Skip to content

Commit f8f8b3d

Browse files
HaGuestoHaGuesto
committed
Merge branch 'master' into production
2 parents 6bcac0a + 12e0b5d commit f8f8b3d

19 files changed

Lines changed: 151 additions & 116 deletions

‎assets/js/custom.js‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -631,9 +631,6 @@ $(".delete-user").on("click", function (e) {
631631
$.ajax({
632632
type: "post",
633633
url: "ajax.php?file=deleteprofile",
634-
data: {
635-
cms_user_id: el.data("id"),
636-
},
637634
dataType: "json",
638635
success: function (result) {
639636
AjaxCheckSuccess(result);

‎cron/dailyroutine.php‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@
2525
FROM people AS p
2626
LEFT OUTER JOIN camps AS c ON c.id = p.camp_id
2727
WHERE (NOT p.deleted OR p.deleted IS NULL) AND p.parent_id IS NULL');
28+
29+
// All deletions are logged with the same timestamp
30+
$now = date('Y-m-d H:i:s');
2831
while ($row = db_fetch($result)) {
2932
$row['touch'] = db_value('
3033
SELECT GREATEST(COALESCE((
@@ -48,9 +51,8 @@
4851
$row['diff'] = $date2->diff($date1)->format('%a');
4952

5053
if ($row['diff'] > $row['treshold']) {
51-
db_query('UPDATE people SET deleted = NOW() WHERE id = :id', ['id' => $row['id']]);
52-
simpleSaveChangeHistory('people', $row['id'], 'Record deleted by daily routine');
53-
db_touch('people', $row['id']);
54+
db_query('UPDATE people SET deleted = :now, modified = :now, modified_by = :user WHERE id = :id', ['user' => $_SESSION['user']['id'], 'id' => $row['id'], 'now' => $now]);
55+
simpleSaveChangeHistory('people', $row['id'], 'Record deleted by daily routine', $now);
5456
}
5557
}
5658
}
@@ -61,9 +63,8 @@
6163
FROM people AS p1, people AS p2
6264
WHERE p2.parent_id = p1.id AND p1.deleted AND (NOT p2.deleted OR p2.deleted IS NULL)');
6365
while ($row = db_fetch($result)) {
64-
db_query('UPDATE people SET deleted = NOW() WHERE id = :id', ['id' => $row['id']]);
65-
simpleSaveChangeHistory('people', $row['id'], 'Record deleted by daily routine because head of family/beneficiary was deleted');
66-
db_touch('people', $row['id']);
66+
db_query('UPDATE people SET deleted = :now, modified = :now, modified_by = :user WHERE id = :id', ['user' => $_SESSION['user']['id'], 'id' => $row['id'], 'now' => $now]);
67+
simpleSaveChangeHistory('people', $row['id'], 'Record deleted by daily routine because head of family/beneficiary was deleted', $now);
6768
}
6869

6970
// this notifies us when a new installation of the Drop App is made

‎db/init.sql‎

Lines changed: 27 additions & 19 deletions
Large diffs are not rendered by default.

