Add user role management functionality with CRUD operations and permissions handling
- Created user_role.php for viewing and editing user roles and their permissions. - Implemented inline editing for role details and permissions. - Added user_role_manage.php for creating and managing user roles. - Introduced user_roles.php for listing all user roles with pagination and filtering options. - Integrated API calls for fetching and updating role data and permissions. - Enhanced user interface with success messages and navigation controls.
This commit is contained in:
“VeLiTi”
79
api/v2/post/access_elements.php
Normal file
79
api/v2/post/access_elements.php
Normal file
@@ -0,0 +1,79 @@
|
||||
<?php
|
||||
defined($security_key) or exit;
|
||||
|
||||
//------------------------------------------
|
||||
// Access Elements
|
||||
//------------------------------------------
|
||||
//Connect to DB
|
||||
$pdo = dbConnect($dbname);
|
||||
|
||||
//CONTENT FROM API (POST)
|
||||
$post_content = json_decode($input,true);
|
||||
|
||||
//SET PARAMETERS FOR QUERY
|
||||
$id = $post_content['rowID'] ?? '';
|
||||
$command = ($id == '')? 'insert' : 'update';
|
||||
if (isset($post_content['delete'])){$command = 'delete';}
|
||||
$date = date('Y-m-d H:i:s');
|
||||
|
||||
//CREATE EMPTY STRINGS
|
||||
$clause = '';
|
||||
$clause_insert ='';
|
||||
$input_insert = '';
|
||||
$execute_input = [];
|
||||
$criterias = [];
|
||||
|
||||
//ADD STANDARD PARAMETERS TO ARRAY BASED ON INSERT OR UPDATE
|
||||
if ($command == 'update'){
|
||||
$post_content['updatedby'] = $username;;
|
||||
$post_content['updated'] = $date;
|
||||
}
|
||||
elseif ($command == 'insert'){
|
||||
$post_content['created'] = $date;
|
||||
$post_content['createdby'] = $username;;
|
||||
}
|
||||
|
||||
//CREAT NEW ARRAY AND MAP TO CLAUSE
|
||||
if(isset($post_content) && $post_content!=''){
|
||||
foreach ($post_content as $key => $var){
|
||||
if ($key == 'submit' || $key == 'rowID' || str_contains($key, 'old_')){
|
||||
//do nothing
|
||||
}
|
||||
else {
|
||||
$criterias[$key] = $var;
|
||||
$clause .= ' , '.$key.' = ?';
|
||||
$clause_insert .= ' , '.$key.'';
|
||||
$input_insert .= ', ?';
|
||||
$execute_input[]= $var;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
//CLEAN UP INPUT
|
||||
$clause = substr($clause, 2);
|
||||
$clause_insert = substr($clause_insert, 2);
|
||||
$input_insert = substr($input_insert, 1);
|
||||
|
||||
//QUERY AND VERIFY ALLOWED
|
||||
if ($command == 'update' && isAllowed('access_element_manage',$profile,$permission,'U') === 1){
|
||||
$sql = 'UPDATE access_elements SET '.$clause.' WHERE rowID = ?';
|
||||
$execute_input[] = $id;
|
||||
$stmt = $pdo->prepare($sql);
|
||||
$stmt->execute($execute_input);
|
||||
}
|
||||
elseif ($command == 'insert' && isAllowed('access_element_manage',$profile,$permission,'C') === 1){
|
||||
$sql = 'INSERT INTO access_elements ('.$clause_insert.') VALUES ('.$input_insert.')';
|
||||
$stmt = $pdo->prepare($sql);
|
||||
$stmt->execute($execute_input);
|
||||
}
|
||||
elseif ($command == 'delete' && isAllowed('access_element_manage',$profile,$permission,'D') === 1){
|
||||
//Delete role permissions using this access element first (foreign key constraint)
|
||||
