library/ajax/adminacl_ajax.php

   1 <?php
   2 // Copyright (C) 2007 Brady Miller <brady@sparmy.com>
   3 //
   4 // This program is free software; you can redistribute it and/or
   5 // modify it under the terms of the GNU General Public License
   6 // as published by the Free Software Foundation; either version 2
   7 // of the License, or (at your option) any later version.
   8 //
   9 //
  10 // This file contains functions that service ajax requests for
  11 // ACL(php-gacl) administration within OpenEMR. All returns are
  12 // done via xml.
  13 //
  14 // Important - Ensure that display_errors=Off in php.ini settings.
  15 //
  16 include_once("../../interface/globals.php");
  17 include_once("$srcdir/acl.inc");
  18
  19 header("Content-type: text/xml");
  20 header("Cache-Control: no-cache");
  21
  22 //initiate error array
  23 $error = array();
  24
  25 //PENDING, need to clean this up on client side
  26 //ensure user has proper access
  27 if (!acl_check('admin', 'acl')) {
  28 echo error_xml(xl('ACL Administration Not Authorized'));
  29 exit;
  30 }
  31 //ensure php is installed
  32 if (!isset($phpgacl_location)) {
  33 echo error_xml(xl('PHP-gacl is not installed'));
  34 exit;
  35 }
  36
  37 //Display red alert if Emergency Login ACL is activated for a user.
  38 if($_POST["action"] == "add"){
  39   if (in_array("Emergency Login",$_POST["selection"])) {
  40       array_push($error, (xl('Emergency Login ACL is chosen. The user is still in active state, please de-activate the user and activate the same when required during emergency situations. Visit Administration->Users for activation or de-activation.') ));
  41    }
  42  }
  43
  44 //PROCESS USERNAME REQUESTS
  45 if ($_POST["control"] == "username") {
  46  if ($_POST["action"] == "list") {
  47   //return username list with alert if user is not joined to group
  48   echo username_listings_xml($error);
  49  }
  50 }
  51
  52
  53 //PROCESS MEMBERSHIP REQUESTS
  54 if ($_POST["control"] == "membership") {
  55  if ($_POST["action"] == "list") {
  56   //return membership data
  57   echo user_group_listings_xml($_POST["name"], $error);
  58  }
  59
  60  if ($_POST["action"] == "add") {
  61   if ($_POST["selection"][0] == "null") {
  62    //no selection, return soft error, and just return membership data
  63    array_push($error, (xl('No group was selected') . "!"));
  64    echo user_group_listings_xml($_POST["name"], $error);
  65    exit;
  66   }
  67   //add the group, then return updated membership data
  68   add_user_aros($_POST["name"], $_POST["selection"]);
  69   echo user_group_listings_xml($_POST["name"], $error);
  70  }
  71
  72  if ($_POST["action"] == "remove") {
  73   if ($_POST["selection"][0] == "null") {
  74    //no selection, return soft error, and just return membership data
  75    array_push($error, (xl('No group was selected') . "!"));
  76    echo user_group_listings_xml($_POST["name"], $error);
  77    exit;
  78   }
  79   if (($_POST["name"] == "admin") && in_array("Administrators",$_POST["selection"])) {
  80    //unable to remove admin user from administrators group, process remove,
  81    // send soft error, then return data
  82    array_push($error, (xl('Not allowed to remove the admin user from the Administrators group') . "!"));
  83    remove_user_aros($_POST["name"], $_POST["selection"]);
