From 99ecc2d4a42390d6eb04b303334f4f8d893bf295 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Thu, 15 Oct 2026 21:29:40 -0400 Subject: [PATCH] Modernize Administration > Users and the agent Account pages: new users list with Users/Admins/No MFA/Disabled/Archived views, role filter, status and MFA pills, remembered browsers, client access summary, last successful sign in with device and IP, seat badge, quick look modal, bulk role/require MFA/forget browsers/activate/disable, shared New/Edit user form with Details/Sign in/Client access tabs (icon prefixed inputs, picture preview, generated passwords, Only/Never client rules with search and set all), archive modal with ticket hand-over, restore requiring a new password, incident response limited to agents and forgetting remembered browsers, export role filter and MFA/last sign in/client access columns; Account pages reworked into Profile/Security/Preferences/Activity with current password required to change email, password or turn MFA off, inline SVG MFA QR code, remembered browser list with forget one/all, rows per page preference; adds functions/user.php shared helpers, validates email format and uniqueness, sets password hash and vault key from the exact typed password, purifies signatures, fixes Activity showing other agents' sign ins, removes dead user invite modal and user_model, and fixes the networks export link from All Clients with no filter --- admin/modals/user/user.php | 116 ++++ admin/modals/user/user_add.php | 174 +---- admin/modals/user/user_all_reset_password.php | 57 +- admin/modals/user/user_archive.php | 109 +-- admin/modals/user/user_bulk_role.php | 45 ++ admin/modals/user/user_edit.php | 239 +------ admin/modals/user/user_export.php | 39 +- admin/modals/user/user_form.php | 377 +++++++++++ admin/modals/user/user_invite.php | 43 -- admin/modals/user/user_restore.php | 104 +-- admin/post/user_model.php | 8 - admin/post/users.php | 639 ++++++++++-------- admin/users.php | 526 ++++++++------ agent/networks.php | 2 +- agent/user/includes/mfa_setup.php | 38 ++ agent/user/includes/user_side_nav.php | 66 +- agent/user/mfa_enforcement.php | 29 +- agent/user/modals/user_mfa_modal.php | 38 +- agent/user/post/profile.php | 328 ++++----- agent/user/user_activity.php | 158 +++-- agent/user/user_details.php | 184 +++-- agent/user/user_preferences.php | 85 ++- agent/user/user_security.php | 246 +++++-- css/itflow_custom.css | 95 +++ functions.php | 1 + functions/export.php | 3 + functions/user.php | 509 ++++++++++++++ includes/top_nav.php | 18 +- 28 files changed, 2703 insertions(+), 1573 deletions(-) create mode 100644 admin/modals/user/user.php create mode 100644 admin/modals/user/user_bulk_role.php create mode 100644 admin/modals/user/user_form.php delete mode 100644 admin/modals/user/user_invite.php delete mode 100644 admin/post/user_model.php create mode 100644 agent/user/includes/mfa_setup.php create mode 100644 functions/user.php diff --git a/admin/modals/user/user.php b/admin/modals/user/user.php new file mode 100644 index 000000000..8b36af996 --- /dev/null +++ b/admin/modals/user/user.php @@ -0,0 +1,116 @@ + Users. Who they are, whether and + * how they sign in, the clients they see, the work they have open, and their + * latest sign ins. + */ + +require_once '../../includes/modal_header.php'; + +$user = userForModal($_GET['id'] ?? 0); +$user_id = intval($user['user_id']); +$is_self = $user_id === intval($session_user_id); +$is_archived = !empty($user['user_archived_at']); +$is_admin = intval($user['role_is_admin']) === 1; +$display_name = $is_archived ? trim(str_replace(' (archived)', '', $user['user_name'])) : $user['user_name']; +$access = userClientAccess([$user_id])[$user_id]; +$remembered = userRememberCounts([$user_id])[$user_id]; +[$open_tickets, $recurring_tickets] = userOpenWork($user_id); +$recent = userRecentLogins($user_id, 6); + +ob_start(); + +?> +
+
+ +
+
You
+
+ + +
+
+
+ +
+ +
+ +
+ + + Admin +
+ +
+
Clients
+
+ + +
Only
+ + +
Never
+ +
+ + +
Remembered
+
+ + browser skip their MFA code + + No browsers + +
+ +
Open work
+
+ + open ticket + + No open tickets + + + · recurring + +
+ + +
Added
+
+ + +
Archived
+
+ +
+ +
Latest sign ins
+ +
+ + + +
+ +
Never signed in.
+ +
+ +
+ Audit log + + Your account + + + + + + +
+ + isset(userRoles()[$role_id]) ? $role_id : 0, + 'user_config_force_mfa' => 0, +]; + ob_start(); ?> @@ -11,148 +23,12 @@ ob_start();
+
- - - -
- -
- -
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- - - - -
-
- -
- -
- - -
-
- -
- - -
- -
> -
- - -
-
- -
-
- - -
-
- -
- -
- -
- Allow restricts the user to the selected clients (no Allow = full access). Deny blocks a client regardless of Allow. Admin users are unaffected. -
- -
- Set all: - - - -
- -
- - - - - - - - - - - - - - - - - - - - - - - -
ClientNo RuleAllowDeny
- - - - - -
-
- -
- -
- + +
+ +
@@ -160,21 +36,5 @@ ob_start();
- - " . intval($session_user_id)))[0]); + ob_start(); ?> -
-
- -

Incident Response: Agent Password Reset

-
- -
All ITFlow agent passwords will be reset and shown to you (except yours - change yours first!).

You should communicate temporary passwords to agents out of band (e.g. via a phone call) and require they are changed ASAP.
-
- -
-
- -
-
-
- -
-
- - +
+
Incident response
+
+
+ + +
+

Reset the password of every other agent - of them.

+
    +
  • Each gets a new password, shown to you once on the next page - give them out by phone, not email, and have them changed.
    • +
  • Their remembered browsers are forgotten, so anyone with MFA is asked for a code again.
    • +
  • Not yours - change your own first, from your account.
    • +
  • Client portal logins are left alone.
    • +
+ + +
+ + + +
+
+
+ + +
+
$user_id ORDER BY user_name ASC"); +while ($row = mysqli_fetch_assoc($sql)) { + $agents[] = $row; +} -$row = mysqli_fetch_assoc($sql); -$user_name = escapeHtml($row['user_name']); -$user_email = escapeHtml($row['user_email']); -$user_avatar = escapeHtml($row['user_avatar']); -$user_initials = escapeHtml(initials($user_name)); - -$sql_related_tickets = mysqli_query($mysqli, "SELECT 1 FROM tickets - WHERE ticket_assigned_to = $user_id AND ticket_resolved_at IS NULL AND ticket_closed_at IS NULL"); - -$ticket_count = mysqli_num_rows($sql_related_tickets); - -// Related Recurring Tickets Query -$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT 1 FROM recurring_tickets WHERE recurring_ticket_assigned_to = $user_id"); - -$recurring_ticket_count = mysqli_num_rows($sql_related_recurring_tickets); - -// Generate the HTML form content using output buffering. ob_start(); + ?>
-
Archiving user: -
+
Archive
+
- - -
- - "> - - - - - - -
- - -
- -
- - +
+ +
+
+
·
+ +
You can't archive yourself.
+ +
The only active admin - archived, there would be nobody to run ITFlow. Make someone else an admin first.
+ +
    +
  • They're signed out, and can't sign in.
    • +
  • Their password and their copy of the credential vault key are wiped - restoring them sets a new password.
    • +
  • Everything they did stays, under their name.
    • +
+ + +
+ + +
+
Each ticket's history says who it went to, and why.
+
- + + +
diff --git a/admin/modals/user/user_bulk_role.php b/admin/modals/user/user_bulk_role.php new file mode 100644 index 000000000..1d458b4a7 --- /dev/null +++ b/admin/modals/user/user_bulk_role.php @@ -0,0 +1,45 @@ + +
+
Role for user
+ +
+
+ + + +
+ +
+ + +
+
The only active admin keeps an admin role, so there is always someone to run ITFlow.
+
+
+ + +
+
+ + -
-
Editing user: -
+
-
- - +
- - - -
- -
- -
- -
- - "> - - - - - - -
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- - - - -
-
- -
- -
- - -
-
- -
- - -
- -
-
- > - -
-
- - - -
- -
- - -
-
- - -
- -
- -
- Allow restricts the user to the selected clients (no Allow = full access). Deny blocks a client regardless of Allow. Admin users are unaffected. -
- -
- Set all: - - - -
- -
- - - - - - - - - - - - - - - - - - - - - - - -
ClientNo RuleAllowDeny
- > - - > - - > -
-
-
- -
- +

That's you - change your own details, password and MFA from your account, so you can't lock yourself out from here.

- - +
-
+ +
+ + - +
+ +
+
+ + +
+
+
- +
- - + +
- +
- + + +
+
+ +
+ +
+
diff --git a/admin/modals/user/user_form.php b/admin/modals/user/user_form.php new file mode 100644 index 000000000..bf6a33520 --- /dev/null +++ b/admin/modals/user/user_form.php @@ -0,0 +1,377 @@ + [], 'deny' => []]; + +// Every client - and an archived one only when it has a rule, so saving does not drop it. Those with a rule first. +$form_clients = []; +$sql = mysqli_query($mysqli, "SELECT client_id, client_name, client_abbreviation, client_archived_at FROM clients + WHERE client_archived_at IS NULL OR client_id IN (SELECT client_id FROM user_client_permissions WHERE user_id = $form_user_id) + ORDER BY client_id IN (SELECT client_id FROM user_client_permissions WHERE user_id = $form_user_id) DESC, client_archived_at IS NOT NULL, client_name ASC"); +while ($row = mysqli_fetch_assoc($sql)) { + $form_clients[] = $row; +} + +$value = function ($key) use ($form) { + return escapeHtml($form[$key] ?? ''); +}; + +?> + + + +
+ + +
+
+ +
+ +
+ + +
+
+ JPG, PNG, GIF or WebP, up to 5 MB. Without one, their initials. + +
+ + +
+ +
+
+
+ +
+
+ +
+ + data-user-name> +
+
+
+ +
+ + +
+ +
Changed, they sign in with the new one - the old address is told.
+ +
+
+ +
+ + +
+
What they can see and change. Roles
+
+
+
+ + +
+
+
+ +
+ + data-user-password> + + + +
+
+ + Give it to them yourself, or have it emailed - either way, they should change it once they're in. + + Set, they're emailed that it changed. It also unlocks their copy of the credential vault, so it is set here rather than reset by email. + +
+
+ + +
+ +
+ + +
The address, the password and where to sign in.
+
+ +
Mail isn't set up, so nothing is emailed - give them their password yourself.
+ +
+ + +
+
+
+ Multi-factor authentication + +
+
+ > + +
Without it set up, they set it up at their next sign in - and they cannot turn it off.
+
+ +
+ + +
For a lost or replaced phone - their authenticator app is forgotten, and so are their remembered browsers.
+
+ +
+
+
+
+ + +
+ + + + +
+
+ Only limits them to those clients - with none, they see every client. + Never keeps them out of a client, whatever else is set. +
+
+
+ + +
+
+ + + +
+ +
+ +
+ + + + + + + + + + + + +
+ + Archived + +
+ > + + > + + > + +
+
No clients yet.
+
+
+
+ +
+ + diff --git a/admin/modals/user/user_invite.php b/admin/modals/user/user_invite.php deleted file mode 100644 index 9a606a5bd..000000000 --- a/admin/modals/user/user_invite.php +++ /dev/null @@ -1,43 +0,0 @@ - -
-
Invite User
- -
-
- -
- -
- -
- - -
-
- -
- -
- - -
-
- -
-
- - -
-
- - $user_id")); -$sql = mysqli_query($mysqli, "SELECT user_avatar, user_email, user_name, user_role_id FROM users WHERE user_id = $user_id AND user_archived_at IS NOT NULL LIMIT 1"); - -$row = mysqli_fetch_assoc($sql); -$user_name = str_replace(" (archived)", "", $row['user_name']); //Removed (archived) from user_name -$user_name = escapeHtml($user_name); -$user_email = escapeHtml($row['user_email']); -$user_avatar = escapeHtml($row['user_avatar']); -$user_initials = initials($user_name); -$user_role_id = intval($row['user_role_id']); - -// Generate the HTML form content using output buffering. ob_start(); + ?>
-
Restoring user: -
+
Restore
+
- - -
- - "> - - - - - - -
- -
- -
- - - +
+ +
+
+
· archived
+ +
+ + +
signs in to another account now - change that one's email first.
+ +
- +
- + + + + + +
+
Their old password was wiped when they were archived - give them this one, and have them change it.
+
+ +
+ +
+
-
@@ -75,5 +75,17 @@ ob_start();
+ + " . $row['user_name'] . " is the only active admin - $what would leave nobody to run ITFlow. Make someone else an admin first.", 'error'); + redirect(); + } +} + if (isset($_POST['add_user'])) { validateCSRFToken(); @@ -15,97 +30,57 @@ if (isset($_POST['add_user'])) { redirect(); } - require_once 'user_model.php'; - - $password = password_hash(trim($_POST['password']), PASSWORD_DEFAULT); - $user_specific_encryption_ciphertext = encryptUserSpecificKey(trim($_POST['password'])); - - mysqli_query($mysqli, "INSERT INTO users SET user_name = '$name', user_email = '$email', user_password = '$password', user_specific_encryption_ciphertext = '$user_specific_encryption_ciphertext', user_role_id = $role"); + $error = ''; + $identity = userCheckIdentity($_POST, 0, $error); + $role = $identity ? userCheckRole($_POST['role'] ?? 0, 0, $error) : null; + $password = (string) ($_POST['password'] ?? ''); + if ($role && ($problem = userPasswordProblem($password))) { + $error = $problem; + } + if (!$identity || !$role || $error !== '') { + flashAlert($error, 'error'); + redirect(); + } + [$name, $email] = $identity; + $role_id = intval($role['role_id']); + mysqli_query($mysqli, "INSERT INTO users SET user_name = '" . escapeSql($name) . "', user_email = '" . escapeSql($email) . "', user_password = '', user_role_id = $role_id"); $user_id = mysqli_insert_id($mysqli); + userSetPassword($user_id, $password); - // Add Client Access (allow / deny per client) - if (isset($_POST['client_permission'])) { - foreach ($_POST['client_permission'] as $perm_client_id => $perm_type) { - $perm_client_id = intval($perm_client_id); - if ($perm_type === 'allow' || $perm_type === 'deny') { - mysqli_query($mysqli, "INSERT INTO user_client_permissions SET user_id = $user_id, client_id = $perm_client_id, permission_type = '$perm_type'"); - } - } - } - - if (!file_exists("../uploads/users/$user_id/")) { - mkdir("../uploads/users/$user_id"); - } - - // Check for and process image/photo - $extended_alert_description = ''; - if (isset($_FILES['file']['tmp_name'])) { - if ($new_file_name = checkFileUpload($_FILES['file'], array('jpg', 'jpeg', 'gif', 'png', 'webp'))) { - - $file_tmp_path = $_FILES['file']['tmp_name']; - - // directory in which the uploaded file will be moved - $upload_file_dir = "../uploads/users/$user_id/"; - $dest_path = $upload_file_dir . $new_file_name; - move_uploaded_file($file_tmp_path, $dest_path); - - // Set Avatar - mysqli_query($mysqli, "UPDATE users SET user_avatar = '$new_file_name' WHERE user_id = $user_id"); - $extended_alert_description = '. File successfully uploaded.'; - } - } - - // Create Settings + $force_mfa = !empty($_POST['force_mfa']) ? 1 : 0; mysqli_query($mysqli, "INSERT INTO user_settings SET user_id = $user_id, user_config_force_mfa = $force_mfa"); - $sql = mysqli_query($mysqli,"SELECT company_name FROM companies WHERE company_id = 1"); - $row = mysqli_fetch_assoc($sql); - $company_name = escapeSql($row['company_name']); - - // Sanitize Config vars from load_global_settings.php - $config_mail_from_name = escapeSql($config_mail_from_name); - $config_mail_from_email = escapeSql($config_mail_from_email); - $config_ticket_from_email = escapeSql($config_ticket_from_email); - $config_login_key_secret = mysqli_real_escape_string($mysqli, $config_login_key_secret); - $config_base_url = escapeSql($config_base_url); - - // Send user e-mail, if specified - if (isset($_POST['send_email']) && !empty($config_smtp_host) && filter_var($email, FILTER_VALIDATE_EMAIL)) { - - $password = mysqli_real_escape_string($mysqli, $_POST['password']); - - // Only hand out the login key when the gate is actually enabled - same test as post/logout.php - $login_url = "https://$config_base_url/login.php"; - if ($config_login_key_required == 1) { - $login_url .= "?key=$config_login_key_secret"; - } - - $subject = "Your new $company_name ITFlow account"; - $body = "Hello $name,