$stmt = $pdo->prepare('DELETE FROM role_access_permissions WHERE access_id = ?');
|
||||
$stmt->execute([$id]);
|
||||
|
||||
//Delete access element
|
||||
$stmt = $pdo->prepare('DELETE FROM access_elements WHERE rowID = ?');
|
||||
$stmt->execute([$id]);
|
||||
}
|
||||
|
||||
?>
|
||||
124
api/v2/post/report_builder.php
Normal file
124
api/v2/post/report_builder.php
Normal file
@@ -0,0 +1,124 @@
|
||||
<?php
|
||||
defined($security_key) or exit;
|
||||
|
||||
//------------------------------------------
|
||||
// Report Builder - POST Endpoints
|
||||
//------------------------------------------
|
||||
|
||||
// Set content type to JSON
|
||||
header('Content-Type: application/json');
|
||||
|
||||
// Connect to DB
|
||||
$pdo = dbConnect($dbname);
|
||||
|
||||
// Parse input data
|
||||
$data = json_decode($input, true);
|
||||
$action = strtolower($data['action'] ?? '');
|
||||
|
||||
/**
|
||||
* Security check: Only allow SELECT queries
|
||||
*/
|
||||
function isSelectQuery($query) {
|
||||
$query = trim($query);
|
||||
$query = preg_replace('/\s+/', ' ', $query); // Normalize whitespace
|
||||
|
||||
// Only allow SELECT queries
|
||||
if (!preg_match('/^SELECT\s/i', $query)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Block dangerous keywords that could be used for injection
|
||||
$dangerousPatterns = [
|
||||
'/;\s*DROP\s/i',
|
||||
'/;\s*DELETE\s/i',
|
||||
'/;\s*UPDATE\s/i',
|
||||
'/;\s*INSERT\s/i',
|
||||
'/;\s*CREATE\s/i',
|
||||
'/;\s*ALTER\s/i',
|
||||
'/;\s*TRUNCATE\s/i',
|
||||
'/INTO\s+OUTFILE\s/i',
|
||||
'/LOAD_FILE\s*\(/i',
|
||||
'/SLEEP\s*\(/i',
|
||||
'/BENCHMARK\s*\(/i',
|
||||
];
|
||||
|
||||
foreach ($dangerousPatterns as $pattern) {
|
||||
if (preg_match($pattern, $query)) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Execute a SELECT query
|
||||
*/
|
||||
if ($action === 'executequery') {
|
||||
$query = $data['query'] ?? '';
|
||||
|
||||
if (empty($query)) {
|
||||
http_response_code(400);
|
||||
$messages = json_encode([
|
||||
'success' => false,
|
||||
'message' => 'Query parameter is required'
|
||||
], JSON_UNESCAPED_UNICODE);
|
||||
}
|
||||
// Security check: only allow SELECT queries
|
||||
elseif (!isSelectQuery($query)) {
|
||||
http_response_code(400);
|
||||
$messages = json_encode([
|
||||
'success' => false,
|
||||
'message' => 'Only SELECT queries are allowed'
|
||||
], JSON_UNESCAPED_UNICODE);
|
||||
} else {
|
||||
try {
|
||||
// Execute the query
|
||||
$stmt = $pdo->query($query);
|
||||
|
||||
// Fetch all results
|
||||
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);
|
||||
|
||||
// Get row count
|
||||
$rowCount = count($results);
|
||||
|
||||
// Limit results to prevent memory issues
|
||||
$maxResults = 5000;
|
||||
if ($rowCount > $maxResults) {
|
||||
$results = array_slice($results, 0, $maxResults);
|
||||
$message = "Query executed successfully. Showing first $maxResults of $rowCount rows.";
|
||||
} else {
|
||||
$message = "Query executed successfully. $rowCount rows returned.";
|
||||
}
|
||||
|
||||
$messages = json_encode([
|
||||
'success' => true,
|
||||
'results' => $results,
|
||||
'rowCount' => $rowCount,
|
||||
'message' => $message
|
||||
], JSON_UNESCAPED_UNICODE);
|
||||
|
||||
} catch (PDOException $e) {
|
||||
http_response_code(400);
|
||||
