diff --git a/access_element.php b/access_element.php index d047901..87be76b 100644 --- a/access_element.php +++ b/access_element.php @@ -1,7 +1,7 @@ '', 'is_active' => 1, 'created' => '', - 'createdby' => $_SESSION['username'], + 'createdby' => $_SESSION['authorization']['clientID'], 'updated' => '', 'updatedby' => '' ]; diff --git a/access_elements.php b/access_elements.php index cad1dc1..57363d1 100644 --- a/access_elements.php +++ b/access_elements.php @@ -1,7 +1,7 @@ ←':''; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security $page_manage = 'access_element_manage'; -$update_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); // Function to scan project for new PHP files and add to access_elements function scan_and_update_access_elements() { diff --git a/account.php b/account.php index d270157..3303a0a 100644 --- a/account.php +++ b/account.php @@ -1,7 +1,7 @@ soldto) ?? ''; //DISPLAY RELATED COMMUNICATION RECORDS $view_communication = ''; -if ($_SESSION['permission'] == 3 || $_SESSION['permission'] == 4){ +if ($_SESSION['authorization']['permission'] == 3 || $_SESSION['authorization']['permission'] == 4){ $view_communication = ' '.$button_partner_assigned_communication.''; } //DISPLAY RELATED USERS $view_users =''; -if ($_SESSION['permission'] == 3 || $_SESSION['permission'] == 4){ +if ($_SESSION['authorization']['permission'] == 3 || $_SESSION['authorization']['permission'] == 4){ $view_users = ' '.$button_partner_assigned_users.''; } diff --git a/account_manage.php b/account_manage.php index 2e822c1..14e3003 100644 --- a/account_manage.php +++ b/account_manage.php @@ -3,14 +3,14 @@ defined(page_security_key) or exit; $page = 'account'; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security -$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); // Default input product values $account = [ @@ -43,7 +43,7 @@ $account = [ 'loghandleraccount' => '' ], 'created' => $date, - 'createdby' => $_SESSION['username'], + 'createdby' => $_SESSION['authorization']['clientID'], 'accounthierarchy' => [ 'salesid' => '', 'soldto' => '' @@ -271,8 +271,8 @@ $view .= '
//Dropdown -$partner_data = json_decode($_SESSION['partnerhierarchy']); -$soldto_dropdown = listPartner('soldto',$_SESSION['permission'],$accounthierarchy->soldto,''); +$partner_data = json_decode($_SESSION['authorization']['partnerhierarchy']); +$soldto_dropdown = listPartner('soldto',$_SESSION['authorization']['permission'],$accounthierarchy->soldto,''); $view .= '
'.$tab3.' diff --git a/accounts.php b/accounts.php index 72e748c..5970a50 100644 --- a/accounts.php +++ b/accounts.php @@ -1,7 +1,7 @@ 'API_INPUT_1','error' => 'user_key is required'])); +} + +//GET USER_DATA +$stmt = $pdo->prepare('SELECT * FROM users WHERE userkey = ?'); +$stmt->execute([$user_key]); + +if ($stmt->rowCount() == 1) { + //Get results + $user_data = $stmt->fetch(); + + //GET DATA + $user_permissions['id'] = $user_data['id']; + $user_permissions['email'] = $user_data['email']; + $user_permissions['partnerhierarchy'] = $user_data['partnerhierarchy']; //clean; + $user_permissions['permission'] = userRights($user_data['view']); + $user_permissions['profile'] = getProfile($user_data['settings'],userRights($user_data['view'])); + + //NEW DATA REPLACING PROFILE AND LATER PERMISSION ABOVE + $user_permissions['permissions'] = getUserPermissions($pdo, $user_data['id']); + + if (!$user_permissions['permissions']) { + http_response_code(404); + exit(json_encode(['error_code' => 'API_NOT_FOUND','error' => 'No permissions found'])); + } + + //+++++++++++++++++++++++++++++++++++++++++++ + //Return as JSON + //+++++++++++++++++++++++++++++++++++++++++++ + echo json_encode($user_permissions); +} +else { + http_response_code(404); + exit(json_encode(['error_code' => 'API_NOT_FOUND','error' => 'User not found'])); +} + +?> \ No newline at end of file diff --git a/assets/functions.php b/assets/functions.php index c2c7762..939bd98 100644 --- a/assets/functions.php +++ b/assets/functions.php @@ -304,7 +304,7 @@ function menu($selected,$selected_child){ $menu = ''; //filter the main_menu array based on profile - $filteredMenu = filterMenuByProfile($main_menu, $_SESSION['profile']); + $filteredMenu = filterMenuByProfile($main_menu, $_SESSION['authorization']['profile']); foreach ($filteredMenu as $menu_item){ //Main Item @@ -340,12 +340,12 @@ function template_header($title, $selected = 'assets', $selected_child = 'view') $domain = getDomainName($_SERVER['SERVER_NAME']); $custom_css = (file_exists(dirname(__FILE__,2).'/custom/'.$domain.'/style/'.$domain.'.css') ? './custom/'.$domain.'/style/'.$domain.'.css' : './style/admin.css'); - $user = ucfirst($_SESSION['username']); + $user = ucfirst($_SESSION['authorization']['clientID']); if (filter_var($user, FILTER_VALIDATE_EMAIL)){ $user = substr($user, 0, strpos($user, "@")); } - if (isset($_SESSION['id'])){$id = $_SESSION['id'];} else{$id='';} + if (isset($_SESSION['authorization']['id'])){$id = $_SESSION['authorization']['id'];} else{$id='';} if(isset($_SESSION['country_code'])){ $api_file_language = dirname(__FILE__,2).'/settings/translations/translations_'.strtoupper($_SESSION['country_code']).'.php'; @@ -520,8 +520,8 @@ EOT; //------------------------------------------ function template_footer($js_script = '') { $js_script = $js_script ? '' : ''; - $lancode = $_SESSION['language'] ?? 