An ITFlow account has been setup for you. Please change your password upon login.

Username: $email
Password: $password
Login URL: $login_url

--
$company_name - Support
$config_ticket_from_email"; - - $data = [ - [ - 'from' => $config_mail_from_email, - 'from_name' => $config_mail_from_name, - 'recipient' => $email, - 'recipient_name' => $name, - 'subject' => $subject, - 'body' => $body - ] - ]; - $mail = addToMailQueue($data); - - if ($mail !== true) { - mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Mail', notification = 'Failed to send email to $email'"); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Mail', log_action = 'Error', log_description = 'Failed to send email to $email regarding $subject. $mail', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $user_id"); - } - + if (!intval($role['role_is_admin'])) { + userSetClientAccess($user_id, $_POST['client_permission'] ?? []); } - logAudit("User", "Create", "$session_name created user $name", 0, $user_id); + $notes = []; + $avatar_error = ''; + if (!empty($_FILES['avatar']['tmp_name']) && !userSaveAvatar($user_id, $_FILES['avatar'], $avatar_error)) { + $notes[] = $avatar_error . ' The user was created without one'; + } - flashAlert("User $name created" . $extended_alert_description); + // Their sign in details by email - the password goes as typed, so it is theirs to change + if (!empty($_POST['send_email']) && !empty($config_smtp_host)) { + $company_name = (string) mysqli_fetch_row(mysqli_query($mysqli, "SELECT company_name FROM companies WHERE company_id = 1"))[0]; + $login_url = "https://$config_base_url/login.php" . ($config_login_key_required == 1 ? "?key=$config_login_key_secret" : ''); + $mail = userQueueMail($email, $name, "Your new $company_name ITFlow account", + 'Hello ' . escapeHtml($name) . ',

An ITFlow account has been set up for you. Please change your password after you sign in' + . ($force_mfa ? ', and have an authenticator app ready - you will set up multi-factor authentication the first time' : '') . '.

' + . 'Email: ' . escapeHtml($email) . '
Password: ' . escapeHtml($password) . '
Sign in at: ' . escapeHtml($login_url) + . '