$messages = json_encode([
|
||||
'success' => false,
|
||||
'message' => 'Query execution failed: ' . $e->getMessage()
|
||||
], JSON_UNESCAPED_UNICODE);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Invalid or missing action
|
||||
*/
|
||||
else {
|
||||
http_response_code(400);
|
||||
$messages = json_encode([
|
||||
'success' => false,
|
||||
'message' => 'Invalid or missing action parameter'
|
||||
], JSON_UNESCAPED_UNICODE);
|
||||
}
|
||||
|
||||
// Send results
|
||||
echo $messages;
|
||||
?>
|
||||
75
api/v2/post/role_access_permissions.php
Normal file
75
api/v2/post/role_access_permissions.php
Normal file
@@ -0,0 +1,75 @@
|
||||
<?php
|
||||
defined($security_key) or exit;
|
||||
|
||||
//------------------------------------------
|
||||
// Role Access Permissions
|
||||
//------------------------------------------
|
||||
//Connect to DB
|
||||
$pdo = dbConnect($dbname);
|
||||
|
||||
//CONTENT FROM API (POST)
|
||||
$post_content = json_decode($input,true);
|
||||
|
||||
//SET PARAMETERS FOR QUERY
|
||||
$id = $post_content['rowID'] ?? '';
|
||||
$command = ($id == '')? 'insert' : 'update';
|
||||
if (isset($post_content['delete'])){$command = 'delete';}
|
||||
$date = date('Y-m-d H:i:s');
|
||||
|
||||
//CREATE EMPTY STRINGS
|
||||
$clause = '';
|
||||
$clause_insert ='';
|
||||
$input_insert = '';
|
||||
$execute_input = [];
|
||||
$criterias = [];
|
||||
|
||||
//ADD STANDARD PARAMETERS TO ARRAY BASED ON INSERT OR UPDATE
|
||||
if ($command == 'update'){
|
||||
$post_content['updatedby'] = $username;;
|
||||
$post_content['updated'] = $date;
|
||||
}
|
||||
elseif ($command == 'insert'){
|
||||
$post_content['created'] = $date;
|
||||
$post_content['createdby'] = $username;;
|
||||
}
|
||||
|
||||
//CREAT NEW ARRAY AND MAP TO CLAUSE
|
||||
if(isset($post_content) && $post_content!=''){
|
||||
foreach ($post_content as $key => $var){
|
||||
if ($key == 'submit' || $key == 'rowID' || str_contains($key, 'old_')){
|
||||
//do nothing
|
||||
}
|
||||
else {
|
||||
$criterias[$key] = $var;
|
||||
$clause .= ' , '.$key.' = ?';
|
||||
$clause_insert .= ' , '.$key.'';
|
||||
$input_insert .= ', ?';
|
||||
$execute_input[]= $var;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
//CLEAN UP INPUT
|
||||
$clause = substr($clause, 2);
|
||||
$clause_insert = substr($clause_insert, 2);
|
||||
$input_insert = substr($input_insert, 1);
|
||||
|
||||
//QUERY AND VERIFY ALLOWED
|
||||
if ($command == 'update' && isAllowed('user_role_manage',$profile,$permission,'U') === 1){
|
||||
$sql = 'UPDATE role_access_permissions SET '.$clause.' WHERE rowID = ?';
|
||||
$execute_input[] = $id;
|
||||
$stmt = $pdo->prepare($sql);
|
||||
$stmt->execute($execute_input);
|
||||
}
|
||||
elseif ($command == 'insert' && isAllowed('user_role_manage',$profile,$permission,'C') === 1){
|
||||
$sql = 'INSERT INTO role_access_permissions ('.$clause_insert.') VALUES ('.$input_insert.')';
|
||||
$stmt = $pdo->prepare($sql);
|
||||
$stmt->execute($execute_input);
|
||||
}
|
||||
elseif ($command == 'delete' && isAllowed('user_role_manage',$profile,$permission,'D') === 1){
|
||||
//Delete permission
|
||||
$stmt = $pdo->prepare('DELETE FROM role_access_permissions WHERE rowID = ?');
|
||||
$stmt->execute([$id]);
|
||||
}
|
||||
|
||||
?>
|
||||
141