'US'; - $user_mail = $_SESSION['email'] ?? ''; + $lancode = $_SESSION['authorization']['language'] ?? 'US'; + $user_mail = $_SESSION['authorization']['email'] ?? ''; $veliti_cim = ''; if (veliti_cim){ $veliti_cim = ' @@ -1239,7 +1239,7 @@ function ioServer($api_call, $data){ debuglog($date." - ioServer incoming call: api_call=$api_call, data=" . $data_log); } - $token = $_SESSION['userkey'] ?? 'authorization_request'; + $token = $_SESSION['authorization']['userkey'] ?? 'authorization_request'; $bearertoken = createCommunicationToken($token); $url = $baseurl.$api_call; @@ -1541,18 +1541,16 @@ function getProfile($profile, $permission){ //+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ function isAllowed($page,$profile,$permission,$action){ - //++++++++++++++++ - //OVERRIDE - //++++++++++++++++ - return 1; - //++++++++++++++++ - + //override for testing only + return 1; + //Include settingsa include dirname(__FILE__,2).'/settings/settings_redirector.php'; // Always allowed collections: [collection => allowed_actions_string] $always_allowed = [ 'com_log' => 'U', + 'user_permissions' => 'R', 'software_update' => 'R', 'software_download' => 'R', 'software_available' => 'R', @@ -2690,7 +2688,7 @@ function listPartner($partnertype, $user_right, $input, $required) //BASED ON USERRIGHT DEFINE SQL AND DATA RETURNED if ($user_right != 3 || $user_right !=4) { //NOT ADMIN USER - $partner = json_decode($_SESSION['partnerhierarchy']); + $partner = json_decode($_SESSION['authorization']['partnerhierarchy']); //SoldTo is empty if (empty($partner->soldto) || $partner->soldto == ''){$soldto_search = '%';} else {$soldto_search = '-%';} //BUILD CONDITION @@ -2738,7 +2736,7 @@ function listAccounts($type, $user_right, $input) //BASED ON USERRIGHT DEFINE SQL AND DATA RETURNED if ($user_right != 3 || $user_right !=4) { //NOT ADMIN USER - $partner = json_decode($_SESSION['partnerhierarchy']); + $partner = json_decode($_SESSION['authorization']['partnerhierarchy']); //SoldTo is empty if (empty($partner->soldto) || $partner->soldto == ''){$soldto_search = '%';} else {$soldto_search = '-%';} //BUILD CONDITION @@ -5661,4 +5659,77 @@ function generateCountriesFile($token){ } return false; +} + +/** + * Get combined user permissions based on all assigned roles + * + * This function retrieves all role assignments for a user and combines permissions + * from multiple roles. If the same access_element appears in multiple roles, + * permissions are merged (OR operation) so the user gets the union of all permissions. + * + * For example: + * - Role A: access_element 'assets' with C=1, U=1, D=0 + * - Role B: access_element 'assets' with C=0, U=0, D=1 + * - Result: access_element 'assets' with C=1, U=1, D=1 + * + * @param PDO $pdo Database connection + * @param int $user_id The user ID to get permissions for + * @return array Associative array of permissions indexed by access_element path + * Each element contains: [path, name, group, can_create, can_read, can_update, can_delete] + */ +function getUserPermissions($pdo, $user_id) { + // Get all active role assignments for the user with their permissions + $sql = "SELECT + ae.access_path, + ae.access_name, + ae.access_group, + rap.can_create, + rap.can_read, + rap.can_update, + rap.can_delete + FROM user_role_assignments ura + INNER JOIN user_roles ur ON ura.role_id = ur.rowID + INNER JOIN role_access_permissions rap ON ur.rowID = rap.role_id + INNER JOIN access_elements ae ON rap.access_id = ae.rowID + WHERE ura.user_id = :user_id + AND ura.is_active = 1 + AND ur.is_active = 1 + AND ae.is_active = 1 + AND (ura.expires_at IS NULL OR ura.expires_at > NOW()) + ORDER BY ae.access_path"; + + $stmt = $pdo->prepare($sql); + $stmt->bindParam(':user_id', $user_id, PDO::PARAM_INT); + $stmt->execute(); + $results = $stmt->fetchAll(PDO::FETCH_ASSOC); + + // Combine permissions for duplicate access elements + $combined_permissions = []; + + foreach ($results as $row) { + $path = $row['access_path']; + + if (!isset($combined_permissions[$path])) { + // First time seeing this access element + $combined_permissions[$path] = [ + 'path' => $row['access_path'], + 'name' => $row['access_name'], + 'group' => $row['access_group'], + 'can_create' => (int)$row['can_create'], + 'can_read' => (int)$row['can_read'], + 'can_update' => (int)$row['can_update'], + 'can_delete' => (int)$row['can_delete'] + ]; + } else { + // Access element already exists, combine permissions (OR operation) + // If any role grants a permission, the user has that permission + $combined_permissions[$path]['can_create'] = max($combined_permissions[$path]['can_create'], (int)$row['can_create']); + $combined_permissions[$path]['can_read'] = max($combined_permissions[$path]['can_read'], (int)$row['can_read']); + $combined_permissions[$path]['can_update'] = max($combined_permissions[$path]['can_update'], (int)$row['can_update']); + $combined_permissions[$path]['can_delete'] = max($combined_permissions[$path]['can_delete'], (int)$row['can_delete']); + } + } + + return $combined_permissions; } \ No newline at end of file diff --git a/buildtool.php b/buildtool.php index 553a35c..9de2e31 100644 --- a/buildtool.php +++ b/buildtool.php @@ -1,7 +1,7 @@ [ 'CarVIN' => '', 'year' => '', - 'NameTester'=> $_SESSION['username'], + 'NameTester'=> $_SESSION['authorization']['clientID'], 'SN' =>'', 'HW' =>'', 'FW' =>'' diff --git a/cartests.php b/cartests.php index 5a49aca..141b967 100644 --- a/cartests.php +++ b/cartests.php @@ -1,7 +1,7 @@ '.