X-Git-Url: https://delta.frontaccounting.com/gitweb/?a=blobdiff_plain;f=admin%2Fusers.php;h=c19a7dd9b5ab0b0e8996e5ea0af6c3d2f9a606fa;hb=da7df35c61205d0b1af47d286be591b8a3194b0c;hp=05e9adc973b406c414626dbd844f64d106a772da;hpb=ea52d139c2309cc07ec2e37155a3fe304471c0fc;p=fa-stable.git

diff --git a/admin/users.php b/admin/users.php
index 05e9adc9..c19a7dd9 100644
--- a/admin/users.php
+++ b/admin/users.php
@@ -1,20 +1,29 @@
 <?php
-
-$page_security=15;
-$path_to_root="..";
+/**********************************************************************
+    Copyright (C) FrontAccounting, LLC.
+	Released under the terms of the GNU General Public License, GPL, 
+	as published by the Free Software Foundation, either version 3 
+	of the License, or (at your option) any later version.
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
+    See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
+***********************************************************************/
+$page_security = 'SA_USERS';
+$path_to_root = "..";
 include_once($path_to_root . "/includes/session.inc");
 
-page(_("Users"));
+page(_($help_context = "Users"));
 
 include_once($path_to_root . "/includes/date_functions.inc");
 include_once($path_to_root . "/includes/ui.inc");
 
 include_once($path_to_root . "/admin/db/users_db.inc");
 
-simple_page_mode(false);
+simple_page_mode(true);
 //-------------------------------------------------------------------------------------------------
 
-function can_process() 
+function can_process($new) 
 {
 
 	if (strlen($_POST['user_id']) < 4)
@@ -24,7 +33,7 @@ function can_process()
 		return false;
 	}
 
-	if ($_POST['password'] != "") 
+	if (!$new && ($_POST['password'] != ""))
 	{
     	if (strlen($_POST['password']) < 4)
     	{
@@ -46,27 +55,33 @@ function can_process()
 
 //-------------------------------------------------------------------------------------------------
 
-if ($Mode=='ADD_ITEM' || $Mode=='UPDATE_ITEM') 
+if (($Mode=='ADD_ITEM' || $Mode=='UPDATE_ITEM') && check_csrf_token())
 {
 
-	if (can_process())
+	if (can_process($Mode == 'ADD_ITEM'))
 	{
-    	if ($selected_id != '') 
+    	if ($selected_id != -1) 
     	{
-    		update_user($_POST['user_id'], $_POST['real_name'], $_POST['phone'],
-    			$_POST['email'], $_POST['Access'], $_POST['language'], 
-				$_POST['profile'], check_value('rep_popup'), $_POST['pos']);
+    		update_user_prefs($selected_id,
+    			get_post(array('user_id', 'real_name', 'phone', 'email', 'role_id', 'language',
+					'print_profile', 'rep_popup' => 0, 'pos')));
 
     		if ($_POST['password'] != "")
-    			update_user_password($_POST['user_id'], md5($_POST['password']));
+    			update_user_password($selected_id, $_POST['user_id'], md5($_POST['password']));
 
     		display_notification_centered(_("The selected user has been updated."));
     	} 
     	else 
     	{
     		add_user($_POST['user_id'], $_POST['real_name'], md5($_POST['password']),
-				$_POST['phone'], $_POST['email'], $_POST['Access'], $_POST['language'],
-				$_POST['profile'], check_value('rep_popup'), $_POST['pos']);
+				$_POST['phone'], $_POST['email'], $_POST['role_id'], $_POST['language'],
+				$_POST['print_profile'], check_value('rep_popup'), $_POST['pos']);
+			$id = db_insert_id();
+			// use current user display preferences as start point for new user
+			$prefs = $_SESSION['wa_current_user']->prefs->get_all();
+			
+			update_user_prefs($id, array_merge($prefs, get_post(array('print_profile',
+				'rep_popup' => 0, 'language'))));
 
 			display_notification_centered(_("A new user has been added."));
     	}
@@ -76,30 +91,39 @@ if ($Mode=='ADD_ITEM' || $Mode=='UPDATE_ITEM')
 
 //-------------------------------------------------------------------------------------------------
 
-if ($Mode == 'Delete')
+if ($Mode == 'Delete' && check_csrf_token())
 {
-	delete_user($selected_id);
-	display_notification_centered(_("User has been deleted."));
-	$Mode = 'RESET';
+	$cancel_delete = 0;
+    if (key_in_foreign_table($selected_id, 'audit_trail', 'user'))
+    {
+        $cancel_delete = 1;
+        display_error(_("Cannot delete this user because entries are associated with this user."));
+    }
+    if ($cancel_delete == 0) 
+    {
+    	delete_user($selected_id);
+    	display_notification_centered(_("User has been deleted."));
+    } //end if Delete group
+    $Mode = 'RESET';
 }
 
 //-------------------------------------------------------------------------------------------------
 if ($Mode == 'RESET')
 {
- 	$selected_id = '';
-	unset($_POST); // clean all input fields
+ 	$selected_id = -1;
+	$sav = get_post('show_inactive', null);
+	unset($_POST);	// clean all input fields
+	$_POST['show_inactive'] = $sav;
 }
 