‎include/cms_users.php‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828

2929
// Execution of queries in cms_users_page.php
3030
$cms_users_lower_level_query = '
31-
SELECT u.*, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 0 as disableifistrue
31+
SELECT u.*, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 0 as disableifistrue, 0 AS preventedit
3232
FROM cms_users AS u
3333
LEFT OUTER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
3434
LEFT OUTER JOIN cms_usergroups_camps AS uc ON uc.cms_usergroups_id = g.id
@@ -46,13 +46,14 @@
4646
// Do not forget to specify :userGroupLevel and :user in the db call later
4747
// related to this trello card https://trello.com/c/KI47eGPI
4848
$cms_users_same_or_upper_level_query = '
49-
SELECT u.*, 0 AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue
49+
SELECT u.*, IF(u.id = :user, 1, 0) AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue, IF(u.id = :user, 0, 1) AS preventedit
5050
FROM cms_users AS u
5151
INNER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
5252
INNER JOIN cms_usergroups_camps AS uc ON uc.cms_usergroups_id = g.id
5353
INNER JOIN cms_usergroups_levels AS l ON l.id = g.userlevel
54-
WHERE (l.level >= :userGroupLevel AND u.id != :user)
55-
AND uc.camp_id IN ('.($_SESSION['camp']['id'] ?: 0).')
54+
WHERE l.level >= :userGroupLevel
55+
AND (u.id != :user OR :userGroupLevel = 100)
56+
AND uc.camp_id IN ('.(intval($_SESSION['camp']['id']) ?: 0).')
5657
AND NOT (u.valid_lastday < CURDATE() AND UNIX_TIMESTAMP(u.valid_lastday) != 0)
5758
AND UNIX_TIMESTAMP(u.deleted) = 0
5859
GROUP BY u.id

‎include/cms_users_deactivated.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
);
2525

2626
// Execution of queries in cms_users_page.php
27-
$cms_users_lower_level_query = 'SELECT u.id, u.naam, SUBSTR(u.email, 1, LENGTH(u.email)-LENGTH(".deleted.")-LENGTH(u.id)) AS email, u.valid_firstday, u.valid_lastday, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 1 as disableifistrue
27+
$cms_users_lower_level_query = 'SELECT u.id, u.naam, SUBSTR(u.email, 1, LENGTH(u.email)-LENGTH(".deleted.")-LENGTH(u.id)) AS email, u.valid_firstday, u.valid_lastday, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 1 as disableifistrue, 0 as preventedit
2828
FROM cms_users AS u
2929
LEFT OUTER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
3030
LEFT OUTER JOIN cms_usergroups_camps AS uc ON uc.cms_usergroups_id = g.id
@@ -40,7 +40,7 @@
4040

4141
// Do not forget to specify :usergroup and :user in the db call later
4242
$cms_users_same_level_query = '
43-
SELECT u.id, u.naam, SUBSTR(u.email, 1, LENGTH(u.email)-LENGTH(".deleted.")-LENGTH(u.id)) AS email, u.valid_firstday, u.valid_lastday, 0 AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue
43+
SELECT u.id, u.naam, SUBSTR(u.email, 1, LENGTH(u.email)-LENGTH(".deleted.")-LENGTH(u.id)) AS email, u.valid_firstday, u.valid_lastday, 0 AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue, 1 AS preventedit
4444
FROM cms_users AS u
4545
LEFT OUTER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
4646
WHERE u.cms_usergroups_id = :usergroup

‎include/cms_users_edit.php‎

Lines changed: 46 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -74,10 +74,41 @@
7474
WHERE ug.id = :id AND (NOT ug.deleted OR ug.deleted IS NULL)', ['id' => $_POST['cms_usergroups_id'][0]]);
7575
$is_admin = $_SESSION['user']['is_admin'];
7676
$organisation_allowed = ($_SESSION['organisation']['id'] == $posteduser['organisation_id']);
77-
// allow admins to create another admin account
77+
// allow HoO to create another HoO account
7878
// related to this trello card https://trello.com/c/YAF3Az4P
7979
$userlevel_allowed = ($_SESSION['usergroup']['userlevel'] > $posteduser['userlevel']) || ($_SESSION['usergroup']['userlevel'] == $posteduser['userlevel'] && '100' == $_SESSION['usergroup']['userlevel']);
8080