--
' . escapeHtml($company_name) . ' - Support
' . escapeHtml($config_ticket_from_email)); + if ($mail === true) { + $notes[] = 'their sign in details were emailed to them'; + } else { + $notes[] = 'the email with their sign in details could not be queued'; + logApp('Mail', 'error', 'Failed to queue the new account email for ' . $email . ": $mail"); + } + } + + logAudit("User", "Create", "$session_name created user " . escapeSql($name), 0, $user_id); + + flashAlert("User $name created" . ($notes ? ' - ' . implode('; ', $notes) : ''), $avatar_error ? 'warning' : 'success'); redirect(); @@ -115,80 +90,62 @@ if (isset($_POST['edit_user'])) { validateCSRFToken(); - require_once 'user_model.php'; + $row = userForRequest($_POST['user_id'] ?? 0); + $user_id = intval($row['user_id']); - $user_id = intval($_POST['user_id']); + $error = ''; + $identity = userCheckIdentity($_POST, $user_id, $error); + $role = $identity ? userCheckRole($_POST['role'] ?? 0, $row['user_role_id'], $error) : null; + $new_password = (string) ($_POST['new_password'] ?? ''); + if ($role && $new_password !== '' && ($problem = userPasswordProblem($new_password))) { + $error = $problem; + } + if (!$identity || !$role || $error !== '') { + flashAlert($error, 'error'); + redirect(); + } + [$name, $email] = $identity; + if (intval($row['role_is_admin']) && !intval($role['role_is_admin'])) { + userGuardLastAdmin($row, 'a role without admin'); + } - $new_password = trim($_POST['new_password']); + mysqli_query($mysqli, "UPDATE users SET user_name = '" . escapeSql($name) . "', user_email = '" . escapeSql($email) . "', user_role_id = " . intval($role['role_id']) . " WHERE user_id = $user_id"); + $force_mfa = !empty($_POST['force_mfa']) ? 1 : 0; + mysqli_query($mysqli, "INSERT INTO user_settings SET user_id = $user_id, user_config_force_mfa = $force_mfa ON DUPLICATE KEY UPDATE user_config_force_mfa = $force_mfa"); - // Update Client Access (allow / deny per client) - mysqli_query($mysqli,"DELETE FROM user_client_permissions WHERE user_id = $user_id"); - if (isset($_POST['client_permission'])) { - foreach ($_POST['client_permission'] as $perm_client_id => $perm_type) { - $perm_client_id = intval($perm_client_id); - if ($perm_type === 'allow' || $perm_type === 'deny') { - mysqli_query($mysqli, "INSERT INTO user_client_permissions SET user_id = $user_id, client_id = $perm_client_id, permission_type = '$perm_type'"); - } + // An admin sees every client - their rules are left as they were, in case the role changes back + if (!intval($role['role_is_admin']) && isset($_POST['client_permission_shown'])) { + userSetClientAccess($user_id, $_POST['client_permission'] ?? []); + } + + $changes = []; + if ($new_password !== '') { + userSetPassword($user_id, $new_password); + $changes[] = 'password changed'; + userNotifyChange($name, $email, 'an administrator set a new password'); + } + if (!empty($_POST['reset_mfa']) && trim((string) $row['user_token']) !== '') { + userResetMfa($user_id); + $changes[] = 'MFA reset'; + userNotifyChange($name, $email, 'an administrator turned off multi-factor authentication' . ($force_mfa ? ' - you will set it up again at your next sign in' : '')); + } + if (strcasecmp($email, $row['user_email']) !== 0) { + $changes[] = 'email changed'; + userNotifyChange($name, $row['user_email'], 'its email address is now ' . $email); + } + $avatar_error = ''; + if (!empty($_POST['remove_avatar'])) { + userRemoveAvatar($user_id); + $changes[] = 'avatar removed'; + } elseif (!empty($_FILES['avatar']['tmp_name'])) { + if (userSaveAvatar($user_id, $_FILES['avatar'], $avatar_error)) { + $changes[] = 'avatar updated'; } } - // Get current Avatar - $sql = mysqli_query($mysqli, "SELECT user_avatar FROM users WHERE user_id = $user_id"); - $row = mysqli_fetch_assoc($sql); - $existing_file_name = escapeSql($row['user_avatar']); + logAudit("User", "Edit", "$session_name edited user " . escapeSql($name) . ($changes ? ' - ' . escapeSql(implode(', ', $changes)) : ''), 0, $user_id); - $extended_log_description = ''; - if (!empty($_POST['2fa'])) { - $two_fa = $_POST['2fa']; - } - - if (!file_exists("../uploads/users/$user_id/")) { - mkdir("../uploads/users/$user_id"); - } - - // Check for and process image/photo - $extended_alert_description = ''; - if (isset($_FILES['file']['tmp_name'])) { - if ($new_file_name = checkFileUpload($_FILES['file'], array('jpg', 'jpeg', 'gif', 'png', 'webp'))) { - - $file_tmp_path = $_FILES['file']['tmp_name']; - - // directory in which the uploaded file will be moved - $upload_file_dir = "../uploads/users/$user_id/"; - $dest_path = $upload_file_dir . $new_file_name; - move_uploaded_file($file_tmp_path, $dest_path); - - // Delete old file - unlink("../uploads/users/$user_id/$existing_file_name"); - - // Set Avatar - mysqli_query($mysqli, "UPDATE users SET user_avatar = '$new_file_name' WHERE user_id = $user_id"); - $extended_alert_description = '. File successfully uploaded.'; - - } - } - - mysqli_query($mysqli, "UPDATE users SET user_name = '$name', user_email = '$email', user_role_id = $role WHERE user_id = $user_id"); - - if (!empty($new_password)) { - $new_password = password_hash($new_password, PASSWORD_DEFAULT); - $user_specific_encryption_ciphertext = encryptUserSpecificKey(trim($_POST['new_password'])); - mysqli_query($mysqli, "UPDATE users SET user_password = '$new_password', user_specific_encryption_ciphertext = '$user_specific_encryption_ciphertext' WHERE user_id = $user_id"); - //Extended Logging - $extended_log_description .= ", password changed"; - } - - if (!empty($two_fa) && $two_fa == 'disable') { - mysqli_query($mysqli, "UPDATE users SET user_token = '' WHERE user_id = '$user_id'"); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'User', log_action = 'Modify', log_description = '$session_name disabled 2FA for $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); - } - - //Update User Settings - mysqli_query($mysqli, "UPDATE user_settings SET user_config_force_mfa = $force_mfa WHERE user_id = $user_id"); - - logAudit("User", "Edit", "$session_name edited user $name", 0, $user_id); - - flashAlert("User $name updated" . $extended_alert_description); + flashAlert("User $name saved" . ($changes ? ' - ' . implode(', ', $changes) : '') . ($avatar_error ? ". $avatar_error" : ''), $avatar_error ? 'warning' : 'success'); redirect(); @@ -198,22 +155,20 @@ if (isset($_GET['activate_user'])) { validateCSRFToken(); - $user_id = intval($_GET['activate_user']); + $row = userForRequest($_GET['activate_user']); + $user_id = intval($row['user_id']); // Only a user who isn't already using a seat can push the count over the limit - $seat_row = mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(user_id) FROM users WHERE user_id = $user_id AND user_type = 1 AND user_status = 1 AND user_archived_at IS NULL")); - if (intval($seat_row[0]) === 0 && agentUserLimitReached()) { + if ((intval($row['user_status']) !== 1 || $row['user_archived_at']) && agentUserLimitReached()) { flashAlert(agentUserLimitMessage(), 'error'); redirect(); } - $user_name = escapeSql(getFieldById('users', $user_id, 'user_name')); - mysqli_query($mysqli, "UPDATE users SET user_status = 1 WHERE user_id = $user_id"); - logAudit("User", "Activate", "$session_name activated user $user_name", 0, $user_id); + logAudit("User", "Activate", "$session_name activated user " . escapeSql($row['user_name']), 0, $user_id); - flashAlert("User $user_name activated"); + flashAlert("User " . $row['user_name'] . " can sign in again"); redirect(); @@ -223,30 +178,16 @@ if (isset($_GET['disable_user'])) { validateCSRFToken(); - $user_id = intval($_GET['disable_user']); - - $user_name = escapeSql(getFieldById('users', $user_id, 'user_name')); + $row = userForRequest($_GET['disable_user']); + $user_id = intval($row['user_id']); + userGuardLastAdmin($row, 'disabling them'); mysqli_query($mysqli, "UPDATE users SET user_status = 0 WHERE user_id = $user_id"); + userHandOverWork($user_id, 0, 'when ' . escapeSql($row['user_name']) . ' was disabled'); - // Un-assign tickets. Collect them first so each one gets a history entry - - // otherwise a whole queue silently goes unassigned with nothing to explain it - $affected_ticket_ids = array(); - $sql_affected_tickets = mysqli_query($mysqli, "SELECT ticket_id FROM tickets WHERE ticket_assigned_to = $user_id AND ticket_closed_at IS NULL"); - while ($affected_ticket_row = mysqli_fetch_assoc($sql_affected_tickets)) { - $affected_ticket_ids[] = intval($affected_ticket_row['ticket_id']); - } + logAudit("User", "Disable", "$session_name disabled user " . escapeSql($row['user_name']), 0, $user_id); - mysqli_query($mysqli, "UPDATE tickets SET ticket_assigned_to = 0 WHERE ticket_assigned_to = $user_id AND ticket_closed_at IS NULL"); - mysqli_query($mysqli, "UPDATE recurring_tickets SET recurring_ticket_assigned_to = 0 WHERE recurring_ticket_assigned_to = $user_id"); - - foreach ($affected_ticket_ids as $affected_ticket_id) { - logTicketHistory($affected_ticket_id, "$session_name unassigned the ticket when $user_name was disabled"); - } - - logAudit("User", "Disable", "$session_name disabled user $user_name", 0, $user_id); - - flashAlert("User $user_name disabled", 'error'); + flashAlert("User " . $row['user_name'] . " disabled - they are signed out, and their open tickets are unassigned", 'error'); redirect(); @@ -256,15 +197,32 @@ if (isset($_GET['revoke_remember_me'])) { validateCSRFToken(); - $user_id = intval($_GET['revoke_remember_me']); - - $user_name = escapeSql(getFieldById('users', $user_id, 'user_name')); + $row = userForRequest($_GET['revoke_remember_me']); + $user_id = intval($row['user_id']); mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_user_id = $user_id"); - logAudit("User", "Edit", "$session_name revoked all remember me tokens for user $user_name", 0, $user_id); + logAudit("User", "Edit", "$session_name revoked all remember me tokens for user " . escapeSql($row['user_name']), 0, $user_id); - flashAlert("User $user_name remember me tokens revoked", 'error'); + flashAlert("Remembered browsers forgotten for " . $row['user_name'] . " - every browser asks for their MFA code again"); + + redirect(); + +} + +if (isset($_GET['reset_user_mfa'])) { + + validateCSRFToken(); + + $row = userForRequest($_GET['reset_user_mfa']); + $user_id = intval($row['user_id']); + + userResetMfa($user_id); + userNotifyChange($row['user_name'], $row['user_email'], 'an administrator turned off multi-factor authentication' . (intval($row['user_config_force_mfa']) ? ' - you will set it up again at your next sign in' : '')); + + logAudit("User", "Edit", "$session_name reset MFA for user " . escapeSql($row['user_name']), 0, $user_id); + + flashAlert("MFA reset for " . $row['user_name'] . "" . (intval($row['user_config_force_mfa']) ? ' - they set it up again at their next sign in' : ' - they sign in with their password alone until they turn it on')); redirect(); @@ -274,38 +232,26 @@ if (isset($_POST['archive_user'])) { validateCSRFToken(); - $user_id = intval($_POST['user_id']); - $ticket_assign = intval($_POST['ticket_assign']); - $password = password_hash(randomString(), PASSWORD_DEFAULT); + $row = userForRequest($_POST['user_id'] ?? 0); + $user_id = intval($row['user_id']); + userGuardLastAdmin($row, 'archiving them'); - $user_name = escapeSql(getFieldById('users', $user_id, 'user_name')); - - // Un-assign / Re-assign tickets. Same as above - collect them first so the - // move shows up on each ticket's history - $affected_ticket_ids = array(); - $sql_affected_tickets = mysqli_query($mysqli, "SELECT ticket_id FROM tickets WHERE ticket_assigned_to = $user_id AND ticket_closed_at IS NULL AND ticket_resolved_at IS NULL"); - while ($affected_ticket_row = mysqli_fetch_assoc($sql_affected_tickets)) { - $affected_ticket_ids[] = intval($affected_ticket_row['ticket_id']); + // Their work to an active agent, or to nobody + $to_user_id = intval($_POST['ticket_assign'] ?? 0); + if ($to_user_id && ($to_user_id === $user_id || !mysqli_num_rows(mysqli_query($mysqli, "SELECT 1 FROM users WHERE user_id = $to_user_id AND user_type = 1 AND user_status = 1 AND user_archived_at IS NULL")))) { + $to_user_id = 0; } + userHandOverWork($user_id, $to_user_id, 'when ' . escapeSql($row['user_name']) . ' was archived'); - mysqli_query($mysqli, "UPDATE tickets SET ticket_assigned_to = $ticket_assign WHERE ticket_assigned_to = $user_id AND ticket_closed_at IS NULL AND ticket_resolved_at IS NULL"); - mysqli_query($mysqli, "UPDATE recurring_tickets SET recurring_ticket_assigned_to = $ticket_assign WHERE recurring_ticket_assigned_to = $user_id"); + // They can no longer sign in, and their copy of the vault key is gone - restoring sets a new password + $archived_name = escapeSql(mb_substr($row['user_name'], 0, 189) . ' (archived)'); + $scrambled = escapeSql(password_hash(randomString(), PASSWORD_DEFAULT)); + mysqli_query($mysqli, "UPDATE users SET user_name = '$archived_name', user_password = '$scrambled', user_status = 0, user_specific_encryption_ciphertext = '', user_archived_at = NOW() WHERE user_id = $user_id"); + mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_user_id = $user_id"); - $reassigned_to_name = $ticket_assign ? escapeSql(getFieldById('users', $ticket_assign, 'user_name')) : ''; - foreach ($affected_ticket_ids as $affected_ticket_id) { - if ($reassigned_to_name) { - logTicketHistory($affected_ticket_id, "$session_name reassigned the ticket to $reassigned_to_name when $user_name was archived"); - } else { - logTicketHistory($affected_ticket_id, "$session_name unassigned the ticket when $user_name was archived"); - } - } + logAudit("User", "Archive", "$session_name archived user " . escapeSql($row['user_name']), 0, $user_id); - // Archive user query - mysqli_query($mysqli, "UPDATE users SET user_name = '$user_name (archived)', user_password = '$password', user_status = 0, user_specific_encryption_ciphertext = '', user_archived_at = NOW() WHERE user_id = $user_id"); - - logAudit("User", "Archive", "$session_name archived user $user_name", 0, $user_id); - - flashAlert("User $user_name archived", 'error'); + flashAlert("User " . $row['user_name'] . " archived" . ($to_user_id ? ' - their open tickets went to ' . getFieldById('users', $to_user_id, 'user_name') : ''), 'error'); redirect(); @@ -315,34 +261,133 @@ if (isset($_POST['restore_user'])) { validateCSRFToken(); - $user_id = intval($_POST['user_id']); + $row = userForRequest($_POST['user_id'] ?? 0); + $user_id = intval($row['user_id']); - // Only a user who isn't already using a seat can push the count over the limit - $seat_row = mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(user_id) FROM users WHERE user_id = $user_id AND user_type = 1 AND user_status = 1 AND user_archived_at IS NULL")); - if (intval($seat_row[0]) === 0 && agentUserLimitReached()) { + if (agentUserLimitReached()) { flashAlert(agentUserLimitMessage(), 'error'); redirect(); } - $new_password = trim($_POST['new_password']); - $role = intval($_POST['role']); - $user_name = getFieldById('users', $user_id, 'user_name'); - $user_name = escapeSql(str_replace(" (archived)", "", $user_name)); //Removed (archived) from user_name - - // Restore user query - mysqli_query($mysqli, "UPDATE users SET user_name = '$user_name', user_status = 1, user_role_id = $role, user_archived_at = NULL WHERE user_id = $user_id"); - - if (!empty($new_password)) { - $new_password = password_hash($new_password, PASSWORD_DEFAULT); - $user_specific_encryption_ciphertext = encryptUserSpecificKey(trim($_POST['new_password'])); - mysqli_query($mysqli, "UPDATE users SET user_password = '$new_password', user_specific_encryption_ciphertext = '$user_specific_encryption_ciphertext' WHERE user_id = $user_id"); - //Extended Logging - $extended_log_description .= ", password changed"; + $error = ''; + $role = userCheckRole($_POST['role'] ?? 0, $row['user_role_id'], $error); + $password = (string) ($_POST['new_password'] ?? ''); + if ($role && ($problem = userPasswordProblem($password))) { + $error = $problem; + } + $name = trim(str_replace(' (archived)', '', $row['user_name'])); + if ($role && mysqli_num_rows(mysqli_query($mysqli, "SELECT 1 FROM users WHERE user_email = '" . escapeSql($row['user_email']) . "' AND user_archived_at IS NULL AND user_id <> $user_id"))) { + $error = '' . $row['user_email'] . ' signs in to another account now - change that one\'s email first.'; + } + if (!$role || $error !== '') { + flashAlert($error, 'error'); + redirect(); } - logAudit("User", "Restored", "$session_name restored user $user_name", 0, $user_id); + mysqli_query($mysqli, "UPDATE users SET user_name = '" . escapeSql($name) . "', user_status = 1, user_role_id = " . intval($role['role_id']) . ", user_archived_at = NULL WHERE user_id = $user_id"); + userSetPassword($user_id, $password); - flashAlert("User $user_name restored"); + logAudit("User", "Restore", "$session_name restored user " . escapeSql($name), 0, $user_id); + + flashAlert("User $name restored - give them their new password"); + + redirect(); + +} + +if (isset($_POST['bulk_role_users'])) { + + validateCSRFToken(); + + $error = ''; + $role = userCheckRole($_POST['role'] ?? 0, 0, $error); + if (!$role) { + flashAlert($error, 'error'); + redirect(); + } + + $count = 0; + $kept = []; + foreach (usersForBulk() as $user_id => $row) { + if (intval($row['role_is_admin']) && !intval($role['role_is_admin']) && userIsLastAdmin($row)) { + $kept[] = $row['user_name']; + continue; + } + mysqli_query($mysqli, "UPDATE users SET user_role_id = " . intval($role['role_id']) . " WHERE user_id = $user_id"); + logAudit("User", "Edit", "$session_name set the role of user " . escapeSql($row['user_name']) . " to " . escapeSql($role['role_name']), 0, $user_id); + $count++; + } + + flashAlert("$count user" . ($count === 1 ? '' : 's') . " now " . ($count === 1 ? 'has' : 'have') . " the " . $role['role_name'] . " role" . ($kept ? ' - ' . implode(', ', $kept) . ' kept theirs, as the only admin' : ''), $kept ? 'warning' : 'success'); + + redirect(); + +} + +if (isset($_POST['bulk_require_mfa_users']) || isset($_POST['bulk_unrequire_mfa_users'])) { + + validateCSRFToken(); + + $force = isset($_POST['bulk_require_mfa_users']) ? 1 : 0; + $count = 0; + foreach (usersForBulk() as $user_id => $row) { + mysqli_query($mysqli, "INSERT INTO user_settings SET user_id = $user_id, user_config_force_mfa = $force ON DUPLICATE KEY UPDATE user_config_force_mfa = $force"); + logAudit("User", "Edit", "$session_name " . ($force ? 'required' : 'stopped requiring') . " MFA for user " . escapeSql($row['user_name']), 0, $user_id); + $count++; + } + + flashAlert(($force ? "MFA required for" : "MFA no longer required for") . " $count user" . ($count === 1 ? '' : 's') . ($force ? ' - anyone without it sets it up at their next sign in' : '')); + + redirect(); + +} + +if (isset($_POST['bulk_revoke_remember_users'])) { + + validateCSRFToken(); + + $count = 0; + foreach (usersForBulk() as $user_id => $row) { + mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_user_id = $user_id"); + logAudit("User", "Edit", "$session_name revoked all remember me tokens for user " . escapeSql($row['user_name']), 0, $user_id); + $count++; + } + + flashAlert("Remembered browsers forgotten for $count user" . ($count === 1 ? '' : 's')); + + redirect(); + +} + +if (isset($_POST['bulk_disable_users']) || isset($_POST['bulk_activate_users'])) { + + validateCSRFToken(); + + $activate = isset($_POST['bulk_activate_users']); + $count = 0; + $kept = []; + foreach (usersForBulk() as $user_id => $row) { + if ($row['user_archived_at'] || intval($row['user_status']) === ($activate ? 1 : 0)) { + continue; + } + if ($activate && agentUserLimitReached()) { + $kept[] = $row['user_name']; + continue; + } + if (!$activate && userIsLastAdmin($row)) { + $kept[] = $row['user_name']; + continue; + } + mysqli_query($mysqli, "UPDATE users SET user_status = " . ($activate ? 1 : 0) . " WHERE user_id = $user_id"); + if (!$activate) { + userHandOverWork($user_id, 0, 'when ' . escapeSql($row['user_name']) . ' was disabled'); + } + logAudit("User", $activate ? "Activate" : "Disable", "$session_name " . ($activate ? 'activated' : 'disabled') . " user " . escapeSql($row['user_name']), 0, $user_id); + $count++; + } + + $why = $activate ? 'the agent user limit is reached' : 'the only admin'; + flashAlert(($activate ? 'Activated' : 'Disabled') . " $count user" . ($count === 1 ? '' : 's') . ($kept ? ' - not ' . implode(', ', $kept) . " ($why)" : ''), $kept ? 'warning' : ($activate ? 'success' : 'error')); redirect(); @@ -359,7 +404,6 @@ if (isExportRequest('export_users')) { // Filters inherited from the users page - mirrors admin/users.php $filter_summary = []; - // Archived Filter if (isset($_POST['archived']) && $_POST['archived'] == 1) { $archive_query = "user_archived_at IS NOT NULL"; $filter_summary['Archived'] = 'Archived only'; @@ -367,23 +411,33 @@ if (isExportRequest('export_users')) { $archive_query = "user_archived_at IS NULL"; } - // Search Filter $q = escapeSql($_POST['q'] ?? ''); - if (!empty($q)) { + if ($q !== '') { $filter_summary['Search'] = $_POST['q']; } - $sql = mysqli_query( - $mysqli, - "SELECT role_name, user_created_at, user_email, user_name, user_status FROM users - LEFT JOIN user_roles ON user_role_id = role_id - WHERE (user_name LIKE '%$q%' OR user_email LIKE '%$q%') - AND user_type = 1 - AND $archive_query - ORDER BY user_name ASC" - ); + $role_query = ''; + $role = userRoles()[intval($_POST['role'] ?? 0)] ?? null; + if ($role) { + $role_query = 'AND user_role_id = ' . intval($role['role_id']); + $filter_summary['Role'] = $role['role_name']; + } - $num_rows = mysqli_num_rows($sql); + $rows = []; + $sql = mysqli_query($mysqli, "SELECT users.user_id, role_name, role_is_admin, user_created_at, user_email, user_name, user_status, user_token, user_config_force_mfa FROM users + LEFT JOIN user_roles ON user_role_id = role_id + LEFT JOIN user_settings ON user_settings.user_id = users.user_id + WHERE (user_name LIKE '%$q%' OR user_email LIKE '%$q%' OR role_name LIKE '%$q%') + AND user_type = 1 + AND $archive_query $role_query + ORDER BY user_name ASC"); + while ($row = mysqli_fetch_assoc($sql)) { + $rows[intval($row['user_id'])] = $row; + } + $logins = userLastLogins(array_keys($rows)); + $access = userClientAccess(array_keys($rows)); + + $num_rows = count($rows); if ($num_rows > 0) { @@ -391,17 +445,11 @@ if (isExportRequest('export_users')) { $export = beginExport('users', $format, "$session_company_name-Users", 'Users', summarizeExportFilters($filter_summary)); - while ($row = mysqli_fetch_assoc($sql)) { - - $user_status = intval($row['user_status']); - if ($user_status == 2) { - $row['user_status_display'] = "Invited"; - } elseif ($user_status == 1) { - $row['user_status_display'] = "Active"; - } else { - $row['user_status_display'] = "Disabled"; - } - + foreach ($rows as $user_id => $row) { + $row['user_status_display'] = USER_STATUSES[intval($row['user_status'])][0] ?? 'Disabled'; + $row['user_mfa_display'] = trim((string) $row['user_token']) !== '' ? 'On' : (intval($row['user_config_force_mfa']) ? 'Required, not set up' : 'Off'); + $row['user_last_login'] = $logins[$user_id]['log_created_at'] ?? 'Never'; + $row['user_client_access'] = userClientAccessText($access[$user_id], intval($row['role_is_admin'])); addExportRow($export, $row); } @@ -416,40 +464,77 @@ if (isExportRequest('export_users')) { if (isset($_POST['ir_reset_user_password'])) { - // Incident response: allow mass reset of agent passwords + // Incident response: every other agent gets a new password, shown once here validateCSRFToken(); // Confirm logged-in user password, for security - $admin_password = $_POST['admin_password']; - $sql = mysqli_query($mysqli, "SELECT user_password FROM users WHERE user_id = $session_user_id"); - $userRow = mysqli_fetch_assoc($sql); - - if (!password_verify($admin_password, $userRow['user_password'])) { - flashAlert("Incorrect password.", 'error'); + $user_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_password FROM users WHERE user_id = $session_user_id")); + if (!password_verify((string) ($_POST['admin_password'] ?? ''), $user_row['user_password'])) { + flashAlert("Incorrect password - nothing was reset.", 'error'); redirect(); } - // Get agents/users, other than the current user - $sql_users = mysqli_query($mysqli, "SELECT user_email, user_id FROM users WHERE (user_archived_at IS NULL AND user_id != $session_user_id)"); - - // Reset passwords + // Agents only - client portal logins have their own reset, and no vault key to rewrite + $reset = []; + $sql_users = mysqli_query($mysqli, "SELECT user_id, user_name, user_email FROM users WHERE user_type = 1 AND user_archived_at IS NULL AND user_id <> $session_user_id ORDER BY user_name"); while ($row = mysqli_fetch_assoc($sql_users)) { - $user_id = intval($row['user_id']); - $user_email = escapeSql($row['user_email']); - $new_password = randomString(); - $user_specific_encryption_ciphertext = encryptUserSpecificKey(trim($new_password)); - - echo $user_email . " -- " . $new_password; // Show - $new_password = password_hash($new_password, PASSWORD_DEFAULT); - - mysqli_query($mysqli, "UPDATE users SET user_password = '$new_password', user_specific_encryption_ciphertext = '$user_specific_encryption_ciphertext' WHERE user_id = $user_id"); - - echo "