api/v2/post/user_role_assignments.php
Normal file
141
api/v2/post/user_role_assignments.php
Normal file
@@ -0,0 +1,141 @@
|
||||
<?php
|
||||
defined($security_key) or exit;
|
||||
|
||||
//------------------------------------------
|
||||
// User Role Assignments
|
||||
//------------------------------------------
|
||||
//Connect to DB
|
||||
$pdo = dbConnect($dbname);
|
||||
|
||||
//CONTENT FROM API (POST)
|
||||
$post_content = json_decode($input,true);
|
||||
|
||||
//SET PARAMETERS FOR QUERY
|
||||
$id = $post_content['rowID'] ?? '';
|
||||
$date = date('Y-m-d H:i:s');
|
||||
|
||||
//------------------------------------------
|
||||
// BATCH UPDATE - Update all roles for a user
|
||||
//------------------------------------------
|
||||
if (isset($post_content['batch_update']) && isset($post_content['user_id']) && isAllowed('user_manage',$profile,$permission,'U') === 1){
|
||||
$user_id = $post_content['user_id'];
|
||||
$selected_roles = $post_content['roles'] ?? [];
|
||||
|
||||
//Get currently assigned active roles
|
||||
$stmt = $pdo->prepare('SELECT role_id, rowID FROM user_role_assignments WHERE user_id = ? AND is_active = 1');
|
||||
$stmt->execute([$user_id]);
|
||||
$current_roles = [];
|
||||
while ($row = $stmt->fetch(PDO::FETCH_ASSOC)){
|
||||
$current_roles[$row['role_id']] = $row['rowID'];
|
||||
}
|
||||
|
||||
//Remove roles that are no longer selected (soft delete)
|
||||
foreach ($current_roles as $role_id => $assignment_id){
|
||||
if (!in_array($role_id, $selected_roles)){
|
||||
$stmt = $pdo->prepare('UPDATE user_role_assignments SET is_active = 0, updatedby = ?, updated = ? WHERE rowID = ?');
|
||||
$stmt->execute([$username, $date, $assignment_id]);
|
||||
}
|
||||
}
|
||||
|
||||
//Add new roles that are selected but not currently assigned
|
||||
foreach ($selected_roles as $role_id){
|
||||
if (!array_key_exists($role_id, $current_roles)){
|
||||
//Check if this user-role combination existed before (inactive)
|
||||
$stmt = $pdo->prepare('SELECT rowID FROM user_role_assignments WHERE user_id = ? AND role_id = ? AND is_active = 0 LIMIT 1');
|
||||
$stmt->execute([$user_id, $role_id]);
|
||||
$existing = $stmt->fetch(PDO::FETCH_ASSOC);
|
||||
|
||||
if ($existing){
|
||||
//Reactivate existing assignment
|
||||
$stmt = $pdo->prepare('UPDATE user_role_assignments SET is_active = 1, assigned_by = ?, assigned_at = ?, updatedby = ?, updated = ? WHERE rowID = ?');
|
||||
$stmt->execute([$username, $date, $username, $date, $existing['rowID']]);
|
||||
} else {
|
||||
//Create new assignment
|
||||
$stmt = $pdo->prepare('INSERT INTO user_role_assignments (user_id, role_id, is_active, assigned_by, assigned_at, created, createdby) VALUES (?, ?, 1, ?, ?, ?, ?)');
|
||||
$stmt->execute([$user_id, $role_id, $username, $date, $date, $userkey]);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
//------------------------------------------
|
||||
// SINGLE OPERATIONS (for backward compatibility or direct API calls)
|
||||
//------------------------------------------
|
||||
else {
|
||||
$command = ($id == '')? 'insert' : 'update';
|
||||
if (isset($post_content['delete'])){$command = 'delete';}
|
||||
|
||||
//CREATE EMPTY STRINGS
|
||||
$clause = '';
|
||||
$clause_insert ='';
|
||||
$input_insert = '';
|