$general_filters_clear.''; //SHOW DOWNLOAD TO EXCELL OPTION ONLY TO ADMIN USERS -if ($_SESSION['permission'] == 3 || $_SESSION['permission'] == 4){ +if ($_SESSION['authorization']['permission'] == 3 || $_SESSION['authorization']['permission'] == 4){ $view .= ' Download '; diff --git a/catalog.php b/catalog.php index e53c7b1..5bbed4b 100644 --- a/catalog.php +++ b/catalog.php @@ -1,7 +1,7 @@ '', diff --git a/communication.php b/communication.php index 5c3334e..c3d8e3d 100644 --- a/communication.php +++ b/communication.php @@ -3,14 +3,14 @@ defined(page_security_key) or exit; $page = 'communication'; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security -$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); // Default input communication values $communication = [ diff --git a/communication_send.php b/communication_send.php index c9823b2..7b9a652 100644 --- a/communication_send.php +++ b/communication_send.php @@ -3,14 +3,14 @@ defined(page_security_key) or exit; $page = 'communication_send'; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security -$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); $url = 'index.php?page=communications'; diff --git a/communications.php b/communications.php index b1c6417..b3eaf24 100644 --- a/communications.php +++ b/communications.php @@ -1,7 +1,7 @@ '.$button_create_communication.''; } -if (isAllowed('communication_send',$_SESSION['profile'],$_SESSION['permission'],'U') === 1){ +if (isAllowed('communication_send',$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U') === 1){ $view .= ''.$button_create_communication_send.''; } diff --git a/contract.php b/contract.php index bbe5260..15ff325 100644 --- a/contract.php +++ b/contract.php @@ -1,7 +1,7 @@ ←':''; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } @@ -27,11 +27,11 @@ $pagination_page = $_SESSION['p'] = isset($_GET['p']) ? $_GET['p'] : 1; //PAGE Security $page_manage = 'contract_manage'; -$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$update_allowed_edit = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'C'); -$view_equipment = isAllowed('equipment' ,$_SESSION['profile'],$_SESSION['permission'],'R'); +$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$update_allowed_edit = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); +$view_equipment = isAllowed('equipment' ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R'); //GET Details from URL $GET_VALUES = urlGETdetails($_GET) ?? ''; diff --git a/contract_manage.php b/contract_manage.php index 032dfae..80c0f23 100644 --- a/contract_manage.php +++ b/contract_manage.php @@ -3,14 +3,14 @@ defined(page_security_key) or exit; $page = 'contract_manage'; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security -$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); // Default input product values $contract = [ @@ -31,7 +31,7 @@ $contract = [ 'reference' => '', 'servicetool' => [], 'assigned_users' => [], - 'accounthierarchy' => $_SESSION['partnerhierarchy'], + 'accounthierarchy' => $_SESSION['authorization']['partnerhierarchy'], 'ignore_list' => [] ]; @@ -248,10 +248,10 @@ $view .='
$partner_data = json_decode($contract['accounthierarchy']); //BUID UP DROPDOWNS -$salesid_dropdown = listPartner('salesid',$_SESSION['permission'],$partner_data->salesid,''); -$soldto_dropdown = listPartner('soldto',$_SESSION['permission'],$partner_data->soldto,''); -$shipto_dropdown = listPartner('shipto',$_SESSION['permission'],$partner_data->shipto,''); -$location_dropdown = listPartner('location',$_SESSION['permission'],$partner_data->location,''); +$salesid_dropdown = listPartner('salesid',$_SESSION['authorization']['permission'],$partner_data->salesid,''); +$soldto_dropdown = listPartner('soldto',$_SESSION['authorization']['permission'],$partner_data->soldto,''); +$shipto_dropdown = listPartner('shipto',$_SESSION['authorization']['permission'],$partner_data->shipto,''); +$location_dropdown = listPartner('location',$_SESSION['authorization']['permission'],$partner_data->location,''); //DISPLAY $view .= '
diff --git a/contracts.php b/contracts.php index e18eac2..50d7e99 100644 --- a/contracts.php +++ b/contracts.php @@ -1,7 +1,7 @@ ←':''; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security $page_manage = 'contract_manage'; -$update_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); //Close Contracts when end_date expired closeContract(); diff --git a/cronjob.php b/cronjob.php index 4902c3b..d9ed9be 100644 --- a/cronjob.php +++ b/cronjob.php @@ -5,7 +5,7 @@ include_once './assets/functions.php'; include_once './settings/settings_redirector.php'; include_once './settings/config_redirector.php'; -if (debug && debug_id == $_SESSION['id']){ +if (debug && debug_id == $_SESSION['authorization']['id']){ ini_set('display_errors', '1'); ini_set('display_startup_errors', '1'); error_reporting(E_ALL); @@ -62,12 +62,10 @@ foreach ($communications as $communication){ $token =''; $data = json_encode(array("username" => interface_user, "password" => interface_pw), JSON_UNESCAPED_UNICODE); -//Secure data -$payload = generate_payload($data); //API call -$responses = ioServer('/v1/authorization', $payload); +$responses = ioServer('/v2/authorization', $data); //Decode Payload -if (!empty($responses)){$responses = decode_payload($responses);}else{$responses = '400';} +if (!empty($responses)){$responses = json_decode($responses);}else{$responses = '400';} if ($responses === 'NOK' || $responses === '400'){ //Not allowed diff --git a/custom/bewellwell/settings/settingsmenu.php b/custom/bewellwell/settings/settingsmenu.php index 954eb5d..74edb4d 100644 --- a/custom/bewellwell/settings/settingsmenu.php +++ b/custom/bewellwell/settings/settingsmenu.php @@ -327,7 +327,7 @@ $page_rows_software_versions = 50; //software versions //------------------------------------------ // Languages supported //------------------------------------------ -$supportedLanguages = ['US', 'NL', 'DE', 'ES','PT']; +$supportedLanguages = ['US', 'NL', 'DE', 'ES','PL','PT']; //------------------------------------------ // Pricing diff --git a/dashboard.php b/dashboard.php index da7f6a1..5aee031 100644 --- a/dashboard.php +++ b/dashboard.php @@ -1,7 +1,7 @@ '', 'full_path' =>'', 'created' => '', - 'createdby' => $_SESSION['username'], + 'createdby' => $_SESSION['authorization']['clientID'], 'updated' => '', 'updatedby' => '' ]; diff --git a/dealers.php b/dealers.php index 7ff341a..c0b01e4 100644 --- a/dealers.php +++ b/dealers.php @@ -1,7 +1,7 @@ '', diff --git a/discounts.php b/discounts.php index b30eedc..0b3cc31 100644 --- a/discounts.php +++ b/discounts.php @@ -1,7 +1,7 @@ sw_version_upgrade) && isset($products_software) && $prod } //Calculate Healthindex based on last test -$total_score = assetHealthIndex($_SESSION['profile'],$_SESSION['permission'],$equipment_data,0); +$total_score = assetHealthIndex($_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],$equipment_data,0); //GetPartnerDetails $partner_data = json_decode($responses->accounthierarchy); @@ -163,7 +163,7 @@ $view = ' //------------------------------------ //CHECK IF USER IS ALSO CREATOR OF RECORD THEN OVERRIDE UPDATE_ALLOWED_EDIT //------------------------------------ -$equipment_owner = (($responses->createdby == $_SESSION['username'])? 1 : 0); +$equipment_owner = (($responses->createdby == $_SESSION['authorization']['clientID'])? 1 : 0); //------------------------------------ // //------------------------------------ @@ -369,7 +369,7 @@ if (!empty($responses->geolocation) || $responses->geolocation != ''){ } //Get all related service events -if (isAllowed('servicereports',$_SESSION['profile'],$_SESSION['permission'],'R') === 1){ +if (isAllowed('servicereports',$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 1){ $service_events = serviceEvents($history,$page); $view .= '
@@ -382,7 +382,7 @@ $view .= '
} //Show equipment_data when available and allowed -if (isAllowed('equipment_data',$_SESSION['profile'],$_SESSION['permission'],'R') === 1 && !empty($equipment_data)){ +if (isAllowed('equipment_data',$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 1 && !empty($equipment_data)){ $view .= '
'.($view_asset_data_text ?? '').' @@ -455,13 +455,13 @@ $shipto_id = explode("-",$partner_data->shipto) ?? ''; $partner_users_id = ($shipto_id[0] != '')? $shipto_id[0] : (($soldto_id[0] != '')? $soldto_id[0] : 1); $view_communication = ''; -if ($partner_users_id != 1 && ($_SESSION['permission'] == 3 || $_SESSION['permission'] == 4)){ +if ($partner_users_id != 1 && ($_SESSION['authorization']['permission'] == 3 || $_SESSION['authorization']['permission'] == 4)){ $view_communication = ' '.$button_partner_assigned_communication.''; } //DISPLAY RELATED USERS $view_users =''; -if ($partner_users_id != 1 && ($_SESSION['permission'] == 3 || $_SESSION['permission'] == 4)){ +if ($partner_users_id != 1 && ($_SESSION['authorization']['permission'] == 3 || $_SESSION['authorization']['permission'] == 4)){ $view_users = ' '.$button_partner_assigned_users.''; } diff --git a/equipment_data.php b/equipment_data.php index 174f861..5c94104 100644 --- a/equipment_data.php +++ b/equipment_data.php @@ -3,14 +3,14 @@ defined(page_security_key) or exit; $page = 'equipment_data'; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security -$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); // Default input product values $equipment_data = [ @@ -18,7 +18,7 @@ $equipment_data = [ 'equipmentid' => '', 'historyid' => '', 'created' => '', - 'createdby' => $_SESSION['username'], + 'createdby' => $_SESSION['authorization']['clientID'], 'measurement' => '' ]; diff --git a/equipment_manage.php b/equipment_manage.php index 46563e9..a79f1ad 100644 --- a/equipment_manage.php +++ b/equipment_manage.php @@ -1,7 +1,7 @@ '', 'productrowid' => '', 'created' => '', - 'createdby' => $_SESSION['username'], + 'createdby' => $_SESSION['authorization']['clientID'], 'status' => 1, - 'accounthierarchy' => $_SESSION['partnerhierarchy'], + 'accounthierarchy' => $_SESSION['authorization']['partnerhierarchy'], 'serialnumber' => '', 'hw_version' => '', 'sw_version' => '', @@ -77,7 +77,7 @@ if (isset($_GET['equipmentID'])) { //------------------------------------ //CHECK IF USER IS ALSO CREATOR OF RECORD THEN OVERRIDE UPDATE_ALLOWED //------------------------------------ - $equipment_owner = (($equipment['createdby'] == $_SESSION['username'])? 1 : 0); + $equipment_owner = (($equipment['createdby'] == $_SESSION['authorization']['clientID'])? 1 : 0); if ($update_allowed === 1 || $equipment_owner === 1 || $update_allowed_special === 1){ if (isset($_POST['submit'])) { @@ -216,10 +216,10 @@ $view .= '