-$result = get_users();
+$result = get_users(check_value('show_inactive'));
 start_form();
-start_table($table_style);
-
-if ($_SESSION["wa_current_user"]->access == 2)
-	$th = array(_("User login"), _("Full Name"), _("Phone"),
-		_("E-mail"), _("Last Visit"), _("Access Level"), "", "");
-else		
-	$th = array(_("User login"), _("Full Name"), _("Phone"),
-		_("E-mail"), _("Last Visit"), _("Access Level"), "");
+start_table(TABLESTYLE);
+
+$th = array(_("User login"), _("Full Name"), _("Phone"),
+	_("E-mail"), _("Last Visit"), _("Access Level"), "", "");
+
+inactive_control_column($th);
 table_header($th);	
 
 $k = 0; //row colour counter
@@ -112,44 +136,49 @@ while ($myrow = db_fetch($result))
 	$last_visit_date = sql2date($myrow["last_visit_date"]);
 
 	/*The security_headings array is defined in config.php */
+	$not_me = strcasecmp($myrow["user_id"], $_SESSION["wa_current_user"]->username);
 
 	label_cell($myrow["user_id"]);
 	label_cell($myrow["real_name"]);
 	label_cell($myrow["phone"]);
-	label_cell($myrow["email"]);
+	email_cell($myrow["email"]);
 	label_cell($last_visit_date, "nowrap");
-	label_cell($security_headings[$myrow["full_access"]]);
- 	edit_button_cell("Edit".$myrow["user_id"], _("Edit"));
-    if (strcasecmp($myrow["user_id"], $_SESSION["wa_current_user"]->username) &&
-    	$_SESSION["wa_current_user"]->access == 2)
- 		edit_button_cell("Delete".$myrow["user_id"], _("Delete"));
+	label_cell($myrow["role"]);
+	
+    if ($not_me)
+		inactive_control_cell($myrow["id"], $myrow["inactive"], 'users', 'id');
+	elseif (check_value('show_inactive'))
+		label_cell('');
+
+	edit_button_cell("Edit".$myrow["id"], _("Edit"));
+    if ($not_me)
+ 		delete_button_cell("Delete".$myrow["id"], _("Delete"));
 	else
 		label_cell('');
 	end_row();
 
 } //END WHILE LIST LOOP
 
-end_table();
-end_form();
-echo '<br>';
-
+inactive_control_row($th);
+end_table(1);
 //-------------------------------------------------------------------------------------------------
-start_form();
+start_table(TABLESTYLE2);
 
-start_table($table_style2);
-if ($selected_id != '') 
+$_POST['email'] = "";
+if ($selected_id != -1) 
 {
   	if ($Mode == 'Edit') {
 		//editing an existing User
 		$myrow = get_user($selected_id);
 
+		$_POST['id'] = $myrow["id"];
 		$_POST['user_id'] = $myrow["user_id"];
 		$_POST['real_name'] = $myrow["real_name"];
 		$_POST['phone'] = $myrow["phone"];
 		$_POST['email'] = $myrow["email"];
-		$_POST['Access'] = $myrow["full_access"];
+		$_POST['role_id'] = $myrow["role_id"];
 		$_POST['language'] = $myrow["language"];
-		$_POST['profile'] = $myrow["print_profile"];
+		$_POST['print_profile'] = $myrow["print_profile"];
 		$_POST['rep_popup'] = $myrow["rep_popup"];
 		$_POST['pos'] = $myrow["pos"];
 	}
@@ -162,15 +191,15 @@ if ($selected_id != '')
 else 
 { //end of if $selected_id only do the else when a new record is being entered
 	text_row(_("User Login:"), "user_id",  null, 22, 20);
-	$_POST['rep_popup'] = 1;
+	$_POST['language'] = user_language();
+	$_POST['print_profile'] = user_print_profile();
+	$_POST['rep_popup'] = user_rep_popup();
+	$_POST['pos'] = user_pos();
 }
 $_POST['password'] = "";
-start_row();
-label_cell(_("Password:"));
-label_cell("<input type='password' name='password' size=22 maxlength=20 value='" . $_POST['password'] . "'>");
-end_row();
+password_row(_("Password:"), 'password', $_POST['password']);
 
-if ($selected_id != '') 
+if ($selected_id != -1) 
 {
 	table_section_title(_("Enter a new password to change, leave empty to keep current."));
 }
@@ -179,15 +208,15 @@ text_row_ex(_("Full Name").":", 'real_name',  50);
 
 text_row_ex(_("Telephone No.:"), 'phone', 30);
 
-text_row_ex(_("Email Address:"), 'email', 50);
+email_row_ex(_("Email Address:"), 'email', 50);
 
-security_headings_list_row(_("Access Level:"), 'Access', null); 
+security_roles_list_row(_("Access Level:"), 'role_id', null); 
 
 languages_list_row(_("Language:"), 'language', null);
 
 pos_list_row(_("User's POS"). ':', 'pos', null);
 
-print_profiles_list_row(_("Printing profile"). ':', 'profile', null,
+print_profiles_list_row(_("Printing profile"). ':', 'print_profile', null,
 	_('Browser printing support'));
 
 check_row(_("Use popup window for reports:"), 'rep_popup', $_POST['rep_popup'],
@@ -195,8 +224,7 @@ check_row(_("Use popup window for reports:"), 'rep_popup', $_POST['rep_popup'],
 
 end_table(1);
 
-submit_add_or_update_center($selected_id == '', '', true);
+submit_add_or_update_center($selected_id == -1, '', 'both');
 
 end_form();
 end_page();
-?>