||||
$execute_input = [];
|
||||
$criterias = [];
|
||||
|
||||
//ADD STANDARD PARAMETERS TO ARRAY BASED ON INSERT OR UPDATE
|
||||
if ($command == 'update'){
|
||||
$post_content['updatedby'] = $username;
|
||||
$post_content['updated'] = $date;
|
||||
}
|
||||
elseif ($command == 'insert'){
|
||||
$post_content['created'] = $date;
|
||||
$post_content['createdby'] = $username;
|
||||
$post_content['assigned_by'] = $username;
|
||||
$post_content['assigned_at'] = $date;
|
||||
}
|
||||
|
||||
//CREAT NEW ARRAY AND MAP TO CLAUSE
|
||||
if(isset($post_content) && $post_content!=''){
|
||||
foreach ($post_content as $key => $var){
|
||||
if ($key == 'submit' || $key == 'rowID' || $key == 'delete' || $key == 'batch_update' || str_contains($key, 'old_')){
|
||||
//do nothing
|
||||
}
|
||||
else {
|
||||
$criterias[$key] = $var;
|
||||
$clause .= ' , '.$key.' = ?';
|
||||
$clause_insert .= ' , '.$key.'';
|
||||
$input_insert .= ', ?';
|
||||
$execute_input[]= $var;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
//CLEAN UP INPUT
|
||||
$clause = substr($clause, 2);
|
||||
$clause_insert = substr($clause_insert, 2);
|
||||
$input_insert = substr($input_insert, 1);
|
||||
|
||||
//QUERY AND VERIFY ALLOWED
|
||||
if ($command == 'update' && isAllowed('user_manage',$profile,$permission,'U') === 1){
|
||||
$sql = 'UPDATE user_role_assignments SET '.$clause.' WHERE rowID = ?';
|
||||
$execute_input[] = $id;
|
||||
$stmt = $pdo->prepare($sql);
|
||||
$stmt->execute($execute_input);
|
||||
}
|
||||
elseif ($command == 'insert' && isAllowed('user_manage',$profile,$permission,'C') === 1){
|
||||
//Check if this user-role combination already exists (including inactive ones)
|
||||
$stmt = $pdo->prepare('SELECT rowID, is_active FROM user_role_assignments WHERE user_id = ? AND role_id = ? LIMIT 1');
|
||||
$stmt->execute([$post_content['user_id'], $post_content['role_id']]);
|
||||
$existing = $stmt->fetch(PDO::FETCH_ASSOC);
|
||||
|
||||
if ($existing){
|
||||
//If exists but inactive, reactivate it
|
||||
if ($existing['is_active'] == 0){
|
||||
$stmt = $pdo->prepare('UPDATE user_role_assignments SET is_active = 1, assigned_by = ?, assigned_at = ?, updatedby = ?, updated = ? WHERE rowID = ?');
|
||||
$stmt->execute([$username, $date, $username, $date, $existing['rowID']]);
|
||||
}
|
||||
//If already active, do nothing (or could throw an error)
|
||||
} else {
|
||||
//Insert new assignment
|
||||
$sql = 'INSERT INTO user_role_assignments ('.$clause_insert.') VALUES ('.$input_insert.')';
|
||||
$stmt = $pdo->prepare($sql);
|
||||
$stmt->execute($execute_input);
|
||||
}
|
||||
}
|
||||
elseif ($command == 'delete' && isAllowed('user_manage',$profile,$permission,'D') === 1){
|
||||
//Soft delete by setting is_active to 0
|
||||
$stmt = $pdo->prepare('UPDATE user_role_assignments SET is_active = 0, updatedby = ?, updated = ? WHERE rowID = ?');
|
||||
$stmt->execute([$username, $date, $id]);
|
||||
}
|
||||
}
|
||||
|
||||
?>
|
||||
123
api/v2/post/user_roles.php
Normal file
123
api/v2/post/user_roles.php
Normal file
@@ -0,0 +1,123 @@
|
||||
<?php
|
||||
defined($security_key) or exit;
|
||||
|
||||
//------------------------------------------
|
||||
// User Roles
|
||||
//------------------------------------------
|
||||
//Connect to DB
