Skip to content

Commit c98eae9

Browse files
HaGuestoHaGuesto
authored
Merge branch 'master' into identical-deleted-modified-in-dailyroutine
Signed-off-by: HaGuesto <hans@boxtribute.org>
2 parents c1e0a9b + 805a24c commit c98eae9

24 files changed

Lines changed: 201 additions & 118 deletions

‎.github/workflows/codeql.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
name: "CodeQL Advanced"
22

33
on:
4+
workflow_dispatch:
45
push:
56
branches: [ "master", "production" ]
67
pull_request:
@@ -85,4 +86,3 @@ jobs:
8586
uses: github/codeql-action/analyze@v4
8687
with:
8788
category: "/language:${{matrix.language}}"
88-
config-file: ./.codeql/config.yml

‎assets/js/custom.js‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -631,9 +631,6 @@ $(".delete-user").on("click", function (e) {
631631
$.ajax({
632632
type: "post",
633633
url: "ajax.php?file=deleteprofile",
634-
data: {
635-
cms_user_id: el.data("id"),
636-
},
637634
dataType: "json",
638635
success: function (result) {
639636
AjaxCheckSuccess(result);

‎cron/dailyroutine.php‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@
2525
FROM people AS p
2626
LEFT OUTER JOIN camps AS c ON c.id = p.camp_id
2727
WHERE (NOT p.deleted OR p.deleted IS NULL) AND p.parent_id IS NULL');
28+
29+
// All deletions are logged with the same timestamp
30+
$now = date('Y-m-d H:i:s');
2831
while ($row = db_fetch($result)) {
2932
$row['touch'] = db_value('
3033
SELECT GREATEST(COALESCE((
@@ -48,8 +51,8 @@
4851
$row['diff'] = $date2->diff($date1)->format('%a');
4952

5053
if ($row['diff'] > $row['treshold']) {
51-
db_query('UPDATE people SET deleted = NOW(), modified = NOW(), modified_by = :user WHERE id = :id', ['user' => $_SESSION['user']['id'], 'id' => $row['id']]);
52-
simpleSaveChangeHistory('people', $row['id'], 'Record deleted by daily routine');
54+
db_query('UPDATE people SET deleted = :now, modified = :now, modified_by = :user WHERE id = :id', ['user' => $_SESSION['user']['id'], 'id' => $row['id'], 'now' => $now]]);
55+
simpleSaveChangeHistory('people', $row['id'], 'Record deleted by daily routine', $now);
5356
}
5457
}
5558
}
@@ -60,8 +63,8 @@
6063
FROM people AS p1, people AS p2
6164
WHERE p2.parent_id = p1.id AND p1.deleted AND (NOT p2.deleted OR p2.deleted IS NULL)');
6265
while ($row = db_fetch($result)) {
63-
db_query('UPDATE people SET deleted = NOW(), modified = NOW(), modified_by = :user WHERE id = :id', ['user' => $_SESSION['user']['id'], 'id' => $row['id']]);
64-
simpleSaveChangeHistory('people', $row['id'], 'Record deleted by daily routine because head of family/beneficiary was deleted');
66+
db_query('UPDATE people SET deleted = :now, modified = :now, modified_by = :user WHERE id = :id', ['user' => $_SESSION['user']['id'], 'id' => $row['id'], 'now' => $now]);
67+
simpleSaveChangeHistory('people', $row['id'], 'Record deleted by daily routine because head of family/beneficiary was deleted', $now);
6568
}
6669

6770
// this notifies us when a new installation of the Drop App is made

‎db/init.sql‎

Lines changed: 27 additions & 19 deletions
Large diffs are not rendered by default.

