query(
|
||||
$mysqli,
|
||||
"SELECT
|
||||
urp.user_role_permission_level
|
||||
FROM
|
||||
modules AS m
|
||||
JOIN
|
||||
user_role_permissions AS urp
|
||||
ON
|
||||
m.module_id = urp.module_id
|
||||
WHERE
|
||||
m.module_name = '$module' AND urp.user_role_id = $session_user_role"
|
||||
);
|
||||
|
||||
$row = mysqli_fetch_array($sql);
|
||||
|
||||
if (isset($row['user_role_permission_level'])) {
|
||||
return intval($row['user_role_permission_level']);
|
||||
}
|
||||
|
||||
// Default return for no module permission
|
||||
return false;
|
||||
}
|
||||
|
||||
// Ensures a user has access to a module (e.g. module_support) with at least the required permission level provided (defaults to read)
|
||||
function enforceUserPermission($module, $check_access_level = 1) {
|
||||
$permitted_access_level = lookupUserPermission($module);
|
||||
|
||||
if (!$permitted_access_level || $permitted_access_level < $check_access_level) {
|
||||
$_SESSION['alert_type'] = "danger";
|
||||
$_SESSION['alert_message'] = WORDING_ROLECHECK_FAILED;
|
||||
header("Location: " . $_SERVER["HTTP_REFERER"]);
|
||||
exit(WORDING_ROLECHECK_FAILED);
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -343,3 +343,54 @@ if (isset($_GET['delete_custom_link'])) {
|
|||
header("Location: " . $_SERVER["HTTP_REFERER"]);
|
||||
|
||||
}
|
||||
|
||||
if (isset($_POST['add_role'])) {
|
||||
validateCSRFToken($_POST['csrf_token']);
|
||||
validateAdminRole();
|
||||
|
||||
$name = sanitizeInput($_POST['role_name']);
|
||||
$description = sanitizeInput($_POST['role_description']);
|
||||
$admin = intval($_POST['role_is_admin']);
|
||||
|
||||
mysqli_query($mysqli, "INSERT INTO user_roles SET user_role_name = '$name', user_role_description = '$description', user_role_is_admin = $admin");
|
||||
|
||||
mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Role', log_action = 'Create', log_description = '$session_name created the $name role', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id");
|
||||
|
||||
$_SESSION['alert_message'] = "Role $name created";
|
||||
|
||||
header("Location: " . $_SERVER["HTTP_REFERER"]);
|
||||
|
||||
}
|
||||
|
||||
if (isset($_POST['edit_role'])) {
|
||||
validateCSRFToken($_POST['csrf_token']);
|
||||
validateAdminRole();
|
||||
|
||||
// Update role metadata
|
||||
$role_id = sanitizeInput($_POST['role_id']);
|
||||
$name = sanitizeInput($_POST['role_name']);
|
||||
$description = sanitizeInput($_POST['role_description']);
|
||||
$admin = intval($_POST['role_is_admin']);
|
||||
mysqli_query($mysqli, "UPDATE user_roles SET user_role_name = '$name', user_role_description = '$description', user_role_is_admin = $admin WHERE user_role_id = $role_id");
|
||||
|
||||
// Update role access levels
|
||||
mysqli_query($mysqli, "DELETE FROM user_role_permissions WHERE user_role_id = $role_id");
|
||||
foreach ($_POST as $key => $value) {
|
||||
if (str_contains($key, '##module_')){
|
||||
$module_id = intval(explode('##', $key)[0]);
|
||||
$access_level = intval($value);
|
||||
|
||||
if ($access_level > 0) {
|
||||
echo $key . ' with id ' . $module_id . " : ". $access_level . "\n";
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = $role_id, module_id = $module_id, user_role_permission_level = $access_level");
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Role', log_action = 'Modify', log_description = '$session_name updated the $name role', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id");
|
||||
|
||||
$_SESSION['alert_message'] = "Role $name updated";
|
||||
|
||||
header("Location: " . $_SERVER["HTTP_REFERER"]);
|
||||
}
|
||||
|
|
|
|||
27
setup.php
27
setup.php
|
|
@ -300,13 +300,32 @@ if (isset($_POST['add_company_settings'])) {
|
|||
mysqli_query($mysqli, "INSERT INTO ticket_statuses SET ticket_status_name = 'New', ticket_status_color = '#dc3545'"); // Default ID for new tickets is 1
|
||||
mysqli_query($mysqli, "INSERT INTO ticket_statuses SET ticket_status_name = 'Open', ticket_status_color = '#007bff'"); // 2
|
||||