  84    echo user_group_listings_xml($_POST["name"], $error);
  85    exit;
  86   }
  87   //remove the group(s), then return updated membership data
  88   remove_user_aros($_POST["name"], $_POST["selection"]);
  89   echo user_group_listings_xml($_POST["name"], $error);
  90  }
  91 }
  92
  93
  94 //PROCESS ACL REQUESTS
  95 if ($_POST["control"] == "acl") {
  96  if ($_POST["action"] == "list") {
  97   //return acl titles with return values
  98   echo acl_listings_xml($error);
  99  }
 100
 101  if ($_POST["action"] == "add") {
 102   //validate form data
 103   $form_error = false;
 104   if (empty($_POST["title"])) {
 105    $form_error = true;
 106    array_push($error, ("title_" . xl('Need to enter title') . "!"));
 107   }
 108   else if (!ctype_alpha(str_replace(' ', '', $_POST["title"]))) {
 109    $form_error = true;
 110    array_push($error, ("title_" . xl('Please only use alphabetic characters') . "!"));
 111   }
 112   else if (acl_exist($_POST["title"], FALSE, $_POST["return_value"])) {
 113    $form_error = true;
 114    array_push($error, ("title_" . xl('Already used, choose another title') . "!"));
 115   }
 116   if (empty($_POST["identifier"])) {
 117    $form_error = true;
 118    array_push($error, ("identifier_" . xl('Need to enter identifier') . "!"));
 119   }
 120   else if (!ctype_alpha($_POST["identifier"])) {
 121    $form_error = true;
 122    array_push($error, ("identifier_" . xl('Please only use alphabetic characters with no spaces') . "!"));
 123   }
 124   else if (acl_exist(FALSE, $_POST["identifier"], $_POST["return_value"])) {
 125    $form_error = true;
 126    array_push($error, ("identifier_" . xl('Already used, choose another identifier') . "!"));
 127   }
 128   if (empty($_POST["return_value"])) {
 129    $form_error = true;
 130    array_push($error, ("return_" . xl('Need to enter a Return Value') . "!"));
 131   }
 132   if (empty($_POST["description"])) {
 133    $form_error = true;
 134    array_push($error, ("description_" . xl('Need to enter a description') . "!"));
 135   }
 136   else if (!ctype_alpha(str_replace(' ', '', $_POST["description"]))) {
 137    $form_error = true;
 138    array_push($error, ("description_" . xl('Please only use alphabetic characters') . "!"));
 139   }
 140   //process if data is valid
 141   if (!$form_error) {
 142    acl_add($_POST["title"], $_POST["identifier"], $_POST["return_value"], $_POST["description"]);
 143    echo "<?xml version=\"1.0\"?>\n" .
 144     "<response>\n" .
 145     "\t<success>SUCCESS</success>\n" .
 146     "</response>\n";
 147   }
 148   else { //$form_error = true, so return errors
 149    echo error_xml($error);
 150   }
 151  }
 152
 153  if ($_POST["action"] == "remove") {
 154   //validate form data
 155   $form_error = false;
 156   if (empty($_POST["title"])) {
 157    $form_error = true;
 158    array_push($error, ("aclTitle_" . xl('Need to enter title') . "!"));
 159   }
 160   if ($_POST["title"] == "Administrators") {
 161    $form_error = true;
 162    array_push($error, ("aclTitle_" . xl('Not allowed to delete the Administrators group') . "!"));
 163   }
 164   //process if data is valid
 165   if (!$form_error) {
 166    acl_remove($_POST["title"], $_POST["return_value"]);
 167    echo "<?xml version=\"1.0\"?>\n" .
 168     "<response>\n" .
 169     "\t<success>SUCCESS</success>\n" .