"; + $new_password = generateReadablePassword(4); + userSetPassword($row['user_id'], $new_password); + // A remembered browser would skip their MFA code - in an incident, it must not + mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_user_id = " . intval($row['user_id'])); + $reset[] = $row + ['password' => $new_password]; } - logAudit("User", "Edit", "$session_name reset ALL user passwords"); + logAudit("User", "Edit", "$session_name reset the passwords of " . count($reset) . " agent(s) and forgot their remembered browsers (incident response)"); - exit; // Stay on the plain text password page + // Shown once, not kept - a plain page to read out or copy, and nothing else on it + header('Cache-Control: no-store'); + ?> + + + + + + + Incident response - new agent passwords + + + + +
+
+ +
+
New passwords for agent - shown once
+
Give each one to its agent out of band (a phone call, not email), and have them change it. Their remembered browsers were forgotten, so MFA is asked for again. Leave this page and the passwords are gone.
+
+
+
+ + + + + + + + + + + + + + +
AgentEmailNew password
There are no other agents.
+
+
+ + Back to Users +
+
+ + + Users - the agents who sign in to ITFlow. Each row is who + * they are, their role, whether they can sign in and how (MFA, browsers that + * skip the code), the clients they can see and when they last signed in. The + * pills split them: everyone, admins, no MFA, disabled - and the archived. + * + * The admin's own row is shown but not changed here: that is their Account + * pages, so nobody locks themselves out by mistake. + */ + // Default Column Sortby Filter $sort = "user_name"; $order = "ASC"; require_once "includes/inc_all_admin.php"; -$sql = mysqli_query( - $mysqli, - "SELECT SQL_CALC_FOUND_ROWS role_name, user_archived_at, user_avatar, user_config_force_mfa, user_email, - user_settings.user_id, user_name, user_role_id, user_status, user_token FROM users - LEFT JOIN user_roles ON user_role_id = role_id - LEFT JOIN user_settings ON users.user_id = user_settings.user_id - WHERE (user_name LIKE '%$q%' OR user_email LIKE '%$q%') - AND user_type = 1 - AND user_$archive_query - ORDER BY $sort $order LIMIT $record_from, $record_to" -); +// filter_header.php fills in canned_date=custom when no range was asked for - not a filter here, so not carried into links +if (($_GET['canned_date'] ?? '') === 'custom' && empty($_GET['dtf'])) { + unset($_GET['canned_date']); +} + +$roles = userRoles(); +$role_filter = isset($roles[intval($_GET['role'] ?? 0)]) ? intval($_GET['role']) : 0; + +$filters = "user_type = 1 AND (user_name LIKE '%$q%' OR user_email LIKE '%$q%' OR role_name LIKE '%$q%')" . ($role_filter ? " AND user_role_id = $role_filter" : ''); +$joins = "LEFT JOIN user_roles ON user_role_id = role_id + LEFT JOIN user_settings ON user_settings.user_id = users.user_id"; + +// The views +$shows = [ + '' => ['label' => 'Users', 'icon' => 'fa-users', 'where' => 'user_archived_at IS NULL', 'title' => 'Everyone not archived'], + 'admins' => ['label' => 'Admins', 'icon' => 'fa-user-shield', 'where' => 'user_archived_at IS NULL AND role_is_admin = 1', 'title' => 'Every client and every setting'], + 'nomfa' => ['label' => 'No MFA', 'icon' => 'fa-unlock', 'where' => "user_archived_at IS NULL AND user_status = 1 AND (user_token IS NULL OR user_token = '')", 'title' => 'Active, and signing in with a password alone'], + 'disabled' => ['label' => 'Disabled', 'icon' => 'fa-ban', 'where' => 'user_archived_at IS NULL AND user_status <> 1', 'title' => 'Cannot sign in'], + 'archived' => ['label' => 'Archived', 'icon' => 'fa-archive', 'where' => 'user_archived_at IS NOT NULL', 'title' => 'Gone - restore one with a new password'], +]; +$show = isset($shows[$_GET['show'] ?? '']) ? ($_GET['show'] ?? '') : ''; + +// Only these sort - an unknown column would take the page down +$last_login_sql = "(SELECT MAX(log_id) FROM logs WHERE log_user_id = users.user_id AND log_type = 'Login' AND log_action = 'Success')"; +$sortable_columns = [ + 'user_name' => "user_name $order", + 'user_email' => "user_email $order", + 'role_name' => "role_is_admin DESC, role_name $order, user_name ASC", + 'user_status' => "user_status $order, user_name ASC", + 'last_login' => "$last_login_sql IS NULL, $last_login_sql $order, user_name ASC", + 'user_created_at' => "user_created_at $order, user_name ASC", +]; +if (!isset($sortable_columns[$sort])) { + $sort = 'user_name'; +} + +$sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS users.user_id, user_name, user_email, user_status, user_token, user_avatar, user_created_at, user_archived_at, + user_role_id, role_name, role_is_admin, user_config_force_mfa + FROM users $joins + WHERE $filters AND {$shows[$show]['where']} + ORDER BY {$sortable_columns[$sort]}, users.user_id ASC + LIMIT $record_from, $record_to"); $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); +$users = []; +while ($row = mysqli_fetch_assoc($sql)) { + $users[intval($row['user_id'])] = $row; +} +$logins = userLastLogins(array_keys($users)); +$access = userClientAccess(array_keys($users)); +$remembered = userRememberCounts(array_keys($users)); + +// How many in each view, over what the search and role leave +$view_counts = []; +$row = mysqli_fetch_row(mysqli_query($mysqli, "SELECT " . implode(', ', array_map(function ($s) { + return "COALESCE(SUM({$s['where']}), 0)"; +}, $shows)) . " FROM users $joins WHERE $filters")); +foreach (array_keys($shows) as $i => $key) { + $view_counts[$key] = intval($row[$i]); +} + // Agent user limit (set in config.php, 0 / unset = unlimited) $agent_user_limit = getAgentUserLimit(); $agent_user_count = getActiveAgentUserCount(); $agent_user_limit_reached = $agent_user_limit > 0 && $agent_user_count >= $agent_user_limit; +$filter_url = function ($changes) { + $params = array_merge($_GET, $changes); + unset($params['page']); + return '?' . http_build_query(array_filter($params, function ($v) { return $v !== '' && $v !== null; })); +}; + +$sort_link = function ($column, $label) use ($url_query_strings_sort, $sort, $disp, $order_icon) { + return '' + . $label . ($sort === $column ? " $order_icon" : '') . ''; +}; + +$csrf = $_SESSION['csrf_token']; + ?>

