interface/usergroup/usergroup_admin.php

   1 <?php
   2 /**
   3  * This script Assign acl 'Emergency login'.
   4  *
   5  * Copyright (C) 2015 Roberto Vasquez <robertogagliotta@gmail.com>
   6  *
   7  * LICENSE: This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License
   9  * as published by the Free Software Foundation; either version 2
  10  * of the License, or (at your option) any later version.
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14  * GNU General Public License for more details.
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
  17  *
  18  * @package OpenEMR
  19  * @author  Roberto Vasquez <robertogagliotta@gmail.com>
  20  * @link    http://www.open-emr.org
  21  */
  22
  23 require_once("../globals.php");
  24 require_once("../../library/acl.inc");
  25 require_once("$srcdir/auth.inc");
  26
  27 $alertmsg = '';
  28 $bg_msg = '';
  29 $set_active_msg=0;
  30 $show_message=0;
  31
  32
  33 /* Sending a mail to the admin when the breakglass user is activated only if $GLOBALS['Emergency_Login_email'] is set to 1 */
  34 $bg_count=count($access_group);
  35 $mail_id = explode(".",$SMTP_HOST);
  36 for($i=0;$i<$bg_count;$i++){
  37 if(($_POST['access_group'][$i] == "Emergency Login") && ($_POST['active'] == 'on') && ($_POST['pre_active'] == 0)){
  38   if(($_POST['get_admin_id'] == 1) && ($_POST['admin_id'] != "")){
  39     $res = sqlStatement("select username from users where id= ? ", array($_POST["id"]));
  40     $row = sqlFetchArray($res);
  41     $uname=$row['username'];
  42     $mail = new MyMailer();
  43         $mail->From = $GLOBALS["practice_return_email_path"];
  44         $mail->FromName = "Administrator OpenEMR";
  45         $text_body  = "Hello Security Admin,\n\n The Emergency Login user ".$uname.
  46                                                 " was activated at ".date('l jS \of F Y h:i:s A')." \n\nThanks,\nAdmin OpenEMR.";
  47         $mail->Body = $text_body;
  48         $mail->Subject = "Emergency Login User Activated";
  49         $mail->AddAddress($_POST['admin_id']);
  50         $mail->Send();
  51 }
  52 }
  53 }
  54 /* To refresh and save variables in mail frame */
  55 if (isset($_POST["privatemode"]) && $_POST["privatemode"] =="user_admin") {
  56     if ($_POST["mode"] == "update") {
  57       if (isset($_POST["username"])) {
  58         // $tqvar = addslashes(trim($_POST["username"]));
  59         $tqvar = trim(formData('username','P'));
  60         $user_data = sqlFetchArray(sqlStatement("select * from users where id= ? ", array($_POST["id"])));
  61         sqlStatement("update users set username='$tqvar' where id= ? ", array($_POST["id"]));
  62         sqlStatement("update groups set user='$tqvar' where user= ?", array($user_data["username"]));
  63         //echo "query was: " ."update groups set user='$tqvar' where user='". $user_data["username"]  ."'" ;
  64       }
  65       if ($_POST["taxid"]) {
  66         $tqvar = formData('taxid','P');
  67         sqlStatement("update users set federaltaxid='$tqvar' where id= ? ", array($_POST["id"]));
  68       }
  69       if ($_POST["state_license_number"]) {
  70         $tqvar = formData('state_license_number','P');
  71         sqlStatement("update users set state_license_number='$tqvar' where id= ? ", array($_POST["id"]));
  72       }
  73       if ($_POST["drugid"]) {
  74         $tqvar = formData('drugid','P');
  75         sqlStatement("update users set federaldrugid='$tqvar' where id= ? ", array($_POST["id"]));
  76       }
  77       if ($_POST["upin"]) {
  78         $tqvar = formData('upin','P');
  79         sqlStatement("update users set upin='$tqvar' where id= ? ", array($_POST["id"]));
  80       }
  81       if ($_POST["npi"]) {
  82         $tqvar = formData('npi','P');
  83         sqlStatement("update users set npi='$tqvar' where id= ? ", array($_POST["id"]));
  84       }