81+
// Prevent HoO user from downgrading their usergroup if they're the only HoO
82+
if (!$is_admin
83+
&& $_POST['id'] == $_SESSION['user']['id']
84+
&& 100 == $_SESSION['usergroup']['userlevel']) {
85+
// Count how many HoO users exist in this organization
86+
$hoo_count = db_value(
87+
'
88+
SELECT COUNT(DISTINCT u.id)
89+
FROM cms_users AS u
90+
LEFT JOIN cms_usergroups AS ug ON ug.id = u.cms_usergroups_id
91+
LEFT JOIN cms_usergroups_levels AS ugl ON ugl.id = ug.userlevel
92+
WHERE ug.organisation_id = :org_id
93+
AND ugl.level = 100
94+
AND (NOT u.deleted OR u.deleted IS NULL)
95+
AND (NOT ug.deleted OR ug.deleted IS NULL)
96+
AND NOT (u.valid_lastday < CURDATE() AND UNIX_TIMESTAMP(u.valid_lastday) != 0)',
97+
['org_id' => $_SESSION['organisation']['id']]
98+
);
99+
100+
// If this is the last HoO, prevent the change
101+
if ($hoo_count <= 1) {
102+
if ($posteduser['userlevel'] < $_SESSION['usergroup']['userlevel']) {
103+
redirect('?action=cms_users_edit&id='.$_POST['id'].'&origin='.$_POST['_origin'].'&warning=1&message=You cannot downgrade yourself. Your organisation must have at least one Head of Operations user.');
104+
trigger_error('You cannot downgrade yourself. Your organisation must have at least one Head of Operations user.', E_USER_NOTICE);
105+
} elseif (('' !== $_POST['valid_firstday']) || ('' !== $_POST['valid_lastday'])) {
106+
redirect('?action=cms_users_edit&id='.$_POST['id'].'&origin='.$_POST['_origin'].'&warning=1&message=You cannot edit yourself. Your organisation must have at least one Head of Operations user.');
107+
trigger_error('You cannot edit yourself. Your organisation must have at least one Head of Operations user.', E_USER_NOTICE);
108+
}
109+
}
110+
}
111+
81112
if ($is_admin || ($organisation_allowed && $userlevel_allowed)) {
82113
$keys = ['naam', 'email', 'cms_usergroups_id', 'valid_firstday', 'valid_lastday'];
83114
$userId = db_transaction(function () use ($table, $keys, $userId) {
@@ -114,7 +145,12 @@
114145
FROM cms_usergroups AS ug
115146
LEFT OUTER JOIN cms_usergroups_levels AS ugl ON ugl.id=ug.userlevel
116147
WHERE ug.id = :id AND (NOT ug.deleted OR ug.deleted IS NULL)', ['id' => $data['cms_usergroups_id']]);
117-
if (!$_SESSION['user']['is_admin'] && ($data && ($data['is_admin'] || ($_SESSION['organisation']['id'] != $requesteduser['organisation_id']) || ($_SESSION['usergroup']['userlevel'] <= $requesteduser['userlevel'])))) {
148+
if (!$_SESSION['user']['is_admin']
149+
&& $data
150+
&& $data['id'] != $_SESSION['user']['id']
151+
&& ($data['is_admin']
152+
|| $_SESSION['organisation']['id'] != $requesteduser['organisation_id']
153+
|| $_SESSION['usergroup']['userlevel'] <= $requesteduser['userlevel'])) {
118154
throw new Exception('You do not have access to this user!', 403);
119155
}
120156

@@ -130,11 +166,14 @@
130166
// display admin role in the usergroup - only for user with admin roles
131167
// related to this trello card https://trello.com/c/YAF3Az4P
132168
$usergroups = db_array('
133-
SELECT ug.id AS value, ug.label
134-
FROM cms_usergroups AS ug
135-
LEFT OUTER JOIN cms_usergroups_levels AS ugl ON (ugl.id=ug.userlevel)
136-
WHERE ug.organisation_id = :organisation_id AND (ugl.level < :userlevel OR :is_admin OR (ugl.level <= :userlevel AND 100 = :userlevel)) AND (NOT ug.deleted OR ug.deleted IS NULL)
137-
ORDER BY ug.label', ['organisation_id' => $_SESSION['organisation']['id'], 'userlevel' => $_SESSION['usergroup']['userlevel'], 'is_admin' => $_SESSION['user']['is_admin']]);
169+
SELECT ug.id AS value, ug.label
170+
FROM cms_usergroups AS ug
171+
LEFT OUTER JOIN cms_usergroups_levels AS ugl ON (ugl.id=ug.userlevel)
172+
WHERE ug.organisation_id = :organisation_id
173+
AND (:is_admin OR (ugl.level < :userlevel OR (ugl.level <= :userlevel AND 100 = :userlevel)))
174+
AND (:is_admin OR ug.label != "Boxtribute God")
175+
AND (NOT ug.deleted OR ug.deleted IS NULL)
176+
ORDER BY ug.label', ['organisation_id' => $_SESSION['organisation']['id'], 'userlevel' => $_SESSION['usergroup']['userlevel'], 'is_admin' => $_SESSION['user']['is_admin']]);
138177
addfield('select', 'Select user group', 'cms_usergroups_id', ['required' => true, 'options' => $usergroups, 'testid' => 'user_group']);
139178