 170     "</response>\n";
 171   }
 172   else { //$form_error = true, so return errors
 173    echo error_xml($error);
 174   }
 175  }
 176
 177  if ($_POST["action"] == "returns") {
 178   //simply return all the possible acl return_values
 179   echo return_values_xml($error);
 180  }
 181 }
 182
 183
 184 //PROCESS ACO REQUESTS
 185 if ($_POST["control"] == "aco") {
 186  if ($_POST["action"] == "list") {
 187   //send acl data
 188   echo aco_listings_xml($_POST["name"], $_POST["return_value"], $error);
 189  }
 190
 191  if ($_POST["action"] == "add") {
 192   if ($_POST["selection"][0] == "null") {
 193    //no selection, return soft error, and just return data
 194    array_push($error, (xl('Nothing was selected') . "!"));
 195    echo aco_listings_xml($_POST["name"], $_POST["return_value"], $error);
 196    exit;
 197   }
 198   //add the aco, then return updated membership data
 199   acl_add_acos($_POST["name"], $_POST["return_value"], $_POST["selection"]);
 200   echo aco_listings_xml($_POST["name"], $_POST["return_value"], $error);
 201  }
 202
 203  if ($_POST["action"] == "remove") {
 204   if ($_POST["selection"][0] == "null") {
 205    //no selection, return soft error, and just return data
 206    array_push($error, (xl('Nothing was selected') . "!"));
 207    echo aco_listings_xml($_POST["name"], $_POST["return_value"], $error);
 208    exit;
 209   }
 210   if ($_POST["name"] == "Administrators") {
 211    //will not allow removal of acos from Administrators ACL
 212    array_push($error, (xl('Not allowed to inactivate anything from the Administrators ACL') . "!"));
 213    echo aco_listings_xml($_POST["name"], $_POST["return_value"], $error);
 214    exit;
 215   }
 216   //remove the acos, then return updated data
 217   acl_remove_acos($_POST["name"], $_POST["return_value"], $_POST["selection"]);
 218   echo aco_listings_xml($_POST["name"], $_POST["return_value"], $error);
 219  }
 220 }
 221
 222
 223 //
 224 // Returns username listings via xml message.
 225 // It will also include alert if user is not joined
 226 // to a group yet
 227 //   $err = error strings (array)
 228 //
 229 function username_listings_xml($err) {
 230  $message = "<?xml version=\"1.0\"?>\n" .
 231   "<response>\n";
 232  $res = sqlStatement("select * from users where username != '' order by username");
 233  for ($iter = 0;$row = sqlFetchArray($res);$iter++)
 234   $result4[$iter] = $row;
 235  foreach ($result4 as $iter) {
 236   $message .= "\t<user>\n" .
 237     "\t\t<username>" . $iter{"username"} . "</username>\n";
 238   $username_acl_groups = acl_get_group_titles($iter{"username"});
 239   if (!$username_acl_groups) {
 240    //not joined to any group, so send alert
 241    $message .= "\t\t<alert>no membership</alert>\n";
 242   }
 243   $message .= "\t</user>\n";
 244  }
 245  if (isset($err)) {
 246   foreach ($err as $value) {
 247    $message .= "\t<error>" . $value . "</error>\n";
 248   }
 249  }
 250  $message .= "</response>\n";
 251  return $message;
 252 }
 253
 254 //
 255 // Returns user group listings(active and inactive lists)
 256 // via xml message.
 257 //   $username = username
 258 //   $err = error strings (array)
 259 //
 260 function user_group_listings_xml($username, $err) {
 261  $list_acl_groups = acl_get_group_title_list();
 262  $username_acl_groups = acl_get_group_titles($username);
 263   //note acl_get_group_titles() returns a 0 if user in no groups
 264
 265  $message = "<?xml version=\"1.0\"?>\n" .
 266   "<response>\n" .
 267   "\t<inactive>\n";
 268  foreach ($list_acl_groups as $value) {
 269   if ((!$username_acl_groups) || (!(in_array($value, $username_acl_groups)))) {
 270    $message .= "\t\t<group>\n";
 271    $message .= "\t\t\t<value>" . $value . "</value>\n";
 272
 273    // Modified 6-2009 by BM - Translate gacl group name if applicable
 274    $message .= "\t\t\t<label>" . xl_gacl_group($value) . "</label>\n";
 275
 276    $message .= "\t\t</group>\n";
 277   }
 278  }
 279  $message .= "\t</inactive>\n" .
 280   "\t<active>\n";
 281  if ($username_acl_groups) {
 282   foreach ($username_acl_groups as $value) {
 283    $message .= "\t\t<group>\n";
 284    $message .= "\t\t\t<value>" . $value . "</value>\n";
 285
 286    // Modified 6-2009 by BM - Translate gacl group name if applicable
 287    $message .= "\t\t\t<label>" . xl_gacl_group($value) . "</label>\n";
 288
 289    $message .= "\t\t</group>\n";
 290   }
 291  }
 292  $message .= "\t</active>\n";
 293  if (isset($err)) {
 294   foreach ($err as $value) {
 295    $message .= "\t<error>" . $value . "</error>\n";
 296   }
 297  }
 298  $message .= "</response>\n";
 299  return $message;
 300 }
 301
 302 //
 303 // Returns acl listings(including return value) via xml message.