‎db/migrations/20260113120933_add_source_box_fk_to_stock_table.php‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<?php
2+
3+
use Phinx\Migration\AbstractMigration;
4+
5+
class AddSourceBoxFkToStockTable extends AbstractMigration
6+
{
7+
public function up(): void
8+
{
9+
$this->table('stock')->addColumn('source_box_id', 'integer', [
10+
'null' => true,
11+
'signed' => false,
12+
'after' => 'box_state_id',
13+
])
14+
->addForeignKey('source_box_id', 'stock', 'id', [
15+
'delete' => 'SET_NULL', 'update' => 'CASCADE',
16+
])
17+
->save()
18+
;
19+
}
20+
21+
public function down(): void
22+
{
23+
$this->table('stock')->dropForeignKey('source_box_id')->save();
24+
$this->table('stock')->removeColumn('source_box_id')->save();
25+
}
26+
}

‎include/cms_users.php‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828

2929
// Execution of queries in cms_users_page.php
3030
$cms_users_lower_level_query = '
31-
SELECT u.*, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 0 as disableifistrue
31+
SELECT u.*, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 0 as disableifistrue, 0 AS preventedit
3232
FROM cms_users AS u
3333
LEFT OUTER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
3434
LEFT OUTER JOIN cms_usergroups_camps AS uc ON uc.cms_usergroups_id = g.id
@@ -46,13 +46,14 @@
4646
// Do not forget to specify :userGroupLevel and :user in the db call later
4747
// related to this trello card https://trello.com/c/KI47eGPI
4848
$cms_users_same_or_upper_level_query = '
49-
SELECT u.*, 0 AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue
49+
SELECT u.*, IF(u.id = :user, 1, 0) AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue, IF(u.id = :user, 0, 1) AS preventedit
5050
FROM cms_users AS u
5151
INNER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
5252
INNER JOIN cms_usergroups_camps AS uc ON uc.cms_usergroups_id = g.id
5353
INNER JOIN cms_usergroups_levels AS l ON l.id = g.userlevel
54-
WHERE (l.level >= :userGroupLevel AND u.id != :user)
55-
AND uc.camp_id IN ('.($_SESSION['camp']['id'] ?: 0).')
54+
WHERE l.level >= :userGroupLevel
55+
AND (u.id != :user OR :userGroupLevel = 100)
56+
AND uc.camp_id IN ('.(intval($_SESSION['camp']['id']) ?: 0).')
5657
AND NOT (u.valid_lastday < CURDATE() AND UNIX_TIMESTAMP(u.valid_lastday) != 0)
5758
AND UNIX_TIMESTAMP(u.deleted) = 0
5859
GROUP BY u.id

‎include/cms_users_deactivated.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
);
2525

2626
// Execution of queries in cms_users_page.php
27-
$cms_users_lower_level_query = 'SELECT u.id, u.naam, SUBSTR(u.email, 1, LENGTH(u.email)-LENGTH(".deleted.")-LENGTH(u.id)) AS email, u.valid_firstday, u.valid_lastday, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 1 as disableifistrue
27+
$cms_users_lower_level_query = 'SELECT u.id, u.naam, SUBSTR(u.email, 1, LENGTH(u.email)-LENGTH(".deleted.")-LENGTH(u.id)) AS email, u.valid_firstday, u.valid_lastday, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 1 as disableifistrue, 0 as preventedit
2828
FROM cms_users AS u
2929
LEFT OUTER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
3030
LEFT OUTER JOIN cms_usergroups_camps AS uc ON uc.cms_usergroups_id = g.id
@@ -40,7 +40,7 @@
4040

4141
// Do not forget to specify :usergroup and :user in the db call later
4242
$cms_users_same_level_query = '
43-
SELECT u.id, u.naam, SUBSTR(u.email, 1, LENGTH(u.email)-LENGTH(".deleted.")-LENGTH(u.id)) AS email, u.valid_firstday, u.valid_lastday, 0 AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue
43+
SELECT u.id, u.naam, SUBSTR(u.email, 1, LENGTH(u.email)-LENGTH(".deleted.")-LENGTH(u.id)) AS email, u.valid_firstday, u.valid_lastday, 0 AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue, 1 AS preventedit
4444
FROM cms_users AS u
4545
LEFT OUTER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
4646
WHERE u.cms_usergroups_id = :usergroup