mysqli_query($mysqli, "INSERT INTO ticket_statuses SET ticket_status_name = 'On Hold', ticket_status_color = '#28a745'"); // 3
|
||||
mysqli_query($mysqli, "INSERT INTO ticket_statuses SET ticket_status_name = 'Resolved', ticket_status_color = '#343a40'"); // 4 - was auto-close, now resolved
|
||||
mysqli_query($mysqli, "INSERT INTO ticket_statuses SET ticket_status_name = 'Resolved', ticket_status_color = '#343a40'"); // 4 (was auto-close)
|
||||
mysqli_query($mysqli, "INSERT INTO ticket_statuses SET ticket_status_name = 'Closed', ticket_status_color = '#343a40'"); // 5
|
||||
|
||||
// Add default modules
|
||||
mysqli_query($mysqli, "INSERT INTO modules SET module_name = 'module_client', module_description = 'General client & contact management'");
|
||||
mysqli_query($mysqli, "INSERT INTO modules SET module_name = 'module_support', module_description = 'Access to ticketing, assets and documentation'");
|
||||
mysqli_query($mysqli, "INSERT INTO modules SET module_name = 'module_credential', module_description = 'Access to client credentials - usernames, passwords and 2FA codes'");
|
||||
mysqli_query($mysqli, "INSERT INTO modules SET module_name = 'module_sales', module_description = 'Access to quotes, invoices and products'");
|
||||
mysqli_query($mysqli, "INSERT INTO modules SET module_name = 'module_financial', module_description = 'Access to payments, accounts, expenses and budgets'");
|
||||
mysqli_query($mysqli, "INSERT INTO modules SET module_name = 'module_reporting', module_description = 'Access to all reports'");
|
||||
|
||||
// Add default roles
|
||||
mysqli_query($mysqli, "INSERT INTO `user_roles` SET user_role_id = 1, user_role_name = 'Accountant', user_role_description = 'Built-in - Limited access to financial-focused modules'");
|
||||
mysqli_query($mysqli, "INSERT INTO `user_roles` SET user_role_id = 2, user_role_name = 'Technician', user_role_description = 'Built-in - Limited access to technical-focused modules'");
|
||||
mysqli_query($mysqli, "INSERT INTO `user_roles` SET user_role_id = 3, user_role_name = 'Administrator', user_role_description = 'Built-in - Full administrative access to all modules (including user management)'");
|
||||
mysqli_query($mysqli, "INSERT INTO user_roles SET user_role_id = 1, user_role_name = 'Accountant', user_role_description = 'Built-in - Limited access to financial-focused modules'");
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 1, module_id = 1, user_role_permission_level = 1"); // Read clients
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 1, module_id = 2, user_role_permission_level = 1"); // Read support
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 1, module_id = 4, user_role_permission_level = 1"); // Read sales
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 1, module_id = 5, user_role_permission_level = 2"); // Modify financial
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 1, module_id = 6, user_role_permission_level = 1"); // Read reports
|
||||
|
||||
mysqli_query($mysqli, "INSERT INTO user_roles SET user_role_id = 2, user_role_name = 'Technician', user_role_description = 'Built-in - Limited access to technical-focused modules'");
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 2, module_id = 1, user_role_permission_level = 2"); // Modify clients
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 2, module_id = 2, user_role_permission_level = 2"); // Modify support
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 2, module_id = 3, user_role_permission_level = 2"); // Modify credentials
|
||||
mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = 2, module_id = 4, user_role_permission_level = 2"); // Modify sales
|
||||
|
||||
mysqli_query($mysqli, "INSERT INTO user_roles SET user_role_id = 3, user_role_name = 'Administrator', user_role_description = 'Built-in - Full administrative access to all modules (including user management)', user_role_is_admin = 1");
|
||||
|
||||
|
||||
$_SESSION['alert_message'] = "Company <strong>$name</strong> created!";
|
||||
|
|
|
|||
Loading…
Reference in New Issue