 304 //   $err = error strings (array)
 305 //
 306 function acl_listings_xml($err) {
 307  global $phpgacl_location;
 308  include_once("$phpgacl_location/gacl_api.class.php");
 309  $gacl = new gacl_api();
 310
 311  $message = "<?xml version=\"1.0\"?>\n" .
 312   "<response>\n";
 313  foreach (acl_get_group_title_list() as $value) {
 314   $acl_id = $gacl->search_acl(FALSE, FALSE, FALSE, FALSE, $value, FALSE, FALSE, FALSE, FALSE);
 315   foreach ($acl_id as $value2) {
 316    $acl = $gacl->get_acl($value2);
 317    $ret = $acl["return_value"];
 318    $note = $acl["note"];
 319
 320    // Modified 6-2009 by BM - Translate gacl group name if applicable
 321    //                         Translate return value
 322    //                         Translate description
 323    $message .= "\t<acl>\n" .
 324     "\t\t<value>" . $value . "</value>\n" .
 325     "\t\t<title>" . xl_gacl_group($value) . "</title>\n" .
 326     "\t\t<returnid>" . $ret  . "</returnid>\n" .
 327     "\t\t<returntitle>" . xl($ret)  . "</returntitle>\n" .
 328     "\t\t<note>" . xl($note)  . "</note>\n" .
 329     "\t</acl>\n";
 330   }
 331  }
 332  if (isset($err)) {
 333   foreach ($err as $value) {
 334    $message .= "\t<error>" . $value . "</error>\n";
 335   }
 336  }
 337  $message .= "</response>\n";
 338  return $message;
 339 }
 340
 341 //
 342 // Return aco listings by sections(active and inactive lists)
 343 // via xml message.
 344 //   $group = group title (string)
 345 //   $return_value = return value (string)
 346 //   $err = error strings (array)
 347 //
 348 function aco_listings_xml($group, $return_value, $err) {
 349  global $phpgacl_location;
 350  include_once("$phpgacl_location/gacl_api.class.php");
 351  $gacl = new gacl_api();
 352
 353  //collect and sort all aco objects
 354  $list_aco_objects = $gacl->get_objects(NULL, 0, 'ACO');
 355  foreach ($list_aco_objects as $key => $value) {
 356   asort($list_aco_objects[$key]);
 357  }
 358
 359  //collect aco objects within the specified acl(already sorted)
 360  $acl_id = $gacl->search_acl(FALSE, FALSE, FALSE, FALSE, $group, FALSE, FALSE, FALSE, $return_value);
 361  $acl = $gacl->get_acl($acl_id[0]);
 362  $active_aco_objects = $acl["aco"];
 363
 364  $message = "<?xml version=\"1.0\"?>\n" .
 365   "<response>\n" .
 366   "\t<inactive>\n";
 367  foreach ($list_aco_objects as $key => $value) {
 368   $counter = 0;
 369   foreach($list_aco_objects[$key] as $value2) {
 370    if (!array_key_exists($key,$active_aco_objects) || !in_array($value2, $active_aco_objects[$key])) {
 371
 372     if ($counter == 0) {
 373      $counter = $counter + 1;
 374      $aco_section_data = $gacl->get_section_data($key, 'ACO');
 375      $aco_section_title = $aco_section_data[3];
 376
 377      // Modified 6-2009 by BM - Translate gacl aco section name
 378      $message .= "\t\t<section>\n" .