Users 0) { ?> - - of agent users + + of seats

- - - -
- - 1) { ?> - - Export - -
- - IR - - + +
+ + Export + + + Roles + + + Security settings + +
+ + Incident response +
+
+
-
+
- - + +
-
-
- "> - Archived - +
+ +
+
+
+
+ +
-
- - "> - - - - - - - - - - - - Invited"; - } elseif ($user_status == 1) { - $user_status_display = "Active"; - } else{ - $user_status_display = "Disabled"; - } - $user_avatar = escapeHtml($row['user_avatar']); - $user_token = escapeHtml($row['user_token']); - if(empty($user_token)) { - $mfa_status_display = ""; - } else { - $mfa_status_display = ""; - } - $user_config_force_mfa = intval($row['user_config_force_mfa']); - $user_role = intval($row['user_role_id']); - $user_role_display = escapeHtml($row['role_name']); - $user_archived_at = escapeHtml($row['user_archived_at']); - $user_initials = escapeHtml(initials($user_name)); + + - - $sql_last_login = mysqli_query( - $mysqli, - "SELECT log_created_at, log_ip, log_user_agent FROM logs - WHERE log_user_id = $user_id AND log_type = 'Login' - ORDER BY log_id DESC LIMIT 1" - ); - if (mysqli_num_rows($sql_last_login) == 0) { - $last_login = "Never logged in"; - } else { - $row = mysqli_fetch_assoc($sql_last_login); - $log_created_at = escapeHtml($row['log_created_at']); - $log_ip = escapeHtml($row['log_ip']); - $log_user_agent = escapeHtml($row['log_user_agent']); - $log_user_os = getOS($log_user_agent); - $log_user_browser = getWebBrowser($log_user_agent); - $last_login = "$log_created_at
$log_user_os
$log_user_browser
$log_ip
"; - } - - // Get User Client Access Permissions - $user_client_access_sql = mysqli_query($mysqli,"SELECT client_id FROM user_client_permissions WHERE user_id = $user_id"); - $client_access_array = []; - while ($row = mysqli_fetch_assoc($user_client_access_sql)) { - $client_access_array[] = intval($row['client_id']); - } - - $sql_remember_tokens = mysqli_query($mysqli, "SELECT 1 FROM remember_tokens WHERE remember_token_user_id = $user_id"); - $remember_token_count = mysqli_num_rows($sql_remember_tokens); - - - - ?> +
+
- - Name - - - - Email - - - - Role - - - - Status - - MFA - Last Login - Action
+ text-nowrap table-light"> - - - - - - - + + + + + + + + + + $row) { + $is_self = $user_id === intval($session_user_id); + $is_archived = !empty($row['user_archived_at']); + $is_active = intval($row['user_status']) === 1 && !$is_archived; + $is_admin = intval($row['role_is_admin']) === 1; + $has_mfa = trim((string) $row['user_token']) !== ''; + $display_name = $is_archived ? trim(str_replace(' (archived)', '', $row['user_name'])) : $row['user_name']; + $name = escapeHtml($display_name); + $quick_url = "modals/user/user.php?id=$user_id"; + $user_access = $access[$user_id]; + $access_title = $is_admin ? 'Admins see every client' : trim( + ($user_access['allow'] ? 'Only: ' . implode(', ', $user_access['allow']) . '. ' : '') + . ($user_access['deny'] ? 'Kept out of: ' . implode(', ', $user_access['deny']) . '.' : '') + ); + $remember_count = $remembered[$user_id] ?? 0; + ?> + + - + - + - ?> + - -
- - class="ajax-modal" - data-modal-url="modals/user/user_edit.php?id=" - - > - - "> - - - - - -
- - -
- - 		- -
- -
- - Edit - - 0) { ?> - Revoke Remember Tokens - - - - - Activate - - - - Disable - - - -
- - Restore - +
+
+ +
+ 		Clients
+
+ + -
- - Archive - +
- - -
+
+ +
+ + You +
+ +
+ +
+
+ + +
+
+
+ 		+ + No role + + + +
-
- + + +
+ + +
+ +
remembered browser
+ + +
+ + + + + + + + + + +
+ +
+ + Quick look + + + Audit log + + + + Your account + + +
+ + Restore + + + + Edit + + + + Reset MFA + + + + + Forget remembered browser + + +
+ + + Disable + + + + Activate + + + + Archive + + +
+
+ + + + + +
+ + +
+ +
+ + No users match. + + Everyone active signs in with MFA. + + No archived users. + + Nobody is disabled. + + No users here. + +
+
+ +
+ + " data-bs-toggle="dropdown">' ?>
0) { ?> - + Export diff --git a/agent/user/includes/mfa_setup.php b/agent/user/includes/mfa_setup.php new file mode 100644 index 000000000..3c9930ad0 --- /dev/null +++ b/agent/user/includes/mfa_setup.php @@ -0,0 +1,38 @@ + +
    +
  1. Open your authenticator app - Microsoft or Google Authenticator, 1Password, Authy, Bitwarden - and add an account.
    2. +
  2. Scan this code:
    3. +
+ +
+ +
+ +
Can't scan it? Type this secret in:
+
+ + +
+
+ +
    +
  1. Enter the 6-digit code it shows:
    2. +
+
+ + +
diff --git a/agent/user/includes/user_side_nav.php b/agent/user/includes/user_side_nav.php index 6184dfa51..222851fcc 100644 --- a/agent/user/includes/user_side_nav.php +++ b/agent/user/includes/user_side_nav.php @@ -11,46 +11,48 @@
+ +
+ +
+
+
+
+
+
- +
- diff --git a/agent/user/mfa_enforcement.php b/agent/user/mfa_enforcement.php index 3a63e4236..90625d190 100644 --- a/agent/user/mfa_enforcement.php +++ b/agent/user/mfa_enforcement.php @@ -12,13 +12,9 @@ $company_logo = escapeHtml($row['company_logo']); // Only generate the token once and store it in session: if (empty($_SESSION['mfa_token'])) { - $token = generateTotpSecret(); - $_SESSION['mfa_token'] = $token; + $_SESSION['mfa_token'] = generateTotpSecret(); } -$token = $_SESSION['mfa_token']; - -// Generate QR Code -$data = "otpauth://totp/ITFlow:$session_email?secret=$token"; +$mfa_secret = $_SESSION['mfa_token']; ?> @@ -65,26 +61,17 @@ $data = "otpauth://totp/ITFlow:$session_email?secret=$token";
diff --git a/agent/user/modals/user_mfa_modal.php b/agent/user/modals/user_mfa_modal.php index 7b0b2126c..f2a10a206 100644 --- a/agent/user/modals/user_mfa_modal.php +++ b/agent/user/modals/user_mfa_modal.php @@ -1,15 +1,17 @@ Security. The secret is made once and + * kept in the session until a code from it is checked, so the modal opening + * again (a wrong code) shows the same one. + */ + +require_once dirname(__DIR__, 3) . '/libs/totp/totp.php'; + if (empty($_SESSION['mfa_token'])) { - $token = generateTotpSecret(); - $_SESSION['mfa_token'] = $token; + $_SESSION['mfa_token'] = generateTotpSecret(); } -$token = $_SESSION['mfa_token']; - -// Generate QR Code -$data = "otpauth://totp/ITFlow:$session_email?secret=$token"; +$mfa_secret = $_SESSION['mfa_token']; ?> @@ -17,30 +19,16 @@ $data = "otpauth://totp/ITFlow:$session_email?secret=$token";
-
Multi-Factor Authentication
+
Turn on multi-factor authentication
- -
- -

Secret: - -

-
- -
-
- - -
-
- +
- +
diff --git a/agent/user/post/profile.php b/agent/user/post/profile.php index 1dcda2bb7..89bb26ffc 100644 --- a/agent/user/post/profile.php +++ b/agent/user/post/profile.php @@ -1,94 +1,68 @@
Your $config_app_name account has been updated, details below:

$details

If you did not perform this change, contact your $config_app_name administrator immediately.

Thanks,
ITFlow
$session_company_name"; - - $data = [ - [ - 'from' => $config_mail_from_email, - 'from_name' => $config_mail_from_name, - 'recipient' => $user_old_email, - 'recipient_name' => $name, - 'subject' => $subject, - 'body' => $body - ] - ]; - $mail = addToMailQueue($data); - } - - // Photo - if (isset($_FILES['avatar']['tmp_name'])) { - if ($new_file_name = checkFileUpload($_FILES['avatar'], array('jpg', 'jpeg', 'gif', 'png', 'webp'))) { - - $file_tmp_path = $_FILES['avatar']['tmp_name']; - - // directory in which the uploaded file will be moved - $upload_file_dir = "../../uploads/users/$session_user_id/"; - $dest_path = $upload_file_dir . $new_file_name; - - if (!file_exists("$upload_file_dir")) { - mkdir("$upload_file_dir"); - } - - move_uploaded_file($file_tmp_path, $dest_path); - - // Delete old file - unlink("../../uploads/users/$session_user_id/$existing_file_name"); - - // Set Avatar - mysqli_query($mysqli,"UPDATE users SET user_avatar = '$new_file_name' WHERE user_id = $session_user_id"); - - // Extended Logging - $extended_log_description .= ", avatar updated"; - - } - } - - mysqli_query($mysqli,"UPDATE users SET user_name = '$name', user_email = '$email' WHERE user_id = $session_user_id"); - - mysqli_query($mysqli,"UPDATE user_settings SET user_config_signature = '$signature' WHERE user_id = $session_user_id"); - - logAudit("User Account", "Edit", "$session_name edited their account $extended_log_description"); - - flashAlert("User details updated"); - - if ($logout) { - redirect('post.php?logout'); - } else { + $error = ''; + $identity = userCheckIdentity($_POST, $session_user_id, $error); + if (!$identity) { + flashAlert($error, 'error'); redirect(); } + [$name, $email] = $identity; + + $email_changed = strcasecmp($email, $me['user_email']) !== 0; + if ($email_changed && !userCurrentPasswordOk($_POST['current_password'] ?? '')) { + flashAlert('Your email signs you in - enter your current password to change it.', 'error'); + redirect(); + } + + // The signature goes on emailed replies - kept to HTML that is safe to send + $signature = mysqli_real_escape_string($mysqli, documentHtmlPurify((string) ($_POST['signature'] ?? ''))); + + mysqli_query($mysqli, "UPDATE users SET user_name = '" . escapeSql($name) . "', user_email = '" . escapeSql($email) . "' WHERE user_id = $session_user_id"); + mysqli_query($mysqli, "INSERT INTO user_settings SET user_id = $session_user_id, user_config_signature = '$signature' ON DUPLICATE KEY UPDATE user_config_signature = '$signature'"); + + $changes = []; + if ($email_changed) { + userNotifyChange($name, $me['user_email'], 'its email address is now ' . $email); + $changes[] = 'email changed'; + } + $avatar_error = ''; + if (!empty($_POST['remove_avatar'])) { + userRemoveAvatar($session_user_id); + $changes[] = 'picture removed'; + } elseif (!empty($_FILES['avatar']['tmp_name']) && userSaveAvatar($session_user_id, $_FILES['avatar'], $avatar_error)) { + $changes[] = 'picture updated'; + } + + logAudit("User Account", "Edit", "$session_name edited their account" . ($changes ? ' - ' . escapeSql(implode(', ', $changes)) : '')); + + flashAlert("Your details are saved" . ($avatar_error ? " - $avatar_error" : ''), $avatar_error ? 'warning' : 'success'); + + redirect(); } @@ -96,15 +70,11 @@ if (isset($_GET['clear_your_user_avatar'])) { validateCSRFToken(); - $user_avatar = escapeSql(getFieldById('users', $session_user_id, 'user_avatar')); - - unlink("../../uploads/users/$session_user_id/$user_avatar"); - - mysqli_query($mysqli,"UPDATE users SET user_avatar = NULL WHERE user_id = $session_user_id"); + userRemoveAvatar($session_user_id); logAudit("User Account", "Edit", "$session_name cleared their avatar"); - flashAlert("Avatar cleared", 'error'); + flashAlert("Picture removed"); redirect(); @@ -114,49 +84,28 @@ if (isset($_POST['edit_your_user_password'])) { validateCSRFToken(); - $new_password = trim($_POST['new_password']); + $new_password = (string) ($_POST['new_password'] ?? ''); - if (empty($new_password)) { + if (!userCurrentPasswordOk($_POST['current_password'] ?? '')) { + flashAlert('That is not your current password - nothing was changed.', 'error'); + redirect('user_security.php'); + } + if ($problem = userPasswordProblem($new_password)) { + flashAlert($problem, 'error'); + redirect('user_security.php'); + } + if ($new_password !== (string) ($_POST['confirm_password'] ?? '')) { + flashAlert('The new password and its confirmation are not the same.', 'error'); redirect('user_security.php'); } - // Email notification when password or email is changed - $user_sql = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_name, user_email FROM users WHERE user_id = $session_user_id")); - $name = escapeSql($user_sql['user_name']); - $user_email = escapeSql($user_sql['user_email']); - - // Sanitize Config Vars from get_settings.php and Session Vars from check_login.php - $config_mail_from_name = escapeSql($config_mail_from_name); - $config_mail_from_email = escapeSql($config_mail_from_email); - $config_app_name = escapeSql($config_app_name); - - if (!empty($config_smtp_host)){ - - $details = "Your password was changed."; - - $subject = "$config_app_name account update confirmation for $name"; - $body = "Hi $name,

Your $config_app_name account has been updated, details below:

$details

If you did not perform this change, contact your $config_app_name administrator immediately.