‎include/cms_users_edit.php‎

Lines changed: 46 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -74,10 +74,41 @@
7474
WHERE ug.id = :id AND (NOT ug.deleted OR ug.deleted IS NULL)', ['id' => $_POST['cms_usergroups_id'][0]]);
7575
$is_admin = $_SESSION['user']['is_admin'];
7676
$organisation_allowed = ($_SESSION['organisation']['id'] == $posteduser['organisation_id']);
77-
// allow admins to create another admin account
77+
// allow HoO to create another HoO account
7878
// related to this trello card https://trello.com/c/YAF3Az4P
7979
$userlevel_allowed = ($_SESSION['usergroup']['userlevel'] > $posteduser['userlevel']) || ($_SESSION['usergroup']['userlevel'] == $posteduser['userlevel'] && '100' == $_SESSION['usergroup']['userlevel']);
8080

81+
// Prevent HoO user from downgrading their usergroup if they're the only HoO
82+
if (!$is_admin
83+
&& $_POST['id'] == $_SESSION['user']['id']
84+
&& 100 == $_SESSION['usergroup']['userlevel']) {
85+
// Count how many HoO users exist in this organization
86+
$hoo_count = db_value(
87+
'
88+
SELECT COUNT(DISTINCT u.id)
89+
FROM cms_users AS u
90+
LEFT JOIN cms_usergroups AS ug ON ug.id = u.cms_usergroups_id
91+
LEFT JOIN cms_usergroups_levels AS ugl ON ugl.id = ug.userlevel
92+
WHERE ug.organisation_id = :org_id
93+
AND ugl.level = 100
94+
AND (NOT u.deleted OR u.deleted IS NULL)
95+
AND (NOT ug.deleted OR ug.deleted IS NULL)
96+
AND NOT (u.valid_lastday < CURDATE() AND UNIX_TIMESTAMP(u.valid_lastday) != 0)',
97+
['org_id' => $_SESSION['organisation']['id']]
98+
);
99+
100+
// If this is the last HoO, prevent the change
101+
if ($hoo_count <= 1) {
102+
if ($posteduser['userlevel'] < $_SESSION['usergroup']['userlevel']) {
103+
redirect('?action=cms_users_edit&id='.$_POST['id'].'&origin='.$_POST['_origin'].'&warning=1&message=You cannot downgrade yourself. Your organisation must have at least one Head of Operations user.');
104+
trigger_error('You cannot downgrade yourself. Your organisation must have at least one Head of Operations user.', E_USER_NOTICE);
105+
} elseif (('' !== $_POST['valid_firstday']) || ('' !== $_POST['valid_lastday'])) {
106+
redirect('?action=cms_users_edit&id='.$_POST['id'].'&origin='.$_POST['_origin'].'&warning=1&message=You cannot edit yourself. Your organisation must have at least one Head of Operations user.');
107+
trigger_error('You cannot edit yourself. Your organisation must have at least one Head of Operations user.', E_USER_NOTICE);
108+
}
109+
}
110+
}
111+
81112
if ($is_admin || ($organisation_allowed && $userlevel_allowed)) {
82113
$keys = ['naam', 'email', 'cms_usergroups_id', 'valid_firstday', 'valid_lastday'];
83114
$userId = db_transaction(function () use ($table, $keys, $userId) {
@@ -114,7 +145,12 @@
114145
FROM cms_usergroups AS ug
115146
LEFT OUTER JOIN cms_usergroups_levels AS ugl ON ugl.id=ug.userlevel
116147
WHERE ug.id = :id AND (NOT ug.deleted OR ug.deleted IS NULL)', ['id' => $data['cms_usergroups_id']]);
117-
if (!$_SESSION['user']['is_admin'] && ($data && ($data['is_admin'] || ($_SESSION['organisation']['id'] != $requesteduser['organisation_id']) || ($_SESSION['usergroup']['userlevel'] <= $requesteduser['userlevel'])))) {
148+
if (!$_SESSION['user']['is_admin']
149+
&& $data
150+
&& $data['id'] != $_SESSION['user']['id']
151+
&& ($data['is_admin']
152+
|| $_SESSION['organisation']['id'] != $requesteduser['organisation_id']
153+
|| $_SESSION['usergroup']['userlevel'] <= $requesteduser['userlevel'])) {
118154
throw new Exception('You do not have access to this user!', 403);
119155
}
120156