//GET PARTNERDATA $partner_data = json_decode($equipment['accounthierarchy']); //BUID UP DROPDOWNS -$salesid_dropdown = listPartner('salesid',$_SESSION['permission'],$partner_data->salesid,''); -$soldto_dropdown = listPartner('soldto',$_SESSION['permission'],$partner_data->soldto,''); -$shipto_dropdown = listPartner('shipto',$_SESSION['permission'],$partner_data->shipto,''); -$location_dropdown = listPartner('location',$_SESSION['permission'],$partner_data->location,''); +$salesid_dropdown = listPartner('salesid',$_SESSION['authorization']['permission'],$partner_data->salesid,''); +$soldto_dropdown = listPartner('soldto',$_SESSION['authorization']['permission'],$partner_data->soldto,''); +$shipto_dropdown = listPartner('shipto',$_SESSION['authorization']['permission'],$partner_data->shipto,''); +$location_dropdown = listPartner('location',$_SESSION['authorization']['permission'],$partner_data->location,''); if (isset($partner_data->section)){$section = getPartnerName($partner_data->section) ?? 'Not specified';} else {$section = 'Not specified';} diff --git a/equipments.php b/equipments.php index 35708d5..373abb1 100644 --- a/equipments.php +++ b/equipments.php @@ -1,7 +1,7 @@ ←':''; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security $page_manage = 'equipment_manage'; -$update_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); //GET PARAMETERS && STORE in SESSION for FURTHER USE/NAVIGATION $pagination_page = $_SESSION['p'] = isset($_GET['p']) ? $_GET['p'] : 1; @@ -192,7 +192,7 @@ $view .= ' X'; //SHOW DOWNLOAD TO EXCELL OPTION ONLY TO ADMIN USERS -if ($_SESSION['permission'] == 3 || $_SESSION['permission'] == 4){ +if ($_SESSION['authorization']['permission'] == 3 || $_SESSION['authorization']['permission'] == 4){ $view .= ' '; diff --git a/equipments_mass_update.php b/equipments_mass_update.php index 5225e6c..4553094 100644 --- a/equipments_mass_update.php +++ b/equipments_mass_update.php @@ -1,7 +1,7 @@ //BUID UP DROPDOWNS -$partner = json_decode($_SESSION['partnerhierarchy'],true); +$partner = json_decode($_SESSION['authorization']['partnerhierarchy'],true); -$salesid_dropdown = listPartner('salesid',$_SESSION['permission'],$partner['salesid'],'yes'); -$soldto_dropdown = listPartner('soldto',$_SESSION['permission'],'','yes'); -$shipto_dropdown = listPartner('shipto',$_SESSION['permission'],'',''); -$location_dropdown = listPartner('location',$_SESSION['permission'],'',''); +$salesid_dropdown = listPartner('salesid',$_SESSION['authorization']['permission'],$partner['salesid'],'yes'); +$soldto_dropdown = listPartner('soldto',$_SESSION['authorization']['permission'],'','yes'); +$shipto_dropdown = listPartner('shipto',$_SESSION['authorization']['permission'],'',''); +$location_dropdown = listPartner('location',$_SESSION['authorization']['permission'],'',''); $view .='
@@ -202,7 +202,7 @@ $view .='
'; // SHOW SALESID and SOLDTO ONLY TO ADMIN -if ($_SESSION['permission'] == 3 || $_SESSION['permission'] == 4){ +if ($_SESSION['authorization']['permission'] == 3 || $_SESSION['authorization']['permission'] == 4){ $view .='
'.$salesid_dropdown.' @@ -227,7 +227,7 @@ $view .='
'; -if ($_SESSION['permission'] == 3 || $_SESSION['permission'] == 4 ){ +if ($_SESSION['authorization']['permission'] == 3 || $_SESSION['authorization']['permission'] == 4 ){ $view .= ' '; } @@ -159,10 +159,10 @@ $view .= '
'; //GET PARTNERDATA -$partner_data = json_decode($partner['salesID'])?? json_decode($_SESSION['partnerhierarchy']) ; +$partner_data = json_decode($partner['salesID'])?? json_decode($_SESSION['authorization']['partnerhierarchy']) ; //BUID UP DROPDOWNS -$salesid_dropdown = listPartner('salesid',$_SESSION['permission'],$partner_data->salesid,''); -$soldto_dropdown = listPartner('soldto',$_SESSION['permission'],$partner_data->soldto,''); +$salesid_dropdown = listPartner('salesid',$_SESSION['authorization']['permission'],$partner_data->salesid,''); +$soldto_dropdown = listPartner('soldto',$_SESSION['authorization']['permission'],$partner_data->soldto,''); //DISPLAY $view .= '
@@ -171,7 +171,7 @@ $view .= '
$view .= '
'; -if ($_SESSION['permission'] == 3 || $_SESSION['permission'] == 4){ +if ($_SESSION['authorization']['permission'] == 3 || $_SESSION['authorization']['permission'] == 4){ $view .= ''; $view .= $salesid_dropdown; } diff --git a/partners.php b/partners.php index b348705..68ac725 100644 --- a/partners.php +++ b/partners.php @@ -1,7 +1,7 @@ ←':''; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } @@ -27,12 +27,12 @@ $pagination_page = $_SESSION['p'] = isset($_GET['p']) ? $_GET['p'] : 1; //PAGE Security $page_manage = 'product_manage'; -$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$update_allowed_edit = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'C'); -$media_update = isAllowed('products_media' ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$software_update = isAllowed('products_software_assignment' ,$_SESSION['profile'],$_SESSION['permission'],'U'); +$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$update_allowed_edit = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); +$media_update = isAllowed('products_media' ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$software_update = isAllowed('products_software_assignment' ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); //GET Details from URL $GET_VALUES = urlGETdetails($_GET) ?? ''; diff --git a/product_manage.php b/product_manage.php index 5877f10..314d0bb 100644 --- a/product_manage.php +++ b/product_manage.php @@ -3,14 +3,14 @@ defined(page_security_key) or exit; $page = 'product_manage'; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security -$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); // if ($_GET['id'] !