  85       if ($_POST["taxonomy"]) {
  86         $tqvar = formData('taxonomy','P');
  87         sqlStatement("update users set taxonomy = '$tqvar' where id= ? ", array($_POST["id"]));
  88       }
  89       if ($_POST["lname"]) {
  90         $tqvar = formData('lname','P');
  91         sqlStatement("update users set lname='$tqvar' where id= ? ", array($_POST["id"]));
  92       }
  93       if ($_POST["job"]) {
  94         $tqvar = formData('job','P');
  95         sqlStatement("update users set specialty='$tqvar' where id= ? ", array($_POST["id"]));
  96       }
  97       if ($_POST["mname"]) {
  98               $tqvar = formData('mname','P');
  99               sqlStatement("update users set mname='$tqvar' where id= ? ", array($_POST["id"]));
 100       }
 101       if ($_POST["facility_id"]) {
 102               $tqvar = formData('facility_id','P');
 103               sqlStatement("update users set facility_id = '$tqvar' where id = ? ", array($_POST["id"]));
 104               //(CHEMED) Update facility name when changing the id
 105               sqlStatement("UPDATE users, facility SET users.facility = facility.name WHERE facility.id = '$tqvar' AND users.id = {$_POST["id"]}");
 106               //END (CHEMED)
 107       }
 108       if ($GLOBALS['restrict_user_facility'] && $_POST["schedule_facility"]) {
 109           sqlStatement("delete from users_facility
 110             where tablename='users'
 111             and table_id= ?
 112             and facility_id not in (" . implode(",", $_POST['schedule_facility']) . ")", array($_POST["id"]));
 113           foreach($_POST["schedule_facility"] as $tqvar) {
 114           sqlStatement("replace into users_facility set
 115                 facility_id = '$tqvar',
 116                 tablename='users',
 117                 table_id = {$_POST["id"]}");
 118         }
 119       }
 120       if ($_POST["fname"]) {
 121               $tqvar = formData('fname','P');
 122               sqlStatement("update users set fname='$tqvar' where id= ? ", array($_POST["id"]));
 123       }
 124
 125       //(CHEMED) Calendar UI preference
 126       if ($_POST["cal_ui"]) {
 127               $tqvar = formData('cal_ui','P');
 128               sqlStatement("update users set cal_ui = '$tqvar' where id = ? ", array($_POST["id"]));
 129
 130               // added by bgm to set this session variable if the current user has edited
 131           //   their own settings
 132           if ($_SESSION['authId'] == $_POST["id"]) {
 133             $_SESSION['cal_ui'] = $tqvar;
 134           }
 135       }
 136       //END (CHEMED) Calendar UI preference
 137
 138       if (isset($_POST['default_warehouse'])) {
 139         sqlStatement("UPDATE users SET default_warehouse = '" .
 140           formData('default_warehouse','P') .
 141           "' WHERE id = '" . formData('id','P') . "'");
 142       }
 143
 144       if (isset($_POST['irnpool'])) {
 145         sqlStatement("UPDATE users SET irnpool = '" .
 146           formData('irnpool','P') .
 147           "' WHERE id = '" . formData('id','P') . "'");
 148       }
 149
 150      if ($_POST["adminPass"] && $_POST["clearPass"]) {
 151         require_once("$srcdir/authentication/password_change.php");
 152         $clearAdminPass=$_POST['adminPass'];
 153         $clearUserPass=$_POST['clearPass'];
 154         $password_err_msg="";
 155         $success=update_password($_SESSION['authId'],$_POST['id'],$clearAdminPass,$clearUserPass,$password_err_msg);
 156         if(!$success)
 157         {
 158             error_log($password_err_msg);
 159             $alertmsg.=$password_err_msg;
 160         }
 161      }
 162
 163       $tqvar  = $_POST["authorized"] ? 1 : 0;
 164       $actvar = $_POST["active"]     ? 1 : 0;
 165       $calvar = $_POST["calendar"]   ? 1 : 0;
 166
 167       sqlStatement("UPDATE users SET authorized = $tqvar, active = $actvar, " .