 379      "\t\t\t<name>" . xl($aco_section_title) . "</name>\n";
 380
 381     }
 382     $aco_id = $gacl->get_object_id($key, $value2,'ACO');
 383     $aco_data = $gacl->get_object_data($aco_id, 'ACO');
 384     $aco_title = $aco_data[0][3];
 385     $message .= "\t\t\t<aco>\n";
 386
 387     // Modified 6-2009 by BM - Translate gacl aco name
 388     $message .= "\t\t\t\t<title>" . xl($aco_title) . "</title>\n";
 389
 390     $message .= "\t\t\t\t<id>" . $aco_id . "</id>\n";
 391     $message .= "\t\t\t</aco>\n";
 392    }
 393   }
 394   if ($counter != 0) {
 395    $message .= "\t\t</section>\n";
 396   }
 397  }
 398  $message .= "\t</inactive>\n" .
 399   "\t<active>\n";
 400  foreach ($active_aco_objects as $key => $value) {
 401   $aco_section_data = $gacl->get_section_data($key, 'ACO');
 402   $aco_section_title = $aco_section_data[3];
 403
 404   // Modified 6-2009 by BM - Translate gacl aco section name
 405   $message .= "\t\t<section>\n" .
 406    "\t\t\t<name>" . xl($aco_section_title) . "</name>\n";
 407
 408   foreach($active_aco_objects[$key] as $value2) {
 409    $aco_id = $gacl->get_object_id($key, $value2,'ACO');
 410    $aco_data = $gacl->get_object_data($aco_id, 'ACO');
 411    $aco_title = $aco_data[0][3];
 412    $message .= "\t\t\t<aco>\n";
 413
 414    // Modified 6-2009 by BM - Translate gacl aco name
 415    $message .= "\t\t\t\t<title>" . xl($aco_title) . "</title>\n";
 416
 417    $message .= "\t\t\t\t<id>" . $aco_id . "</id>\n";
 418    $message .= "\t\t\t</aco>\n";
 419   }
 420   $message .= "\t\t</section>\n";
 421  }
 422  $message .= "\t</active>\n";
 423  if (isset($err)) {
 424   foreach ($err as $value) {
 425    $message .= "\t<error>" . $value . "</error>\n";
 426   }
 427  }
 428  $message .= "</response>\n";
 429  return $message;
 430 }
 431
 432 //
 433 // Returns listing of all possible return values via xml message.
 434 //   $err = error strings (array)
 435 //
 436 function return_values_xml($err) {
 437  global $phpgacl_location;
 438  include_once("$phpgacl_location/gacl_api.class.php");
 439  $gacl = new gacl_api();
 440  $returns = array();
 441
 442  $message = "<?xml version=\"1.0\"?>\n" .
 443   "<response>\n";
 444  foreach(acl_get_group_title_list() as $value) {
 445   $acl_id = $gacl->search_acl(FALSE, FALSE, FALSE, FALSE, $value, FALSE, FALSE, FALSE, FALSE);
 446    foreach($acl_id as $value2){
 447     $acl = $gacl->get_acl($value2);
 448     $ret = $acl["return_value"];
 449     if (!in_array($ret, $returns)) {
 450
 451      // Modified 6-2009 by BM - Translate return value
 452      $message .= "\t<return>\n";
 453      $message .= "\t\t<returnid>" . $ret  . "</returnid>\n";
 454      $message .= "\t\t<returntitle>" . xl($ret)  . "</returntitle>\n";
 455      $message .= "\t</return>\n";
 456
 457      array_push($returns, $ret);
 458     }
 459    }
 460  }
 461  if (isset($err)) {
 462   foreach ($err as $value) {
 463    $message .= "\t<error>" . $value . "</error>\n";
 464    }
 465  }
 466  $message .= "</response>\n";
 467  return $message;
 468 }
 469
 470 //
 471 // Returns error string(s) via xml
 472 //   $err = error (string or array)
 473 //
 474 function error_xml($err) {
 475  $message = "<?xml version=\"1.0\"?>\n" .
 476   "<response>\n";
 477  if (is_array($err)){
 478   foreach ($err as $value){
 479    $message .= "\t<error>" . $value . "</error>\n";
 480   }
 481  }
 482  else {
 483  $message .= "\t<error>" . $err . "</error>\n";
 484  }
 485  $message .= "</response>\n";
 486  return $message;
 487 }
 488 ?>