=''){ @@ -30,13 +30,13 @@ $product = [ 'url_slug' => '', 'full_path' =>'', 'created' => '', - 'createdby' => $_SESSION['username'], + 'createdby' => $_SESSION['authorization']['clientID'], 'parttype' => 1, 'price' => '0', 'salesflag' => 0, 'quantity' => 1, 'updated' => '', - 'updatedby' => $_SESSION['username'], + 'updatedby' => $_SESSION['authorization']['clientID'], 'product_category' => '', 'status' => 1, 'build' => 1, diff --git a/products.php b/products.php index cda7274..7666889 100644 --- a/products.php +++ b/products.php @@ -1,7 +1,7 @@ '', 'assignment' => '', 'created' => '', - 'createdby' => $_SESSION['username'], + 'createdby' => $_SESSION['authorization']['clientID'], 'updated' => '', 'updatedby' => '' ]; diff --git a/products_software.php b/products_software.php index bdac74e..2bc5633 100644 --- a/products_software.php +++ b/products_software.php @@ -3,14 +3,14 @@ defined(page_security_key) or exit; $page = 'products_software'; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security -$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); // Default input product values $products_software = [ @@ -21,7 +21,7 @@ $products_software = [ 'hw_version' => '', 'software' => '', 'created' => '', - 'createdby' => $_SESSION['username'], + 'createdby' => $_SESSION['authorization']['clientID'], 'mandatory' => '', 'latest' => '' ]; diff --git a/products_software_assignments.php b/products_software_assignments.php index 5904720..159b0e7 100644 --- a/products_software_assignments.php +++ b/products_software_assignments.php @@ -3,14 +3,14 @@ defined(page_security_key) or exit; $page = 'products_software_assignments'; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security -$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); // Get product details $productrowid = $_GET['productrowid'] ?? ''; diff --git a/products_software_upgrade_paths_manage.php b/products_software_upgrade_paths_manage.php index 2261f80..a63c347 100644 --- a/products_software_upgrade_paths_manage.php +++ b/products_software_upgrade_paths_manage.php @@ -6,14 +6,14 @@ if (!isset($button_cancel)) $button_cancel = 'Cancel'; $page = 'products_software_upgrade_paths_manage'; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security -$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); // Determine redirect URL if (isset($_GET['id'])) { @@ -32,9 +32,9 @@ $path = [ 'description' => '', 'is_active' => 1, 'created' => '', - 'createdby' => $_SESSION['username'], + 'createdby' => $_SESSION['authorization']['clientID'], 'updated' => '', - 'updatedby' => $_SESSION['username'] + 'updatedby' => $_SESSION['authorization']['clientID'] ]; // Check if coming from version page (id parameter) or editing existing path diff --git a/products_software_version.php b/products_software_version.php index 5c5bb7f..a73909d 100644 --- a/products_software_version.php +++ b/products_software_version.php @@ -1,7 +1,7 @@ '', 'status' => 1, 'created' => '', - 'createdby' => $_SESSION['username'], + 'createdby' => $_SESSION['authorization']['clientID'], 'updated' => '', - 'updatedby' => $_SESSION['username'] + 'updatedby' => $_SESSION['authorization']['clientID'] ]; // If editing, fetch existing data diff --git a/products_software_versions.php b/products_software_versions.php index 2cd45e0..71c2f92 100644 --- a/products_software_versions.php +++ b/products_software_versions.php @@ -1,7 +1,7 @@ '', 'config' => '', 'created' => '', - 'createdby' => $_SESSION['username'], + 'createdby' => $_SESSION['authorization']['clientID'], 'measurement' => '', ]; diff --git a/profile.php b/profile.php index ff0df19..6122919 100644 --- a/profile.php +++ b/profile.php @@ -3,14 +3,14 @@ defined(page_security_key) or exit; $page = 'profile'; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security -$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); // Default input product values $user = [ @@ -29,7 +29,7 @@ $user = [ // ID param exists, edit an existing product //CALL TO API -$api_url = '/v1/profile/userkey='.$_SESSION['userkey']; +$api_url = '/v1/profile/userkey='.$_SESSION['authorization']['userkey']; $responses = ioServer($api_url,''); //Decode Payload if (!empty($responses)){$responses = decode_payload($responses);}else{$responses = null;} @@ -75,7 +75,7 @@ if ($update_allowed === 1){ //------------------------------------ //CHECK IF USER IS ALSO CREATOR OF RECORD THEN OVERRIDE UPDATE_ALLOWED_EDIT //------------------------------------ -$update_allowed = (($user['username'] == $_SESSION['username'])? 1 : 0); +$update_allowed = (($user['username'] == $_SESSION['authorization']['clientID'])? 1 : 0); template_header('Profile', 'profile', 'manage'); @@ -85,7 +85,7 @@ $view ='

'.$user_h2.'