 168         "calendar = $calvar, see_auth = ? WHERE " .
 169         "id = ? ", array($_POST['see_auth'], $_POST["id"]));
 170       //Display message when Emergency Login user was activated
 171       $bg_count=count($_POST['access_group']);
 172       for($i=0;$i<$bg_count;$i++){
 173         if(($_POST['access_group'][$i] == "Emergency Login") && ($_POST['pre_active'] == 0) && ($actvar == 1)){
 174          $show_message = 1;
 175         }
 176       }
 177       if(($_POST['access_group'])){
 178         for($i=0;$i<$bg_count;$i++){
 179         if(($_POST['access_group'][$i] == "Emergency Login") && ($_POST['user_type']) == "" && ($_POST['check_acl'] == 1) && ($_POST['active']) != ""){
 180          $set_active_msg=1;
 181         }
 182       }
 183     }
 184       if ($_POST["comments"]) {
 185         $tqvar = formData('comments','P');
 186         sqlStatement("update users set info = '$tqvar' where id = ? ", array($_POST["id"]));
 187       }
 188         $erxrole = formData('erxrole','P');
 189         sqlStatement("update users set newcrop_user_role = '$erxrole' where id = ? ", array($_POST["id"]));
 190
 191           if ($_POST["physician_type"]) {
 192                 $physician_type = formData('physician_type');
 193                 sqlStatement("update users set physician_type = '$physician_type' where id = ? ", array($_POST["id"]));
 194           }
 195
 196       if (isset($phpgacl_location) && acl_check('admin', 'acl')) {
 197         // Set the access control group of user
 198         $user_data = sqlFetchArray(sqlStatement("select username from users where id= ?", array($_POST["id"])));
 199         set_user_aro($_POST['access_group'], $user_data["username"],
 200           formData('fname','P'), formData('mname','P'), formData('lname','P'));
 201       }
 202     }
 203 }
 204
 205 /* To refresh and save variables in mail frame  - Arb*/
 206 if (isset($_POST["mode"])) {
 207   if ($_POST["mode"] == "new_user") {
 208     if ($_POST["authorized"] != "1") {
 209       $_POST["authorized"] = 0;
 210     }
 211     // $_POST["info"] = addslashes($_POST["info"]);
 212
 213     $calvar = $_POST["calendar"] ? 1 : 0;
 214
 215     $res = sqlStatement("select distinct username from users where username != ''");
 216     $doit = true;
 217     while ($row = sqlFetchArray($res)) {
 218       if ($doit == true && $row['username'] == trim(formData('rumple'))) {
 219         $doit = false;
 220       }
 221     }
 222
 223     if ($doit == true) {
 224     require_once("$srcdir/authentication/password_change.php");
 225
 226     //if password expiration option is enabled,  calculate the expiration date of the password
 227     if($GLOBALS['password_expiration_days'] != 0){
 228     $exp_days = $GLOBALS['password_expiration_days'];
 229     $exp_date = date('Y-m-d', strtotime("+$exp_days days"));
 230     }
 231
 232     $insertUserSQL=
 233             "insert into users set " .
 234             "username = '"         . trim(formData('rumple'       )) .
 235             "', password = '"      . 'NoLongerUsed'                  .
 236             "', fname = '"         . trim(formData('fname'        )) .
 237             "', mname = '"         . trim(formData('mname'        )) .
 238             "', lname = '"         . trim(formData('lname'        )) .
 239             "', federaltaxid = '"  . trim(formData('federaltaxid' )) .
 240             "', state_license_number = '"  . trim(formData('state_license_number' )) .
 241             "', newcrop_user_role = '"  . trim(formData('erxrole' )) .
 242                         "', physician_type = '"  . trim(formData('physician_type' )) .
 243             "', authorized = '"    . trim(formData('authorized'   )) .
 244             "', info = '"          . trim(formData('info'         )) .
 245             "', federaldrugid = '" . trim(formData('federaldrugid')) .
