AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-16 12:35:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Removed the last of legacy validate functions and replaced with the new enforce fumctions.

Browse Source
This commit is contained in:
johnnyq
2026-07-14 16:49:14 -04:00
parent a2a96f9752
commit 29bea9517d
5 changed files with 12 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
admin/includes/inc_all_admin.php
View File

@@ -4,9 +4,7 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/config.php';
require_once $_SERVER['DOCUMENT_ROOT'] . '/functions.php'; require_once $_SERVER['DOCUMENT_ROOT'] . '/functions.php';
require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/check_login.php'; require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/check_login.php';
require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/page_title.php'; require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/page_title.php';
if (!isset($session_is_admin) || !$session_is_admin) { enforceAdminPermission();
exit(WORDING_ROLECHECK_FAILED . "<br>Tell your admin: Your role does not have admin access.");
}
require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/header.php'; require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/header.php';
require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/top_nav.php'; require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/top_nav.php';
require_once 'includes/side_nav.php'; require_once 'includes/side_nav.php';

2
admin/post/update.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_GET['update'])) { if (isset($_GET['update'])) {
validateAdminRole(); // Old function enforceAdminPermission();
//git fetch downloads the latest from remote without trying to merge or rebase anything. Then the git reset resets the master branch to what you just fetched. The --hard option changes all the files in your working tree to match the files in origin/master //git fetch downloads the latest from remote without trying to merge or rebase anything. Then the git reset resets the master branch to what you just fetched. The --hard option changes all the files in your working tree to match the files in origin/master

1
agent/custom/index.php
View File

@@ -13,7 +13,6 @@
<hr> <hr>
<p>This is a great starting point for new custom pages.</p> <p>This is a great starting point for new custom pages.</p>
<h1><?php echo $session_user_role; ?></h1> <h1><?php echo $session_user_role; ?></h1>
<?php validateAdminRole(); ?>
<?php <?php

2
agent/reports/recurring_by_client.php
View File

@@ -2,7 +2,7 @@
require_once "includes/inc_all_reports.php"; require_once "includes/inc_all_reports.php";
validateAccountantRole(); enforceUserPermission('module_financial');
$sql = mysqli_query($mysqli, " $sql = mysqli_query($mysqli, "
SELECT client_id, client_name, SELECT client_id, client_name,

39
functions/auth.php
View File

@@ -3,36 +3,6 @@
// Role and permission enforcement // Role and permission enforcement
// Split from the former monolithic functions.php // Split from the former monolithic functions.php
/*
* LEGACY Role validation
* Admin - 3
* Tech - 2
* Accountant - 1
*/
function validateAdminRole() {
global $session_user_role;
if (!isset($session_user_role) || $session_user_role != 3) {
$_SESSION['alert_type'] = "danger";
$_SESSION['alert_message'] = WORDING_ROLECHECK_FAILED;
header("Location: " . $_SERVER["HTTP_REFERER"]);
exit();
}
}
// LEGACY
// Validates a user is an accountant (or admin). Stops page load and attempts to direct away from the page if not (i.e. user is a tech)
function validateAccountantRole() {
global $session_user_role;
if (!isset($session_user_role) || $session_user_role == 2) {
$_SESSION['alert_type'] = "danger";
$_SESSION['alert_message'] = WORDING_ROLECHECK_FAILED;
header("Location: " . $_SERVER["HTTP_REFERER"]);
exit();
}
}
// When provided a module name (e.g. module_support), returns the associated permission level (false=none, 1=read, 2=write, 3=full) // When provided a module name (e.g. module_support), returns the associated permission level (false=none, 1=read, 2=write, 3=full)
function lookupUserPermission($module) { function lookupUserPermission($module) {
global $mysqli, $session_is_admin, $session_user_role; global $mysqli, $session_is_admin, $session_user_role;
@@ -67,6 +37,15 @@ function lookupUserPermission($module) {
return false; return false;
} }
// Enforce admin portal access - single canonical admin gate ($session_is_admin)
function enforceAdminPermission() {
global $session_is_admin;
if (!isset($session_is_admin) || !$session_is_admin) {
exit(WORDING_ROLECHECK_FAILED . "<br>Tell your admin: Your role does not have admin access.");
}
return true;
}
// Ensures a user has access to a module (e.g. module_support) with at least the required permission level provided (defaults to read) // Ensures a user has access to a module (e.g. module_support) with at least the required permission level provided (defaults to read)
function enforceUserPermission($module, $check_access_level = 1) { function enforceUserPermission($module, $check_access_level = 1) {
$permitted_access_level = lookupUserPermission($module); $permitted_access_level = lookupUserPermission($module);