Thanks,
$config_app_name"; - - $data = [ - [ - 'from' => $config_mail_from_email, - 'from_name' => $config_mail_from_name, - 'recipient' => $user_email, - 'recipient_name' => $name, - 'subject' => $subject, - 'body' => $body - ] - ]; - $mail = addToMailQueue($data); - } - - $new_password = password_hash($new_password, PASSWORD_DEFAULT); - $user_specific_encryption_ciphertext = encryptUserSpecificKey($_POST['new_password']); - mysqli_query($mysqli,"UPDATE users SET user_password = '$new_password', user_specific_encryption_ciphertext = '$user_specific_encryption_ciphertext' WHERE user_id = $session_user_id"); + $me = userRow($session_user_id); + userSetPassword($session_user_id, $new_password); + userNotifyChange($me['user_name'], $me['user_email'], 'its password was changed'); logAudit("User Account", "Edit", "$session_name changed their password"); - flashAlert("Your password was updated"); + flashAlert("Your password was changed - sign in with the new one"); redirect('post.php?logout'); } @@ -165,34 +114,19 @@ if (isset($_POST['edit_your_user_preferences'])) { validateCSRFToken(); - $calendar_first_day = intval($_POST['calendar_first_day']); - $dark_mode = intval($_POST['dark_mode'] ?? 0); - - // Calendar - if (isset($calendar_first_day)) { - mysqli_query($mysqli, "UPDATE user_settings SET user_config_calendar_first_day = $calendar_first_day, user_config_theme_dark = $dark_mode WHERE user_id = $session_user_id"); + $calendar_first_day = intval($_POST['calendar_first_day'] ?? 0) === 1 ? 1 : 0; + $dark_mode = intval($_POST['dark_mode'] ?? 0) === 1 ? 1 : 0; + $per_page = intval($_POST['records_per_page'] ?? 10); + if (!in_array($per_page, [5, 10, 20, 50, 100, 500], true)) { + $per_page = 10; } - // Enable extension access, only if it isn't already setup (user doesn't have cookie) - if (isset($_POST['extension']) && $_POST['extension'] == 'Yes') { - if (!isset($_COOKIE['user_extension_key'])) { - $extension_key = randomString(32); - mysqli_query($mysqli, "UPDATE users SET user_extension_key = '$extension_key' WHERE user_id = $session_user_id"); + mysqli_query($mysqli, "INSERT INTO user_settings SET user_id = $session_user_id, user_config_calendar_first_day = $calendar_first_day, user_config_theme_dark = $dark_mode, user_config_records_per_page = $per_page + ON DUPLICATE KEY UPDATE user_config_calendar_first_day = $calendar_first_day, user_config_theme_dark = $dark_mode, user_config_records_per_page = $per_page"); - $extended_log_description .= "enabled browser extension access"; - $logout = true; - } - } + logAudit("User Account", "Edit", "$session_name updated their preferences"); - // Disable extension access - if (!isset($_POST['extension'])) { - mysqli_query($mysqli, "UPDATE users SET user_extension_key = '' WHERE user_id = $session_user_id"); - $extended_log_description .= "disabled browser extension access"; - } - - logAudit("User Account", "Edit", "$session_name $extended_log_description"); - - flashAlert("User preferences updated"); + flashAlert("Your preferences are saved"); redirect(); @@ -205,55 +139,42 @@ if (isset($_POST['enable_mfa'])) { require_once "../../libs/totp/totp.php"; // Grab the code from the user - $verify_code = trim($_POST['verify_code']); - // Ensure it's numeric - if (!ctype_digit($verify_code)) { + $verify_code = preg_replace('/\s+/', '', (string) ($_POST['verify_code'] ?? '')); + if (!preg_match('/^[0-9]{6}$/', $verify_code)) { $verify_code = ''; } // Grab the secret from the session $token = $_SESSION['mfa_token'] ?? ''; + $from_enforcement = isset($_SERVER['HTTP_REFERER']) && basename(parse_url($_SERVER['HTTP_REFERER'], PHP_URL_PATH)) === 'mfa_enforcement.php'; - // Verify - if (TokenAuth6238::verify($token, $verify_code, 1)) { + if ($token !== '' && $verify_code !== '' && TokenAuth6238::verify($token, $verify_code, 1)) { - // SUCCESS - mysqli_query($mysqli,"UPDATE users SET user_token = '$token' WHERE user_id = $session_user_id"); + mysqli_query($mysqli, "UPDATE users SET user_token = '" . escapeSql($token) . "' WHERE user_id = $session_user_id"); // Delete any existing MFA tokens - these browsers should be re-validated mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_user_id = $session_user_id"); logAudit("User Account", "Edit", "$session_name enabled MFA on their account"); - flashAlert("Multi-Factor authentication enabled"); + flashAlert("Multi-factor authentication is on - you will be asked for a code when you sign in"); // Clear the mfa_token from the session to avoid re-use. unset($_SESSION['mfa_token']); - // Check if the previous page is mfa_enforcement.php - if (isset($_SERVER['HTTP_REFERER'])) { - $previousPage = basename(parse_url($_SERVER['HTTP_REFERER'], PHP_URL_PATH)); - if ($previousPage === 'mfa_enforcement.php') { - // Redirect back to mfa_enforcement.php - redirect("../$config_start_page"); - - } + if ($from_enforcement) { + redirect("../$config_start_page"); } } else { - // FAILURE - flashAlert("Verification code invalid, please try again.", 'error'); - // Set a flag to automatically open the MFA modal again + flashAlert("That code did not match - check the time on your phone, and try the newest code.", 'error'); + + // Open the set up again, with the same secret $_SESSION['show_mfa_modal'] = true; - // Check if the previous page is mfa_enforcement.php - if (isset($_SERVER['HTTP_REFERER'])) { - $previousPage = basename(parse_url($_SERVER['HTTP_REFERER'], PHP_URL_PATH)); - if ($previousPage === 'mfa_enforcement.php') { - // Redirect back to mfa_enforcement.php - redirect(); - } + if ($from_enforcement) { + redirect(); } } @@ -261,48 +182,28 @@ if (isset($_POST['enable_mfa'])) { } -if (isset($_GET['disable_mfa'])){ - - if ($session_user_config_force_mfa) { - flashAlert("Multi-Factor authentication cannot be disabled for your account", 'error'); - redirect(); - } +if (isset($_POST['disable_your_mfa'])) { validateCSRFToken(); - mysqli_query($mysqli,"UPDATE users SET user_token = '' WHERE user_id = $session_user_id"); - - // Delete any existing MFA tokens - these browsers should be re-validated - mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_user_id = $session_user_id"); - - // Sanitize Config Vars from get_settings.php and Session Vars from check_login.php - $config_mail_from_name = escapeSql($config_mail_from_name); - $config_mail_from_email = escapeSql($config_mail_from_email); - $config_app_name = escapeSql($config_app_name); - - // Email notification - if (!empty($config_smtp_host)) { - $subject = "$config_app_name account update confirmation for $session_name"; - $body = "Hi $session_name,

Your $config_app_name account has been updated, details below:

2FA was disabled.

If you did not perform this change, contact your $config_app_name administrator immediately.

Thanks,
ITFlow
$session_company_name"; - - $data = [ - [ - 'from' => $config_mail_from_email, - 'from_name' => $config_mail_from_name, - 'recipient' => $session_email, - 'recipient_name' => $session_name, - 'subject' => $subject, - 'body' => $body - ] - ]; - $mail = addToMailQueue($data); + if ($session_user_config_force_mfa) { + flashAlert("Your administrator requires multi-factor authentication on your account - it cannot be turned off.", 'error'); + redirect("user_security.php"); } + if (!userCurrentPasswordOk($_POST['current_password'] ?? '')) { + flashAlert('That is not your current password - MFA is still on.', 'error'); + redirect("user_security.php"); + } + + $me = userRow($session_user_id); + userResetMfa($session_user_id); + userNotifyChange($me['user_name'], $me['user_email'], 'multi-factor authentication was turned off'); logAudit("User Account", "Edit", "$session_name disabled MFA on their account"); - flashAlert("Multi-Factor authentication disabled", 'error'); + flashAlert("Multi-factor authentication is off", 'error'); - redirect(); + redirect("user_security.php"); } @@ -310,13 +211,28 @@ if (isset($_POST['revoke_your_2fa_remember_tokens'])) { validateCSRFToken(); - // Delete tokens mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_user_id = $session_user_id"); logAudit("User Account", "Edit", "$session_name revoked all their remember-me tokens"); - flashAlert("Remember me tokens revoked", 'error'); + flashAlert("Every remembered browser is forgotten - each asks for your code at the next sign in"); - redirect(); + redirect("user_security.php"); + +} + +if (isset($_POST['revoke_your_remember_token'])) { + + validateCSRFToken(); + + $token_id = intval($_POST['revoke_your_remember_token']); + mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_id = $token_id AND remember_token_user_id = $session_user_id"); + + if (mysqli_affected_rows($mysqli)) { + logAudit("User Account", "Edit", "$session_name revoked a remember-me token"); + flashAlert("That browser is forgotten - it asks for your code at the next sign in"); + } + + redirect("user_security.php"); } diff --git a/agent/user/user_activity.php b/agent/user/user_activity.php index a70809447..b42d587b7 100644 --- a/agent/user/user_activity.php +++ b/agent/user/user_activity.php @@ -1,98 +1,92 @@ Activity - your latest sign ins (and wrong MFA codes), and + * the latest things you did. Yours only. + */ + require_once "includes/inc_all_user.php"; +$logins = userRecentLogins($session_user_id, 20); -$sql_recent_logins = mysqli_query($mysqli, "SELECT log_created_at, log_id, log_ip, log_user_agent FROM logs - WHERE log_type = 'Login' OR log_type = 'Login 2FA' AND log_action = 'Success' AND log_user_id = $session_user_id - ORDER BY log_id DESC LIMIT 3" -); +$activity = []; +$sql = mysqli_query($mysqli, "SELECT log_id, log_type, log_action, log_description, log_created_at, log_client_id, client_name FROM logs + LEFT JOIN clients ON client_id = log_client_id AND log_client_id > 0 + WHERE log_user_id = $session_user_id AND log_type NOT IN ('Login', 'Login 2FA', 'Logout') + ORDER BY log_id DESC LIMIT 25"); +while ($row = mysqli_fetch_assoc($sql)) { + $activity[] = $row; +} -$sql_recent_logs = mysqli_query($mysqli, "SELECT log_action, log_created_at, log_description, log_id, log_type FROM logs - WHERE log_user_id = $session_user_id AND log_type NOT LIKE 'Login' - ORDER BY log_id DESC LIMIT 5" -); +$action_icons = [ + 'Create' => 'fa-plus text-success', + 'Edit' => 'fa-pen text-info', + 'Modify' => 'fa-pen text-info', + 'Delete' => 'fa-trash-alt text-danger', + 'Archive' => 'fa-archive text-secondary', + 'Restore' => 'fa-redo text-secondary', + 'Export' => 'fa-download text-secondary', + 'Upload' => 'fa-upload text-secondary', + 'View' => 'fa-eye text-secondary', + 'Reply' => 'fa-reply text-primary', +]; ?> -
-
-

Your Recent Sign ins

-
- - - - while ($row = mysqli_fetch_assoc($sql_recent_logins)) { - $log_id = intval($row['log_id']); - $log_ip = escapeHtml($row['log_ip']); - $log_user_agent = escapeHtml($row['log_user_agent']); - $log_user_os = getOS($log_user_agent); - $log_user_browser = getWebBrowser($log_user_agent); - $log_created_at = escapeHtml($row['log_created_at']); - - ?> - - - - - - - - - -
- -
- ">See More... +
+
+
+

Your sign ins

+
+ +
    + +
    • + +
+
Not you? Change your password, and tell an administrator.
+ +
None yet.
+
- -
- -
-
-

Your Recent Activity

- - - - - - - - - - - - - -
- -
- See More... +
+
+
+

What you did

+ +
+ Audit log +
+ +
+ +
    + +
  • + +
    +
    +
    + + · + + + +
    +
    +
    • + +
+ +
Nothing yet.
+
- +
+
Profile - your picture, name, email and the signature that + * goes on your ticket replies. Your email signs you in, so changing it takes + * your current password, and the old address is told. + */ + require_once "includes/inc_all_user.php"; +$me = userRow($session_user_id); +$has_avatar = trim((string) $me['user_avatar']) !== ''; + ?> -
-
-

User Preferences

+
+
+

Profile

-
+
+ - - - -
-
- - "> - Remove Avatar -
- -
- - +
+
+
+
+ +
+ + +
JPG, PNG, GIF or WebP, up to 5 MB.
+ +
+ + +
+ +
-
-
- -
- - +
+
+
+ +
+ + +
+
+
+ +
+ + +
+
+ +
+ +
+ + +
+
Set by an administrator.
+
+
+ +
+ + Password and MFA +
+
+
+ + +
Added to the end of your ticket replies and the emails they send.
- -
- -
- - -
-
- -
- -
- - -
-
- -
- - -
- - -
- - - -
- +
+
+ +
+
+ + Preferences - how ITFlow looks and behaves for you: light + * or dark, the day calendars start on, and how many rows a list shows. + */ + require_once "includes/inc_all_user.php"; -$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_config_calendar_first_day FROM user_settings WHERE user_id = $session_user_id")); -$user_config_calendar_first_day = intval($row['user_config_calendar_first_day']); +$me = userRow($session_user_id); +$calendar_first_day = intval($me['user_config_calendar_first_day']); +$per_page = intval($me['user_config_records_per_page']) ?: 10; ?> -
-
-