140179
addfield('line');

‎include/cms_users_expired.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
);
3030

3131
// Execution of queries in cms_users_page.php
32-
$cms_users_lower_level_query = 'SELECT u.*, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 1 as disableifistrue
32+
$cms_users_lower_level_query = 'SELECT u.*, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 1 as disableifistrue, 0 AS preventedit
3333
FROM cms_users AS u
3434
LEFT OUTER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
3535
LEFT OUTER JOIN cms_usergroups_camps AS uc ON uc.cms_usergroups_id = g.id
@@ -46,7 +46,7 @@
4646

4747
// Do not forget to specify :usergroup and :user in the db call later
4848
$cms_users_same_level_query = '
49-
SELECT u.*, 0 AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue
49+
SELECT u.*, 0 AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue, 1 AS preventedit
5050
FROM cms_users AS u
5151
LEFT OUTER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
5252
WHERE u.cms_usergroups_id = :usergroup

‎include/people.php‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -514,14 +514,15 @@ function () use ($cmsmain, $data) {
514514
case 'touch':
515515
$ids = explode(',', (string) $_POST['ids']);
516516
$userId = $_SESSION['user']['id'];
517+
$now = date('Y-m-d H:i:s');
517518
// Query speed optimised for 500 records from 6.2 seconds to 0.54 seconds using transaction blocks over UPDATE and bulk inserts
518-
db_transaction(function () use ($ids, $userId) {
519+
db_transaction(function () use ($ids, $userId, $now) {
519520
foreach ($ids as $id) {
520-
db_query('UPDATE people SET modified = NOW(), modified_by = :user WHERE id = :id', ['id' => $id, 'user' => $userId]);
521+
db_query('UPDATE people SET modified = :now, modified_by = :user WHERE id = :id', ['id' => $id, 'user' => $userId, 'now' => $now]);
521522
}
522523
});
523524
// Bulk insert used to insert into history table
524-
simpleBulkSaveChangeHistory('people', $ids, 'Touched');
525+
simpleBulkSaveChangeHistory('people', $ids, 'Touched', $now);
525526

526527
$success = true;
527528
$message = 'Selected people have been touched';

‎include/people_deactivated.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@ function () use (&$data) {
161161
}
162162

163163
// Optimized by using bulk inserts and transactions over delete queries
164-
[$success, $message, $redirect] = listBulkRealDelete($table, $ids);
164+
[$success, $message, $redirect] = listBulkRealDelete($table, $ids, $now);
165165

166166
return [$success, $message, $redirect];
167167
});

‎include/stock_overview.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,8 @@ function box_state_id_from_filter($applied_filter)
118118
products as b ON upper(a.name)=upper(b.name)
119119
WHERE
120120
a.camp_id = :camp_id and b.camp_id = :camp_id and a.id<=b.id
121+
AND (NOT a.deleted OR a.deleted IS NULL)
122+
AND (NOT b.deleted OR b.deleted IS NULL)
121123
GROUP BY
122124
upper(a.name)
123125
) prod_a

0 commit comments

Comments
 (0)