 246             "', upin = '"          . trim(formData('upin'         )) .
 247             "', npi  = '"          . trim(formData('npi'          )).
 248             "', taxonomy = '"      . trim(formData('taxonomy'     )) .
 249             "', facility_id = '"   . trim(formData('facility_id'  )) .
 250             "', specialty = '"     . trim(formData('specialty'    )) .
 251             "', see_auth = '"      . trim(formData('see_auth'     )) .
 252             "', cal_ui = '"        . trim(formData('cal_ui'       )) .
 253             "', default_warehouse = '" . trim(formData('default_warehouse')) .
 254             "', irnpool = '"       . trim(formData('irnpool'      )) .
 255             "', calendar = '"      . $calvar                         .
 256             "', pwd_expiration_date = '" . trim("$exp_date") .
 257             "'";
 258
 259     $clearAdminPass=$_POST['adminPass'];
 260     $clearUserPass=$_POST['stiltskin'];
 261     $password_err_msg="";
 262     $prov_id="";
 263     $success = update_password($_SESSION['authId'], 0, $clearAdminPass, $clearUserPass,
 264       $password_err_msg, true, $insertUserSQL, trim(formData('rumple')), $prov_id);
 265     error_log($password_err_msg);
 266     $alertmsg .=$password_err_msg;
 267     if($success)
 268     {
 269       //set the facility name from the selected facility_id
 270       sqlStatement("UPDATE users, facility SET users.facility = facility.name WHERE facility.id = '" . trim(formData('facility_id')) . "' AND users.username = '" . trim(formData('rumple')) . "'");
 271
 272       sqlStatement("insert into groups set name = '" . trim(formData('groupname')) .
 273         "', user = '" . trim(formData('rumple')) . "'");
 274
 275       if (isset($phpgacl_location) && acl_check('admin', 'acl') && trim(formData('rumple'))) {
 276         // Set the access control group of user
 277         set_user_aro($_POST['access_group'], trim(formData('rumple')),
 278           trim(formData('fname')), trim(formData('mname')), trim(formData('lname')));
 279       }
 280     }
 281
 282
 283
 284     } else {
 285       $alertmsg .= xl('User','','',' ') . trim(formData('rumple')) . xl('already exists.','',' ');
 286     }
 287    if($_POST['access_group']){
 288          $bg_count=count($_POST['access_group']);
 289          for($i=0;$i<$bg_count;$i++){
 290           if($_POST['access_group'][$i] == "Emergency Login"){
 291              $set_active_msg=1;
 292            }
 293         }
 294       }
 295   }
 296   else if ($_POST["mode"] == "new_group") {
 297     $res = sqlStatement("select distinct name, user from groups");
 298     for ($iter = 0; $row = sqlFetchArray($res); $iter++)
 299       $result[$iter] = $row;
 300     $doit = 1;
 301     foreach ($result as $iter) {
 302       if ($doit == 1 && $iter{"name"} == trim(formData('groupname')) && $iter{"user"} == trim(formData('rumple')))
 303         $doit--;
 304     }
 305     if ($doit == 1) {
 306       sqlStatement("insert into groups set name = '" . trim(formData('groupname')) .
 307         "', user = '" . trim(formData('rumple')) . "'");
 308     } else {
 309       $alertmsg .= "User " . trim(formData('rumple')) .
 310         " is already a member of group " . trim(formData('groupname')) . ". ";
 311     }
 312   }
 313 }
 314
 315 if (isset($_GET["mode"])) {
 316
 317   /*******************************************************************
 318   // This is the code to delete a user.  Note that the link which invokes
 319   // this is commented out.  Somebody must have figured it was too dangerous.
 320   //
 321   if ($_GET["mode"] == "delete") {
 322     $res = sqlStatement("select distinct username, id from users where id = '" .
 323       $_GET["id"] . "'");
 324     for ($iter = 0; $row = sqlFetchArray($res); $iter++)
 325       $result[$iter] = $row;
 326
 327     // TBD: Before deleting the user, we should check all tables that
 328     // reference users to make sure this user is not referenced!