@@ -130,11 +166,14 @@
130166
// display admin role in the usergroup - only for user with admin roles
131167
// related to this trello card https://trello.com/c/YAF3Az4P
132168
$usergroups = db_array('
133-
SELECT ug.id AS value, ug.label
134-
FROM cms_usergroups AS ug
135-
LEFT OUTER JOIN cms_usergroups_levels AS ugl ON (ugl.id=ug.userlevel)
136-
WHERE ug.organisation_id = :organisation_id AND (ugl.level < :userlevel OR :is_admin OR (ugl.level <= :userlevel AND 100 = :userlevel)) AND (NOT ug.deleted OR ug.deleted IS NULL)
137-
ORDER BY ug.label', ['organisation_id' => $_SESSION['organisation']['id'], 'userlevel' => $_SESSION['usergroup']['userlevel'], 'is_admin' => $_SESSION['user']['is_admin']]);
169+
SELECT ug.id AS value, ug.label
170+
FROM cms_usergroups AS ug
171+
LEFT OUTER JOIN cms_usergroups_levels AS ugl ON (ugl.id=ug.userlevel)
172+
WHERE ug.organisation_id = :organisation_id
173+
AND (:is_admin OR (ugl.level < :userlevel OR (ugl.level <= :userlevel AND 100 = :userlevel)))
174+
AND (:is_admin OR ug.label != "Boxtribute God")
175+
AND (NOT ug.deleted OR ug.deleted IS NULL)
176+
ORDER BY ug.label', ['organisation_id' => $_SESSION['organisation']['id'], 'userlevel' => $_SESSION['usergroup']['userlevel'], 'is_admin' => $_SESSION['user']['is_admin']]);
138177
addfield('select', 'Select user group', 'cms_usergroups_id', ['required' => true, 'options' => $usergroups, 'testid' => 'user_group']);
139178

140179
addfield('line');

‎include/cms_users_expired.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
);
3030

3131
// Execution of queries in cms_users_page.php
32-
$cms_users_lower_level_query = 'SELECT u.*, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 1 as disableifistrue
32+
$cms_users_lower_level_query = 'SELECT u.*, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 1 as disableifistrue, 0 AS preventedit
3333
FROM cms_users AS u
3434
LEFT OUTER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
3535
LEFT OUTER JOIN cms_usergroups_camps AS uc ON uc.cms_usergroups_id = g.id
@@ -46,7 +46,7 @@
4646

4747
// Do not forget to specify :usergroup and :user in the db call later
4848
$cms_users_same_level_query = '
49-
SELECT u.*, 0 AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue
49+
SELECT u.*, 0 AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue, 1 AS preventedit
5050
FROM cms_users AS u
5151
LEFT OUTER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
5252
WHERE u.cms_usergroups_id = :usergroup

‎include/container-stock.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,5 +76,6 @@
7676
$cmsmain->assign('listdata', $listdata);
7777
$cmsmain->assign('include', 'cms_list.tpl');
7878
} else {
79-
throw new Exception('There is no Stockroom warehouse location defined! Ask your coordinator to correct this!');
79+
$cmsmain->assign('list_info_text', "You have not set up a stockroom for your free shop. Stockroom is a way to help free shops keep track of items that aren't on display or that always need to be in stock. If you need this functionality, ask your coordinator to enable it.");
80+
$cmsmain->assign('include', 'cms_list.tpl');
8081
}

0 commit comments

Comments
 (0)