|
||||
$pdo = dbConnect($dbname);
|
||||
|
||||
//CONTENT FROM API (POST)
|
||||
$post_content = json_decode($input,true);
|
||||
|
||||
//SET PARAMETERS FOR QUERY
|
||||
$id = $post_content['rowID'] ?? '';
|
||||
$command = ($id == '')? 'insert' : 'update';
|
||||
if (isset($post_content['delete'])){$command = 'delete';}
|
||||
$date = date('Y-m-d H:i:s');
|
||||
|
||||
//CREATE EMPTY STRINGS
|
||||
$clause = '';
|
||||
$clause_insert ='';
|
||||
$input_insert = '';
|
||||
$execute_input = [];
|
||||
$criterias = [];
|
||||
|
||||
//ADD STANDARD PARAMETERS TO ARRAY BASED ON INSERT OR UPDATE
|
||||
if ($command == 'update'){
|
||||
$post_content['updatedby'] = $username;
|
||||
$post_content['updated'] = $date;
|
||||
}
|
||||
elseif ($command == 'insert'){
|
||||
$post_content['created'] = $date;
|
||||
$post_content['createdby'] = $username;
|
||||
}
|
||||
|
||||
//CREAT NEW ARRAY AND MAP TO CLAUSE
|
||||
if(isset($post_content) && $post_content!=''){
|
||||
foreach ($post_content as $key => $var){
|
||||
if ($key == 'submit' || $key == 'rowID' || $key == 'permissions' || str_contains($key, 'old_')){
|
||||
//do nothing
|
||||
}
|
||||
else {
|
||||
$criterias[$key] = $var;
|
||||
$clause .= ' , '.$key.' = ?';
|
||||
$clause_insert .= ' , '.$key.'';
|
||||
$input_insert .= ', ?';
|
||||
$execute_input[]= $var;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
//CLEAN UP INPUT
|
||||
$clause = substr($clause, 2);
|
||||
$clause_insert = substr($clause_insert, 2);
|
||||
$input_insert = substr($input_insert, 1);
|
||||
|
||||
//QUERY AND VERIFY ALLOWED
|
||||
if ($command == 'update' && isAllowed('user_role_manage',$profile,$permission,'U') === 1){
|
||||
$sql = 'UPDATE user_roles SET '.$clause.' WHERE rowID = ?';
|
||||
$execute_input[] = $id;
|
||||
$stmt = $pdo->prepare($sql);
|
||||
$stmt->execute($execute_input);
|
||||
|
||||
//Handle permissions update
|
||||
if (isset($post_content['permissions'])){
|
||||
//First delete all existing permissions for this role
|
||||
$stmt = $pdo->prepare('DELETE FROM role_access_permissions WHERE role_id = ?');
|
||||
$stmt->execute([$id]);
|
||||
|
||||
//Insert new permissions
|
||||
foreach ($post_content['permissions'] as $access_id => $perms){
|
||||
$can_create = isset($perms['can_create']) ? 1 : 0;
|
||||
$can_read = isset($perms['can_read']) ? 1 : 0;
|
||||
$can_update = isset($perms['can_update']) ? 1 : 0;
|
||||
$can_delete = isset($perms['can_delete']) ? 1 : 0;
|
||||
|
||||
//Only insert if at least one permission is set
|
||||
if ($can_create || $can_read || $can_update || $can_delete){
|
||||
$stmt = $pdo->prepare('INSERT INTO role_access_permissions (role_id, access_id, can_create, can_read, can_update, can_delete, created, createdby) VALUES (?, ?, ?, ?, ?, ?, ?, ?)');
|
||||
$stmt->execute([$id, $access_id, $can_create, $can_read, $can_update, $can_delete, $date, $userkey]);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
elseif ($command == 'insert' && isAllowed('user_role_manage',$profile,$permission,'C') === 1){
|
||||
$sql = 'INSERT INTO user_roles ('.$clause_insert.') VALUES ('.$input_insert.')';
|
||||
$stmt = $pdo->prepare($sql);
|
||||
$stmt->execute($execute_input);
|
||||
|
||||
//Get the new role ID
|
||||
$new_role_id = $pdo->lastInsertId();