Preferences

+
+
+

Preferences

-
+
+ - - +
+
+
+ +
+ > + + > + +
+
-
-
Dark Mode
+
+ +
+ + +
+
-
- > - - > - +
+ +
+ + +
+
Also changed from the bottom of any list.
- -
- -
- - -
-
- +
+
- - - -
+
+
Security - your password, multi-factor authentication, and + * the browsers that skip your MFA code. Changing the password or turning MFA + * off takes your current password; you are emailed either way. + */ + require_once "includes/inc_all_user.php"; -// User remember me tokens -$sql_remember_tokens = mysqli_query($mysqli, "SELECT remember_token_created_at, remember_token_id FROM remember_tokens WHERE remember_token_user_id = $session_user_id"); -$remember_token_count = mysqli_num_rows($sql_remember_tokens); +$me = userRow($session_user_id); +$has_mfa = trim((string) $me['user_token']) !== ''; +$forced = intval($me['user_config_force_mfa']) === 1; +$browsers = userRememberedBrowsers($session_user_id); +$remember_days = max(1, intval($config_login_remember_me_expire)); ?> -
-
-

Your Password

-
-
-
- +
-
- -
- - - -
+ +
+
+
+

Password

+ + +
+
+ +
+ + + +
+
+
+ +
+ + + +
+
+
+ +
+ + +
+
You're signed out once it's changed, to sign in with the new one.
+
+
+
+ +
+ +
+
- + +
+
+
+

Multi-factor authentication

+
+
+
+ +
+
Required by your administrator' : '' ?>
+
+ + Signing in takes your password and a code from your authenticator app. + + Signing in takes only your password. With MFA it also takes a code from an app on your phone - so a stolen password alone doesn't get anyone in. + +
+
+
- - -
- - - - + +
+
+ + +
+ + + +
+ +
+
+ +
+
+ + + + + New phone? Turn it off, then on again with the new one. + + New phone? Ask an administrator to reset your MFA - you set it up again at your next sign in. + +
+
+
+ +
+
+
+

Remembered browsers

+ 1) { ?> +
+
+ + +
+
+ +
+ +
    + +
  • + +
    +
    + A browser' ?> + This browser +
    +
    + Remembered + from + · skips the code until +
    +
    +
    + + +
    +
    • + +
- Disable MFA +
+ + None. Tick Remember me when you enter your code at sign in, and that browser skips the code for days. + + None - browsers are remembered once MFA is on, so you're not asked for a code every time. + +
-
+
- 0) { ?> -
-
-