'; -if ($update_allowed === 1 && $_SESSION['permission'] != 0){ +if ($update_allowed === 1 && $_SESSION['authorization']['permission'] != 0){ $view .= ''; } @@ -108,7 +108,7 @@ $view .= '
- + @@ -120,7 +120,7 @@ $view .= '
$view .=' '; - if ($update_allowed === 1 && $_SESSION['permission'] != 0){ + if ($update_allowed === 1 && $_SESSION['authorization']['permission'] != 0){ $view .= ' '; diff --git a/profiles.php b/profiles.php index 0a6879d..0785010 100644 --- a/profiles.php +++ b/profiles.php @@ -12,7 +12,7 @@ include dirname(__FILE__).'/settings/settingsviews.php'; $page = 'profiles'; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } diff --git a/register.php b/register.php index e963915..e2e46fe 100644 --- a/register.php +++ b/register.php @@ -32,12 +32,10 @@ if (isset($_POST['register'])){ $register = $_POST; //GET USERKEY $data = json_encode(array("username" => interface_user, "password" => interface_pw), JSON_UNESCAPED_UNICODE); - //Secure data - $payload = generate_payload($data); //API call - $responses = ioServer('/v1/authorization', $payload); + $responses = ioServer('/v2/authorization', $data); //Decode Payload - if (!empty($responses)){$responses = decode_payload($responses);}else{$responses = '400';} + if (!empty($responses)){$responses = json_decode($responses,true);}else{$responses = '400';} if ($responses === 'NOK' || $responses === '400'){ //Not allowed @@ -47,7 +45,7 @@ if (isset($_POST['register'])){ // Start a new session session_start(); // Store data in session - $_SESSION['userkey'] = $responses->userkey; + $_SESSION['authorization']['userkey'] = $responses['userkey']; // GET ALL POST DATA $data = json_encode($register, JSON_UNESCAPED_UNICODE); // Secure data diff --git a/report_build.php b/report_build.php index a5469f5..55b4143 100644 --- a/report_build.php +++ b/report_build.php @@ -1,7 +1,7 @@ ←':''; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } diff --git a/report_healthindex.php b/report_healthindex.php index 9084994..d4c469e 100644 --- a/report_healthindex.php +++ b/report_healthindex.php @@ -1,7 +1,7 @@ ←':''; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } @@ -135,7 +135,7 @@ $view .= ' '; //SHOW DOWNLOAD TO EXCELL OPTION ONLY TO ADMIN USERS -if ($_SESSION['permission'] == 3 || $_SESSION['permission'] == 4){ +if ($_SESSION['authorization']['permission'] == 3 || $_SESSION['authorization']['permission'] == 4){ $view .='
'; diff --git a/report_usage.php b/report_usage.php index a64b808..cb3a38f 100644 --- a/report_usage.php +++ b/report_usage.php @@ -1,7 +1,7 @@ $username, "resetkey" => ''), JSON_UNESCAPED_UNICODE); - //Secure data - $payload = generate_payload($data); //API call - $responses = ioServer('/v1/authorization', $payload); + $responses = ioServer('/v2/authorization', $data); //Decode Payload - if (!empty($responses)){$responses = decode_payload($responses);}else{$responses = '400';} + if (!empty($responses)){$responses = json_decode($responses);}else{$responses = '400';} if ($responses === 'NOK'){ $username_err = $password_err_1 ?? 'Not authorized, please retry'; @@ -107,11 +105,9 @@ if (isset($_POST['resetkey']) && $_POST['resetkey'] !='' && $_POST['password_upd else { //UPDATE PASSWORD $data = json_encode(array("password" => $password, "resetkey" => $resetkey), JSON_UNESCAPED_UNICODE); - //Secure data - $payload = generate_payload($data); //API call - $responses = ioServer('/v1/authorization', $payload); - if (!empty($responses)){$responses = decode_payload($responses);}else{$responses = '400';} + $responses = ioServer('/v2/authorization', $data); + if (!empty($responses)){$responses = json_decode($responses);}else{$responses = '400';} if ($responses === 'NOK'){ $username_err = $password_err_1 ?? 'Not authorized, please retry'; diff --git a/rma.php b/rma.php index d3de1d9..9e01d8d 100644 --- a/rma.php +++ b/rma.php @@ -1,7 +1,7 @@ '.$general_filters_clear.''; //SHOW DOWNLOAD TO EXCELL OPTION ONLY TO ADMIN USERS -if ($_SESSION['permission'] == 3 || $_SESSION['permission'] == 4){ +if ($_SESSION['authorization']['permission'] == 3 || $_SESSION['authorization']['permission'] == 4){ $view .= ' Download '; diff --git a/servicereport.php b/servicereport.php index 426803e..f37f06b 100644 --- a/servicereport.php +++ b/servicereport.php @@ -1,7 +1,7 @@ ←':''; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } diff --git a/settings.php b/settings.php index 5e3bd34..365c80b 100644 --- a/settings.php +++ b/settings.php @@ -8,7 +8,7 @@ $domain = getDomainName($_SERVER['SERVER_NAME']); $file = ((file_exists(dirname(__FILE__).'/custom/'.$domain.'/settings/'.$domain.'_config.php')) ? dirname(__FILE__).'/custom/'.$domain.'/settings/'.$domain.'_config.php' : dirname(__FILE__).'/settings/config.php'); //Check if allowed -if (isAllowed('settings',$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed('settings',$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } @@ -101,7 +101,7 @@ if (isset($_POST['submit']) && !empty($_POST)) { if (isset($_POST['geoupdate'])){ //GEOLOCATION UPDATE - geolocationUpdate($_SESSION['userkey']); + geolocationUpdate($_SESSION['authorization']['userkey']); } if (isset($_POST['updatecartest'])){ diff --git a/settings/settingsmenu.php b/settings/settingsmenu.php index b49526e..36557b9 100644 --- a/settings/settingsmenu.php +++ b/settings/settingsmenu.php @@ -353,7 +353,7 @@ $page_rows_folders = 25; //marketing folders //------------------------------------------ // Languages supported //------------------------------------------ -$supportedLanguages = ['US', 'NL', 'DE', 'ES','PT']; +$supportedLanguages = ['US', 'NL', 'DE', 'ES','PL','PT']; //------------------------------------------ // Pricing diff --git a/settings/settingsprofiles.php b/settings/settingsprofiles.php index 25a18d9..012f7ae 100644 --- a/settings/settingsprofiles.php +++ b/settings/settingsprofiles.php @@ -1,27 +1,27 @@ \ No newline at end of file diff --git a/settings/settingsviews.php b/settings/settingsviews.php index 6d0d3e4..f366609 100644 --- a/settings/settingsviews.php +++ b/settings/settingsviews.php @@ -4,6 +4,9 @@ // All individual views and APIs - Profile ++++++++++++++ // +++++++++++++++++++++++++++++++++++++++++++++++++++++++ $all_views = [ + "access_element", + "access_element_manage", + "access_elements", "account", "account_manage", "accounts", @@ -112,6 +115,7 @@ $all_views = [ "register", "render_service_report", "report_build", + "report_builder", "report_contracts_billing", "report_healthindex", "report_usage", @@ -122,6 +126,7 @@ $all_views = [ "rma_history_manage", "rma_manage", "rmas", + "role_access_permissions", "sales", "security", "service", @@ -149,6 +154,10 @@ $all_views = [ "user", "user_credentials", "user_manage", + "user_role", + "user_role_assignments", + "user_role_manage", + "user_roles", "users", "vin", "webhook_mollie", diff --git a/shipping.php b/shipping.php index 16982bc..45b2b9d 100644 --- a/shipping.php +++ b/shipping.php @@ -1,7 +1,7 @@ '', diff --git a/softwaretool.php b/softwaretool.php index 398d1b4..cd971b9 100644 --- a/softwaretool.php +++ b/softwaretool.php @@ -1,7 +1,7 @@ diff --git a/translation_manage.php b/translation_manage.php index e9ba952..0cbef61 100644 --- a/translation_manage.php +++ b/translation_manage.php @@ -3,16 +3,16 @@ defined(page_security_key) or exit; $page = 'translation_manage'; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security -$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); // Default input product values $text_variable = [ @@ -66,8 +66,8 @@ if (isset($_GET['rowID'])) { if ($responses === 'NOK'){ } else { - if ($_SESSION['permission'] == 4){ - generateLanguageFile($_POST['language_key'],$_SESSION['userkey']); + if ($_SESSION['authorization']['permission'] == 4){ + generateLanguageFile($_POST['language_key'],$_SESSION['authorization']['userkey']); } header('Location: index.php?page=translation_manage&rowID='.$_GET['rowID'].''); exit; @@ -99,8 +99,8 @@ if (isset($_GET['rowID'])) { if ($NOK_error == 0){ //NO errors generatelanguagefile - if ($_SESSION['permission'] == 4){ - generateLanguageFile($attr_language,$_SESSION['userkey']); + if ($_SESSION['authorization']['permission'] == 4){ + generateLanguageFile($attr_language,$_SESSION['authorization']['userkey']); } } diff --git a/translations.php b/translations.php index e0fc2fc..bde711e 100644 --- a/translations.php +++ b/translations.php @@ -1,7 +1,7 @@ interface_user, "password" => interface_pw), JSON_UNESCAPED_UNICODE); - //Secure data - $payload = generate_payload($data); //API call - $responses = ioServer('/v1/authorization', $payload); + $responses = ioServer('/v2/authorization', $data); //Decode Payload - if (!empty($responses)){$responses = decode_payload($responses);}else{$responses = '400';} + if (!empty($responses)){$responses = json_decode($responses,true);}else{$responses = '400';} if ($responses === 'NOK' || $responses === '400'){ //Not allowed @@ -25,7 +23,7 @@ if (isset($_GET['email'])){ // Start a new session session_start(); // Store data in session - $_SESSION['userkey'] = $responses->userkey; + $_SESSION['authorization']['userkey'] = $responses['userkey']; // GET ALL POST DATA $data = json_encode($unscribe, JSON_UNESCAPED_UNICODE); // Secure data diff --git a/uploader.php b/uploader.php index ec9dcee..2cfa79d 100644 --- a/uploader.php +++ b/uploader.php @@ -3,14 +3,14 @@ defined(page_security_key) or exit; $page = 'uploader'; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security -$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); if ($create_allowed === 1 && $_POST){ diff --git a/user.php b/user.php index 4aa74e9..8db6e34 100644 --- a/user.php +++ b/user.php @@ -1,7 +1,7 @@ '; -if ($_SESSION['permission'] == 3){ +if ($_SESSION['authorization']['permission'] == 3){ $view .= ''; } -if ($_SESSION['permission'] == 4){ +if ($_SESSION['authorization']['permission'] == 4){ $view .= ' '; } @@ -360,7 +360,7 @@ $view .= ' '.($user->settings ?? '-').''; -if ($_SESSION['permission'] == 3 || $_SESSION['permission'] == 4){ +if ($_SESSION['authorization']['permission'] == 3 || $_SESSION['authorization']['permission'] == 4){ $view .= ''; } else { $view .= ''; diff --git a/user_role.php b/user_role.php index 86ed8ce..021de77 100644 --- a/user_role.php +++ b/user_role.php @@ -1,7 +1,7 @@ '', 'is_active' => 1, 'created' => '', - 'createdby' => $_SESSION['username'], + 'createdby' => $_SESSION['authorization']['clientID'], 'updated' => '', 'updatedby' => '' ]; diff --git a/user_roles.php b/user_roles.php index daf39af..9ddde59 100644 --- a/user_roles.php +++ b/user_roles.php @@ -1,7 +1,7 @@ ←':''; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security $page_manage = 'user_role_manage'; -$update_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); //GET PARAMETERS && STORE in SESSION for FURTHER USE/NAVIGATION $pagination_page = $_SESSION['p'] = isset($_GET['p']) ? $_GET['p'] : 1; diff --git a/users.php b/users.php index 624356a..1d98e22 100644 --- a/users.php +++ b/users.php @@ -1,7 +1,7 @@ ←':''; //Check if allowed -if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){ +if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){ header('location: index.php'); exit; } //PAGE Security -$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U'); -$delete_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'D'); -$create_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'C'); +$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U'); +$delete_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D'); +$create_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C'); //GET PARAMETERS