 329
 330     foreach($result as $iter) {
 331       sqlStatement("delete from groups where user = '" . $iter{"username"} . "'");
 332     }
 333     sqlStatement("delete from users where id = '" . $_GET["id"] . "'");
 334   }
 335   *******************************************************************/
 336
 337   if ($_GET["mode"] == "delete_group") {
 338     $res = sqlStatement("select distinct user from groups where id = ?", array($_GET["id"]));
 339     for ($iter = 0; $row = sqlFetchArray($res); $iter++)
 340       $result[$iter] = $row;
 341     foreach($result as $iter)
 342       $un = $iter{"user"};
 343     $res = sqlStatement("select name, user from groups where user = '$un' " .
 344       "and id != ?", array($_GET["id"]));
 345
 346     // Remove the user only if they are also in some other group.  I.e. every
 347     // user must be a member of at least one group.
 348     if (sqlFetchArray($res) != FALSE) {
 349       sqlStatement("delete from groups where id = ?", array($_GET["id"]));
 350     } else {
 351       $alertmsg .= "You must add this user to some other group before " .
 352         "removing them from this group. ";
 353     }
 354   }
 355 }
 356
 357 $form_inactive = empty($_REQUEST['form_inactive']) ? false : true;
 358
 359 ?>
 360 <html>
 361 <head>
 362
 363 <link rel="stylesheet" href="<?php echo $css_header;?>" type="text/css">
 364 <link rel="stylesheet" href="<?php echo $css_header;?>" type="text/css">
 365 <link rel="stylesheet" type="text/css" href="<?php echo $GLOBALS['webroot'] ?>/library/js/fancybox/jquery.fancybox-1.2.6.css" media="screen" />
 366 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/dialog.js?v=<?php echo $v_js_includes; ?>"></script>
 367 <script type="text/javascript" src="<?php echo $GLOBALS['assets_static_relative']; ?>/jquery-min-1-3-2/index.js"></script>
 368 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/js/common.js"></script>
 369 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/js/fancybox/jquery.fancybox-1.2.6.js"></script>
 370 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/js/jquery-ui.js"></script>
 371 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/js/jquery.easydrag.handler.beta2.js"></script>
 372 <script type="text/javascript">
 373
 374 $(document).ready(function(){
 375
 376     // fancy box
 377     enable_modals();
 378
 379     tabbify();
 380
 381     // special size for
 382         $(".iframe_medium").fancybox( {
 383                 'overlayOpacity' : 0.0,
 384                 'showCloseButton' : true,
 385                 'frameHeight' : 450,
 386                 'frameWidth' : 660
 387         });
 388
 389         $(function(){
 390                 // add drag and drop functionality to fancybox
 391                 $("#fancy_outer").easydrag();
 392         });
 393 });
 394
 395 </script>
 396 <script language="JavaScript">
 397
 398 function authorized_clicked() {
 399  var f = document.forms[0];
 400  f.calendar.disabled = !f.authorized.checked;
 401  f.calendar.checked  =  f.authorized.checked;
 402 }
 403
 404 </script>
 405
 406 </head>
 407 <body class="body_top">
 408
 409 <div>
 410     <div>
 411        <table>
 412           <tr >
 413                 <td><b><?php xl('User / Groups','e'); ?></b></td>
 414                 <td><a href="usergroup_admin_add.php" class="iframe_medium css_button"><span><?php xl('Add User','e'); ?></span></a>
 415                 </td>
 416                 <td><a href="facility_user.php" class="css_button"><span><?php xl('View Facility Specific User Information','e'); ?></span></a>
 417                 </td>
 418           </tr>
 419         </table>
 420     </div>
 421     <div style="width:650px;">
 422         <div>
 423