2FA Remember-Me Tokens

-
-
+ -
    - ID: $token_id | Created: $token_created"; - } ?> -
- -
- - - - -
- -
-
- + " . alertMessageHtml($_SESSION['alert_message']) . "
"; - // Clear it so it doesn't persist on refresh - unset($_SESSION['alert_type']); - unset($_SESSION['alert_message']); -} - -// If the user just failed a TOTP verification, auto-open the modal: -if (!empty($_SESSION['show_mfa_modal'])) { - echo " +// A code that didn't match - open the set up again, with the same secret +if (!empty($_SESSION['show_mfa_modal']) && !$has_mfa) { ?> "; - unset($_SESSION['show_mfa_modal']); -} + + .user-menu .nav-link .itflow-contact-avatar { + width: 1.75rem; + height: 1.75rem; +} +.itflow-user-header .itflow-contact-avatar { + width: 5.5rem; + height: 5.5rem; + margin: 0 auto; + border: 3px solid rgba(255, 255, 255, .2); + font-size: 1.8rem; +} +/* Client access: one row per client, scrolling inside the modal */ +.itflow-user-access { + max-height: 22rem; + overflow-y: auto; +} +.itflow-user-access .btn-group-sm > .btn { + min-width: 3.25rem; +} +/* MFA set up: the QR code on white, whatever the theme - an authenticator + app reads dark on light - and the code, spaced out like the app shows it */ +.itflow-mfa-qr-box { + display: inline-block; + padding: .25rem; + background: #fff; + border: 1px solid var(--bs-border-color); + border-radius: var(--bs-border-radius-lg); + line-height: 0; +} +.itflow-mfa-qr { + width: 12rem; + height: 12rem; +} +.itflow-mfa-code { + letter-spacing: .4em; +} +.itflow-mfa-code::placeholder { + letter-spacing: .4em; + opacity: .35; +} +.itflow-mfa-state { + display: inline-flex; + flex: 0 0 auto; + align-items: center; + justify-content: center; + width: 2.5rem; + height: 2.5rem; + border-radius: 50%; + font-size: 1rem; +} +.itflow-mfa-state.is-on { + background: var(--bs-success-bg-subtle); + color: var(--bs-success-text-emphasis); +} +.itflow-mfa-state.is-off { + background: var(--bs-danger-bg-subtle); + color: var(--bs-danger-text-emphasis); +} +/* Preferences: what light and dark look like */ +.itflow-theme-pick { + display: inline-flex; + align-items: center; + gap: .5rem; + padding: .5rem .9rem; +} +.itflow-theme-swatch { + display: inline-block; + width: 1.75rem; + height: 1.25rem; + border: 1px solid var(--bs-border-color); + border-radius: var(--bs-border-radius-sm); +} +.itflow-theme-swatch.is-light { + background: linear-gradient(90deg, #343a40 0 30%, #f8f9fa 30%); +} +.itflow-theme-swatch.is-dark { + background: linear-gradient(90deg, #343a40 0 30%, #212529 30%); +} diff --git a/functions.php b/functions.php index ec32b05b0..c8a053349 100644 --- a/functions.php +++ b/functions.php @@ -19,6 +19,7 @@ require_once __DIR__ . '/functions/files.php'; require_once __DIR__ . '/functions/domain.php'; require_once __DIR__ . '/functions/certificate.php'; require_once __DIR__ . '/functions/network.php'; +require_once __DIR__ . '/functions/user.php'; require_once __DIR__ . '/functions/asset_interface.php'; require_once __DIR__ . '/functions/rack.php'; require_once __DIR__ . '/functions/asset.php'; diff --git a/functions/export.php b/functions/export.php index 58bdf0a3e..a588e981b 100644 --- a/functions/export.php +++ b/functions/export.php @@ -409,6 +409,9 @@ function getExportColumns($export_type) { 'user_email' => ['label' => 'Email', 'weight' => 2], 'role_name' => ['label' => 'Role'], 'user_status_display' => ['label' => 'Status'], + 'user_mfa_display' => ['label' => 'MFA'], + 'user_last_login' => ['label' => 'Last Sign In'], + 'user_client_access' => ['label' => 'Client Access', 'weight' => 2, 'default' => false], 'user_created_at' => ['label' => 'Creation Date'], ], diff --git a/functions/user.php b/functions/user.php new file mode 100644 index 000000000..18e10ee10 --- /dev/null +++ b/functions/user.php @@ -0,0 +1,509 @@ + Users (admin/users.php, admin/modals/user/*, + * admin/post/users.php) and the agent's own account pages (agent/user/*). + * An agent's password also unlocks the credential vault (their copy of the + * master key, user_specific_encryption_ciphertext), so a password is only + * ever set through userSetPassword(), which writes both together. + */ + +/** What a user's status is: [status => label, tone]. 2 is the old invite state - shown, never set. */ +const USER_STATUSES = [ + 1 => ['Active', 'success'], + 0 => ['Disabled', 'secondary'], + 2 => ['Invited', 'info'], +]; + +/** The shortest password ITFlow takes for an agent. */ +const USER_PASSWORD_MIN = 8; + +/** Their picture, or their initials on a colour that stays the same for them. $size as contactAvatar(). */ +function userAvatar($user_id, $name, $avatar, $size = '') { + $class = 'itflow-contact-avatar' . ($size ? " itflow-contact-avatar-$size" : ''); + $avatar = html_entity_decode((string) $avatar, ENT_QUOTES, 'UTF-8'); + if ($avatar !== '') { + return ''; + } + $tone = clientInitialsTone($user_id); + return ''; +} + +/** A user's status as a pill. */ +function userStatusPill($status, $archived = false) { + if ($archived) { + return 'Archived'; + } + [$label, $tone] = USER_STATUSES[intval($status)] ?? USER_STATUSES[0]; + $icon = ['success' => 'fa-check-circle', 'secondary' => 'fa-ban', 'info' => 'fa-paper-plane'][$tone]; + return '' . $label . ''; +} + +/** + * Their MFA as a pill: on, required but not set up yet (they are asked at + * their next sign in), or off. + */ +function userMfaPill($token, $forced) { + if (trim((string) $token) !== '') { + return 'MFA' . (intval($forced) ? ' · required' : '') . ''; + } + if (intval($forced)) { + return 'MFA pending'; + } + return 'No MFA'; +} + +/** One agent by id, with their settings and role - raw, or null. */ +function userRow($user_id) { + global $mysqli; + $user_id = intval($user_id); + if (!$user_id) { + return null; + } + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT users.user_id, user_name, user_email, user_auth_method, user_type, user_status, user_token, user_avatar, + user_created_at, user_updated_at, user_archived_at, user_role_id, role_name, role_is_admin, role_archived_at, + user_config_force_mfa, user_config_calendar_first_day, user_config_theme_dark, user_config_records_per_page, user_config_signature + FROM users + LEFT JOIN user_settings ON user_settings.user_id = users.user_id + LEFT JOIN user_roles ON role_id = user_role_id + WHERE users.user_id = $user_id AND user_type = 1 LIMIT 1")); + return $row ?: null; +} + +/** + * For admin post handlers: the agent a request names - or back with an error + * when there is none. With $not_self, the admin's own account is refused: + * that is changed from their Account pages, so nobody locks themselves out + * from here. + */ +function userForRequest($user_id, $not_self = true) { + global $session_user_id; + $row = userRow($user_id); + if (!$row) { + flashAlert('That user no longer exists.', 'error'); + redirect(); + } + if ($not_self && intval($row['user_id']) === intval($session_user_id)) { + flashAlert('Change your own account from Account in the top right.', 'error'); + redirect(); + } + return $row; +} + +/** For admin modals: the same, or the modal's error. */ +function userForModal($user_id) { + $row = userRow($user_id); + if (!$row) { + echo json_encode(['error' => 'That user no longer exists.']); + exit; + } + return $row; +} + +/** The agents a bulk action names (user_ids[]), never the admin themselves - [id => row]. */ +function usersForBulk() { + global $session_user_id; + $rows = []; + foreach (array_unique(array_map('intval', (array) ($_POST['user_ids'] ?? []))) as $user_id) { + $row = userRow($user_id); + if ($row && $user_id !== intval($session_user_id)) { + $rows[$user_id] = $row; + } + } + return $rows; +} + +/** The roles an agent can have - [role_id => row], admins first. */ +function userRoles($include_role_id = 0) { + global $mysqli; + $roles = []; + $sql = mysqli_query($mysqli, "SELECT role_id, role_name, role_description, role_is_admin, role_archived_at FROM user_roles + WHERE role_type = 1 AND (role_archived_at IS NULL OR role_id = " . intval($include_role_id) . ") + ORDER BY role_is_admin DESC, role_name ASC"); + while ($row = mysqli_fetch_assoc($sql)) { + $roles[intval($row['role_id'])] = $row; + } + return $roles; +} + +/** A role in a picker - a shield for an admin role, and what it is for underneath. */ +function selectOptionRole($role) { + return selectOptionData([ + 'icon' => 'fas ' . (intval($role['role_is_admin']) ? 'fa-user-shield' : 'fa-user-tag'), + 'description' => implode(' · ', array_filter([intval($role['role_is_admin']) ? 'Administrator - every client, every setting' : '', $role['role_description']])), + ]); +} + +/** How many active agents with an admin role there are, leaving out $except_user_id. */ +function userActiveAdminCount($except_user_id = 0) { + global $mysqli; + return intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM users JOIN user_roles ON role_id = user_role_id + WHERE user_type = 1 AND user_status = 1 AND user_archived_at IS NULL AND role_is_admin = 1 AND user_id <> " . intval($except_user_id)))[0]); +} + +/** Would taking this agent out of the admins (a new role, disabled, archived) leave nobody to run the place? */ +function userIsLastAdmin($row) { + return intval($row['role_is_admin']) === 1 && intval($row['user_status']) === 1 && empty($row['user_archived_at']) + && userActiveAdminCount($row['user_id']) === 0; +} + +/** + * The name and email of New User / Edit User / the agent's own details, + * checked - [name, email] raw, or null with $error. The email signs them in, + * so no other account that can sign in may have it. + */ +function userCheckIdentity($post, $user_id, &$error = '') { + global $mysqli; + $name = trim((string) ($post['name'] ?? '')); + $email = trim((string) ($post['email'] ?? '')); + if ($name === '') { + $error = 'A user needs a name.'; + return null; + } + if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { + $error = '' . ($email ?: 'Nothing') . ' is not an email address.'; + return null; + } + $email_sql = escapeSql($email); + $taken = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_id, user_type FROM users WHERE user_email = '$email_sql' AND user_archived_at IS NULL AND user_id <> " . intval($user_id) . " LIMIT 1")); + if ($taken) { + $error = '' . $email . ' already signs in to ' . (intval($taken['user_type']) === 1 ? 'another agent account' : 'a client portal account') . ' - each account needs its own email.'; + return null; + } + return [mb_substr($name, 0, 200), mb_substr($email, 0, 200)]; +} + +/** A role an admin may give: one that exists and is not archived (or the one they have). Its row, or null with $error. */ +function userCheckRole($role_id, $current_role_id, &$error = '') { + $roles = userRoles($current_role_id); + $role_id = intval($role_id); + if (!isset($roles[$role_id]) || ($roles[$role_id]['role_archived_at'] && $role_id !== intval($current_role_id))) { + $error = 'Pick a role for them.'; + return null; + } + return $roles[$role_id]; +} + +/** Is this a password ITFlow takes? '' when it is, the reason when not. */ +function userPasswordProblem($password) { + if (strlen((string) $password) < USER_PASSWORD_MIN) { + return 'A password is at least ' . USER_PASSWORD_MIN . ' characters.'; + } + return ''; +} + +/** + * Set an agent's password - the hash they sign in with, and their copy of + * the vault key under it. Exactly what was typed, as the sign in page checks + * exactly what is typed. + */ +function userSetPassword($user_id, $password) { + global $mysqli; + $hash = escapeSql(password_hash((string) $password, PASSWORD_DEFAULT)); + $ciphertext = escapeSql(encryptUserSpecificKey((string) $password)); + mysqli_query($mysqli, "UPDATE users SET user_password = '$hash', user_specific_encryption_ciphertext = '$ciphertext' WHERE user_id = " . intval($user_id)); +} + +/** Turn an agent's MFA off - and forget the browsers it trusted, which have to sign in afresh. */ +function userResetMfa($user_id) { + global $mysqli; + $user_id = intval($user_id); + mysqli_query($mysqli, "UPDATE users SET user_token = '' WHERE user_id = $user_id"); + mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_user_id = $user_id"); +} + +/** + * Take an uploaded picture as an agent's avatar - a real image (checked, + * not trusted by its name), up to 5 MB - replacing the old one. True when + * set, false with $error when not. + */ +function userSaveAvatar($user_id, $file, &$error = '') { + global $mysqli; + $user_id = intval($user_id); + if (empty($file['tmp_name']) || ($file['error'] ?? UPLOAD_ERR_NO_FILE) === UPLOAD_ERR_NO_FILE) { + return false; + } + $new_name = checkFileUpload($file, ['jpg', 'jpeg', 'gif', 'png', 'webp']); + $image = $new_name ? @getimagesize($file['tmp_name']) : false; + if (!$new_name || !$image || !in_array($image[2], [IMAGETYPE_JPEG, IMAGETYPE_GIF, IMAGETYPE_PNG, IMAGETYPE_WEBP], true)) { + $error = 'The avatar has to be a JPG, PNG, GIF or WebP picture.'; + return false; + } + if ($file['size'] > 5 * 1024 * 1024) { + $error = 'The avatar can be up to 5 MB.'; + return false; + } + $dir = dirname(__DIR__) . "/uploads/users/$user_id"; + if (!is_dir($dir)) { + mkdir($dir, 0755, true); + } + if (!move_uploaded_file($file['tmp_name'], "$dir/$new_name")) { + $error = 'The avatar could not be saved.'; + return false; + } + userRemoveAvatar($user_id); + mysqli_query($mysqli, "UPDATE users SET user_avatar = '" . escapeSql($new_name) . "' WHERE user_id = $user_id"); + return true; +} + +/** Remove an agent's avatar - the file and the reference to it. */ +function userRemoveAvatar($user_id) { + global $mysqli; + $user_id = intval($user_id); + $old = (string) getFieldById('users', $user_id, 'user_avatar'); + if ($old !== '' && basename($old) === $old && is_file(dirname(__DIR__) . "/uploads/users/$user_id/$old")) { + unlink(dirname(__DIR__) . "/uploads/users/$user_id/$old"); + } + mysqli_query($mysqli, "UPDATE users SET user_avatar = NULL WHERE user_id = $user_id"); +} + +/** + * The clients an agent is limited to or kept from, from the Client access + * tab's radios (client_permission[client_id] = allow / deny / '') - replaces + * whatever they had. Only clients that exist are written. + */ +function userSetClientAccess($user_id, $permissions) { + global $mysqli; + $user_id = intval($user_id); + mysqli_query($mysqli, "DELETE FROM user_client_permissions WHERE user_id = $user_id"); + foreach ((array) $permissions as $client_id => $type) { + $client_id = intval($client_id); + if (($type === 'allow' || $type === 'deny') && $client_id) { + mysqli_query($mysqli, "INSERT INTO user_client_permissions (user_id, client_id, permission_type) + SELECT $user_id, client_id, '$type' FROM clients WHERE client_id = $client_id"); + } + } +} + +/** + * The client rules of some agents - [user_id => ['allow' => [client_id => + * name], 'deny' => [...]]]. + */ +function userClientAccess(array $user_ids) { + global $mysqli; + $user_ids = array_values(array_filter(array_map('intval', $user_ids))); + $access = []; + foreach ($user_ids as $id) { + $access[$id] = ['allow' => [], 'deny' => []]; + } + if ($user_ids) { + $sql = mysqli_query($mysqli, "SELECT user_id, user_client_permissions.client_id, permission_type, client_name FROM user_client_permissions + JOIN clients ON clients.client_id = user_client_permissions.client_id + WHERE user_id IN (" . implode(',', $user_ids) . ") ORDER BY client_name"); + while ($row = mysqli_fetch_assoc($sql)) { + $access[intval($row['user_id'])][$row['permission_type'] === 'deny' ? 'deny' : 'allow'][intval($row['client_id'])] = $row['client_name']; + } + } + return $access; +} + +/** What an agent can see, in words: "All clients", "3 clients", "All but 1". An admin sees everything. */ +function userClientAccessText($access, $is_admin) { + if ($is_admin) { + return 'All clients (admin)'; + } + $allow = count($access['allow']); + $deny = count($access['deny']); + if ($allow) { + return $allow . ' client' . ($allow === 1 ? '' : 's') . ($deny ? ", $deny kept out" : ''); + } + return $deny ? "All but $deny client" . ($deny === 1 ? '' : 's') : 'All clients'; +} + +/** + * The last successful sign in of some agents - [user_id => log row with + * log_created_at, log_ip, log_user_agent], or nothing for one never signed in. + */ +function userLastLogins(array $user_ids) { + global $mysqli; + $user_ids = array_values(array_filter(array_map('intval', $user_ids))); + $logins = []; + if ($user_ids) { + $sql = mysqli_query($mysqli, "SELECT log_user_id, log_created_at, log_ip, log_user_agent FROM logs + WHERE log_id IN (SELECT MAX(log_id) FROM logs WHERE log_user_id IN (" . implode(',', $user_ids) . ") AND log_type = 'Login' AND log_action = 'Success' GROUP BY log_user_id)"); + while ($row = mysqli_fetch_assoc($sql)) { + $logins[intval($row['log_user_id'])] = $row; + } + } + return $logins; +} + +/** + * An agent's latest sign ins and failed MFA codes, newest first - log rows + * with log_action, log_created_at, log_ip, log_user_agent. Theirs only. + */ +function userRecentLogins($user_id, $limit = 10) { + global $mysqli; + $rows = []; + $sql = mysqli_query($mysqli, "SELECT log_id, log_action, log_description, log_created_at, log_ip, log_user_agent FROM logs + WHERE log_user_id = " . intval($user_id) . " AND log_type IN ('Login', 'Login 2FA') + ORDER BY log_id DESC LIMIT " . max(1, intval($limit))); + while ($row = mysqli_fetch_assoc($sql)) { + $rows[] = $row; + } + return $rows; +} + +/** One of those as a line - a tick for a sign in, a cross for a failed code - with when and from where. Raw in, HTML out. */ +function userLoginLineHtml($log) { + $ok = $log['log_action'] === 'Success'; + return '
' + . '' + . '
' . escapeHtml(timeAgo($log['log_created_at'])) . '' + . ($ok ? '' : ' ' . escapeHtml($log['log_action'] === 'MFA Failed' ? 'wrong MFA code' : $log['log_action']) . '') + . '
' . userDeviceHtml($log['log_user_agent']) . ' · ' . escapeHtml($log['log_ip']) . '
' + . '
'; +} + +/** The browsers that skip an agent's MFA code (remember me) - [user_id => count]. */ +function userRememberCounts(array $user_ids) { + global $mysqli, $config_login_remember_me_expire; + $user_ids = array_values(array_filter(array_map('intval', $user_ids))); + $counts = array_fill_keys($user_ids, 0); + if ($user_ids) { + $days = max(1, intval($config_login_remember_me_expire ?? 30)); + $sql = mysqli_query($mysqli, "SELECT remember_token_user_id, COUNT(*) FROM remember_tokens + WHERE remember_token_user_id IN (" . implode(',', $user_ids) . ") AND remember_token_created_at > NOW() - INTERVAL $days DAY GROUP BY remember_token_user_id"); + while ($row = mysqli_fetch_row($sql)) { + $counts[intval($row[0])] = intval($row[1]); + } + } + return $counts; +} + +/** + * The browsers that skip an agent's MFA code, newest first - each with when + * it was remembered, until when, whether it is the browser asking, and the + * sign in it was remembered at (for the device and address - the token + * itself records neither). + */ +function userRememberedBrowsers($user_id) { + global $mysqli, $config_login_remember_me_expire; + $user_id = intval($user_id); + $days = max(1, intval($config_login_remember_me_expire ?? 30)); + $cookie = (string) ($_COOKIE['rememberme'] ?? ''); + $rows = []; + $sql = mysqli_query($mysqli, "SELECT remember_token_id, remember_token_token, remember_token_created_at, + remember_token_created_at + INTERVAL $days DAY AS remember_token_expires_at + FROM remember_tokens + WHERE remember_token_user_id = $user_id AND remember_token_created_at > NOW() - INTERVAL $days DAY + ORDER BY remember_token_id DESC"); + while ($row = mysqli_fetch_assoc($sql)) { + $created = escapeSql($row['remember_token_created_at']); + $row['login'] = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT log_created_at, log_ip, log_user_agent FROM logs + WHERE log_user_id = $user_id AND log_type = 'Login' AND log_action = 'Success' + AND log_created_at BETWEEN '$created' - INTERVAL 2 MINUTE AND '$created' + INTERVAL 2 MINUTE + ORDER BY ABS(TIMESTAMPDIFF(SECOND, log_created_at, '$created')) LIMIT 1")); + $row['is_current'] = $cookie !== '' && hash_equals((string) $row['remember_token_token'], $cookie); + unset($row['remember_token_token']); + $rows[] = $row; + } + return $rows; +} + +/** The device a sign in came from - "Windows Chrome" with their icons - from its user agent. HTML. */ +function userDeviceHtml($user_agent) { + $parts = array_filter([getOS((string) $user_agent), getWebBrowser((string) $user_agent)], function ($part) { + return $part !== '-'; + }); + return $parts ? implode(' ', $parts) : 'Unknown device'; +} + +/** A sign in, in words: when, and from what - "2 hours ago · Windows · Chrome · 203.0.113.9". Raw values in, HTML out. */ +function userLoginHtml($log, $with_ip = true) { + if (!$log) { + return 'Never signed in'; + } + return '' . escapeHtml(timeAgo($log['log_created_at'])) . '' + . '
' . userDeviceHtml($log['log_user_agent']) + . ($with_ip ? ' · ' . escapeHtml($log['log_ip']) . '' : '') . '
'; +} + +/** + * The QR code an authenticator app scans to set up MFA, drawn here as an + * SVG - the secret is never put in an image URL, where it would land in the + * web server's access log. + */ +function userMfaQrSvg($secret, $email) { + global $config_app_name; + // libs/barcode/barcode.php stops the page outright without GD - then it is the secret to type in + if (!extension_loaded('gd')) { + return ''; + } + require_once dirname(__DIR__) . '/libs/barcode/barcode.php'; + $issuer = (string) ($config_app_name ?: 'ITFlow'); + $uri = 'otpauth://totp/' . rawurlencode($issuer) . ':' . rawurlencode((string) $email) . '?secret=' . rawurlencode((string) $secret) . '&issuer=' . rawurlencode($issuer); + $generator = new barcode_generator(); + $svg = $generator->render_svg('qr', $uri, ['w' => 200, 'h' => 200, 'p' => 0]); + // Shown inline in the page, not as an image - the XML prolog has to go, and it scales with its box + $svg = preg_replace('/^<\?xml[^>]*>\s*/', '', (string) $svg); + return preg_replace('/ $escape($config_mail_from_email), + 'from_name' => $escape($config_mail_from_name), + 'recipient' => $escape($recipient), + 'recipient_name' => $escape($recipient_name), + 'subject' => $escape($subject), + 'body' => $escape($body_html), + ]]); +} + +/** An agent's own email, sent from the system - their account was changed. Queued; nothing when mail is not set up. */ +function userNotifyChange($name, $email, $what) { + global $config_smtp_host, $config_app_name, $session_company_name; + if (empty($config_smtp_host) || !filter_var($email, FILTER_VALIDATE_EMAIL)) { + return; + } + $app = $config_app_name ?: 'ITFlow'; + userQueueMail($email, $name, "$app account update for $name", + 'Hi ' . escapeHtml($name) . ',

Your ' . escapeHtml($app) . ' account was changed: ' . escapeHtml($what) . '

' + . 'If this was not you, contact your ' . escapeHtml($app) . ' administrator straight away.

Thanks,
' . escapeHtml($session_company_name ?? $app)); +} diff --git a/includes/top_nav.php b/includes/top_nav.php index 80587d3c8..4ec15c36c 100644 --- a/includes/top_nav.php +++ b/includes/top_nav.php @@ -73,26 +73,16 @@
  • - - - - " - class="user-image rounded-circle"> - +
      -
    • - - - - - " class="rounded-circle"> - +
    • +

      - + ·