|
||||
|
||||
//Handle permissions for new role
|
||||
if (isset($post_content['permissions'])){
|
||||
foreach ($post_content['permissions'] as $access_id => $perms){
|
||||
$can_create = isset($perms['can_create']) ? 1 : 0;
|
||||
$can_read = isset($perms['can_read']) ? 1 : 0;
|
||||
$can_update = isset($perms['can_update']) ? 1 : 0;
|
||||
$can_delete = isset($perms['can_delete']) ? 1 : 0;
|
||||
|
||||
//Only insert if at least one permission is set
|
||||
if ($can_create || $can_read || $can_update || $can_delete){
|
||||
$stmt = $pdo->prepare('INSERT INTO role_access_permissions (role_id, access_id, can_create, can_read, can_update, can_delete, created, createdby) VALUES (?, ?, ?, ?, ?, ?, ?, ?)');
|
||||
$stmt->execute([$new_role_id, $access_id, $can_create, $can_read, $can_update, $can_delete, $date, $userkey]);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
elseif ($command == 'delete' && isAllowed('user_role_manage',$profile,$permission,'D') === 1){
|
||||
//Delete role permissions first (foreign key constraint)
|
||||
$stmt = $pdo->prepare('DELETE FROM role_access_permissions WHERE role_id = ?');
|
||||
$stmt->execute([$id]);
|
||||
|
||||
//Delete user role assignments
|
||||
$stmt = $pdo->prepare('DELETE FROM user_role_assignments WHERE role_id = ?');
|
||||
$stmt->execute([$id]);
|
||||
|
||||
//Delete role
|
||||
$stmt = $pdo->prepare('DELETE FROM user_roles WHERE rowID = ?');
|
||||
$stmt->execute([$id]);
|
||||
}
|
||||
|
||||
?>
|
||||
@@ -44,10 +44,11 @@ $user_name_old = $user_data['username'];
|
||||
$view_old = $user_data['view'];
|
||||
$partnerhierarchy_old = json_decode($user_data['partnerhierarchy']);
|
||||
|
||||
$salesid_new = ((isset($post_content['salesid']) && $post_content['salesid'] != '' && $post_content['salesid'] != $partnerhierarchy_old->salesid)? $post_content['salesid'] : $partnerhierarchy_old->salesid);
|
||||
$soldto_new = ((isset($post_content['soldto']) && $post_content['soldto'] != '' && $post_content['soldto'] != $partnerhierarchy_old->soldto)? $post_content['soldto'] : $partnerhierarchy_old->soldto);
|
||||
$shipto_new = ((isset($post_content['shipto']) && $post_content['shipto'] != '' && $post_content['shipto'] != $partnerhierarchy_old->shipto)? $post_content['shipto'] : $partnerhierarchy_old->shipto);
|
||||
$location_new = ((isset($post_content['location']) && $post_content['location'] != '' && $post_content['location'] != $partnerhierarchy_old->location)? $post_content['location'] : $partnerhierarchy_old->location);
|
||||
// Allow clearing values by checking if key exists (even if empty)
|
||||
$salesid_new = (array_key_exists('salesid', $post_content)) ? $post_content['salesid'] : ($partnerhierarchy_old->salesid ?? '');
|
||||
$soldto_new = (array_key_exists('soldto', $post_content)) ? $post_content['soldto'] : ($partnerhierarchy_old->soldto ?? '');
|
||||
$shipto_new = (array_key_exists('shipto', $post_content)) ? $post_content['shipto'] : ($partnerhierarchy_old->shipto ?? '');
|
||||
$location_new = (array_key_exists('location', $post_content)) ? $post_content['location'] : ($partnerhierarchy_old->location ?? '');
|
||||
|
||||
if ($permission == 4){
|
||||
//ADMIN+ ONLY ARE ALLOWED TO CHANGE SALES AND SOLD
|
||||
|
||||
Reference in New Issue
Block a user