 424 <form name='userlist' method='post' action='usergroup_admin.php' onsubmit='return top.restoreSession()'>
 425     <input type='checkbox' name='form_inactive' value='1' onclick='submit()' <?php if ($form_inactive) echo 'checked '; ?>/>
 426     <span class='text' style = "margin-left:-3px"> <?php xl('Include inactive users','e'); ?> </span>
 427 </form>
 428 <?php
 429 if($set_active_msg == 1){
 430 echo "<font class='alert'>".xl('Emergency Login ACL is chosen. The user is still in active state, please de-activate the user and activate the same when required during emergency situations. Visit Administration->Users for activation or de-activation.')."</font><br>";
 431 }
 432 if ($show_message == 1){
 433  echo "<font class='alert'>".xl('The following Emergency Login User is activated:')." "."<b>".$_GET['fname']."</b>"."</font><br>";
 434  echo "<font class='alert'>".xl('Emergency Login activation email will be circulated only if following settings in the interface/globals.php file are configured:')." \$GLOBALS['Emergency_Login_email'], \$GLOBALS['Emergency_Login_email_id']</font>";
 435 }
 436
 437 ?>
 438 <table cellpadding="1" cellspacing="0" class="showborder">
 439         <tbody><tr height="22" class="showborder_head">
 440                 <th width="180px"><b><?php xl('Username','e'); ?></b></th>
 441                 <th width="270px"><b><?php xl('Real Name','e'); ?></b></th>
 442                 <th width="320px"><b><span class="bold"><?php xl('Additional Info','e'); ?></span></b></th>
 443                 <th><b><?php xl('Authorized','e'); ?>?</b></th>
 444
 445                 <?php
 446 $query = "SELECT * FROM users WHERE username != '' ";
 447 if (!$form_inactive) $query .= "AND active = '1' ";
 448 $query .= "ORDER BY username";
 449 $res = sqlStatement($query);
 450 for ($iter = 0;$row = sqlFetchArray($res);$iter++)
 451   $result4[$iter] = $row;
 452 foreach ($result4 as $iter) {
 453   if ($iter{"authorized"}) {
 454     $iter{"authorized"} = xl('yes');
 455   } else {
 456       $iter{"authorized"} = "";
 457   }
 458   print "<tr height=20  class='text' style='border-bottom: 1px dashed;'>
 459                 <td class='text'><b><a href='user_admin.php?id=" . $iter{"id"} .
 460     "' class='iframe_medium' onclick='top.restoreSession()'><span>" . $iter{"username"} . "</span></a></b>" ."&nbsp;</td>
 461         <td><span class='text'>" . attr($iter{"fname"}) . ' ' . attr($iter{"lname"}) ."</span>&nbsp;</td>
 462         <td><span class='text'>" . attr($iter{"info"}) . "</span>&nbsp;</td>
 463         <td align='left'><span class='text'>" .$iter{"authorized"} . "</span>&nbsp;</td>";
 464   print "<td><!--<a href='usergroup_admin.php?mode=delete&id=" . $iter{"id"} .
 465     "' class='link_submit'>[Delete]</a>--></td>";
 466   print "</tr>\n";
 467 }
 468 ?>
 469         </tbody></table>
 470 <?php
 471 if (empty($GLOBALS['disable_non_default_groups'])) {
 472   $res = sqlStatement("select * from groups order by name");
 473   for ($iter = 0;$row = sqlFetchArray($res);$iter++)
 474     $result5[$iter] = $row;
 475
 476   foreach ($result5 as $iter) {
 477     $grouplist{$iter{"name"}} .= $iter{"user"} .
 478       "(<a class='link_submit' href='usergroup_admin.php?mode=delete_group&id=" .
 479       $iter{"id"} . "' onclick='top.restoreSession()'>Remove</a>), ";
 480   }
 481
 482   foreach ($grouplist as $groupname => $list) {
 483     print "<span class='bold'>" . $groupname . "</span><br>\n<span class='text'>" .
 484       substr($list,0,strlen($list)-2) . "</span><br>\n";
 485   }
 486 }
 487 ?>
 488         </div>
 489     </div>
 490 </div>
 491
 492
 493 <script language="JavaScript">
 494 <?php
 495   if ($alertmsg = trim($alertmsg)) {
 496     echo "alert('$alertmsg');\n";
 497   }
 498 ?>
 499 </script>
 500
 501 </body>
 502 </html>