interface/usergroup/usergroup_admin.php

   1 <?php
   2 require_once("../globals.php");
   3 require_once("../../library/acl.inc");
   4 require_once("$srcdir/sha1.js");
   5 require_once("$srcdir/sql.inc");
   6 require_once("$srcdir/auth.inc");
   7 require_once("$srcdir/formdata.inc.php");
   8 require_once(dirname(__FILE__) . "/../../library/classes/WSProvider.class.php");
   9 require_once ($GLOBALS['srcdir'] . "/classes/postmaster.php");
  10
  11 $alertmsg = '';
  12 $bg_msg = '';
  13 $set_active_msg=0;
  14
  15 /* Sending a mail to the admin when the breakglass user is activated only if $GLOBALS['Emergency_Login_email'] is set to 1 */
  16 $bg_count=count($access_group);
  17 $mail_id = explode(".",$SMTP_HOST);
  18 for($i=0;$i<$bg_count;$i++){
  19 if(($_GET['access_group'][$i] == "Emergency Login") && ($_GET['active'] == 'on') && ($_GET['pre_active'] == 0)){
  20   if(($_GET['get_admin_id'] == 1) && ($_GET['admin_id'] != "")){
  21         $res = sqlStatement("select username from users where id={$_GET["id"]}");
  22         $row = sqlFetchArray($res);
  23         $uname=$row['username'];
  24         $mail = new MyMailer();
  25         $mail->SetLanguage("en",$GLOBALS['fileroot'] . "/library/" );
  26         $mail->From = "admin@".$mail_id[1].".".$mail_id[2];
  27         $mail->FromName = "Administrator OpenEMR";
  28         $text_body  = "Hello Security Admin,\n\n The Emergency Login user ".$uname.
  29                                                 " was activated at ".date('l jS \of F Y h:i:s A')." \n\nThanks,\nAdmin OpenEMR.";
  30         $mail->Body = $text_body;
  31         $mail->Subject = "Emergency Login User Activated";
  32         $mail->AddAddress($_GET['admin_id']);
  33         $mail->Send();
  34 }
  35 }
  36 }
  37 /* To refresh and save variables in mail frame */
  38 if ($_GET["privatemode"]=="user_admin") {
  39     if ($_GET["mode"] == "update") {
  40       if ($_GET["username"]) {
  41         // $tqvar = addslashes(trim($_GET["username"]));
  42         $tqvar = trim(formData('username','G'));
  43         $user_data = mysql_fetch_array(sqlStatement("select * from users where id={$_GET["id"]}"));
  44         sqlStatement("update users set username='$tqvar' where id={$_GET["id"]}");
  45         sqlStatement("update groups set user='$tqvar' where user='". $user_data["username"]  ."'");
  46         //echo "query was: " ."update groups set user='$tqvar' where user='". $user_data["username"]  ."'" ;
  47       }
  48       if ($_GET["taxid"]) {
  49         $tqvar = formData('taxid','G');
  50         sqlStatement("update users set federaltaxid='$tqvar' where id={$_GET["id"]}");
  51       }
  52       if ($_GET["state_license_number"]) {
  53         $tqvar = formData('state_license_number','G');
  54         sqlStatement("update users set state_license_number='$tqvar' where id={$_GET["id"]}");
  55       }
  56       if ($_GET["drugid"]) {
  57         $tqvar = formData('drugid','G');
  58         sqlStatement("update users set federaldrugid='$tqvar' where id={$_GET["id"]}");
  59       }
  60       if ($_GET["upin"]) {
  61         $tqvar = formData('upin','G');
  62         sqlStatement("update users set upin='$tqvar' where id={$_GET["id"]}");
  63       }
  64       if ($_GET["npi"]) {
  65         $tqvar = formData('npi','G');
  66         sqlStatement("update users set npi='$tqvar' where id={$_GET["id"]}");
  67       }
  68       if ($_GET["taxonomy"]) {
  69         $tqvar = formData('taxonomy','G');
  70         sqlStatement("update users set taxonomy = '$tqvar' where id= {$_GET["id"]}");
  71       }
  72       if ($_GET["lname"]) {
  73         $tqvar = formData('lname','G');
  74         sqlStatement("update users set lname='$tqvar' where id={$_GET["id"]}");
  75       }
  76       if ($_GET["job"]) {
  77         $tqvar = formData('job','G');
  78         sqlStatement("update users set specialty='$tqvar' where id={$_GET["id"]}");
  79       }
  80       if ($_GET["mname"]) {
  81               $tqvar = formData('mname','G');
  82               sqlStatement("update users set mname='$tqvar' where id={$_GET["id"]}");
  83       }
  84       if ($_GET["facility_id"]) {
  85               $tqvar = formData('facility_id','G');
  86               sqlStatement("update users set facility_id = '$tqvar' where id = {$_GET["id"]}");
  87               //(CHEMED) Update facility name when changing the id
  88               sqlStatement("UPDATE users, facility SET users.facility = facility.name WHERE facility.id = '$tqvar' AND users.id = {$_GET["id"]}");
  89               //END (CHEMED)
  90       }
  91       if ($GLOBALS['restrict_user_facility'] && $_GET["schedule_facility"]) {
  92           sqlStatement("delete from users_facility
  93             where tablename='users'
  94             and table_id={$_GET["id"]}
  95             and facility_id not in (" . implode(",", $_GET['schedule_facility']) . ")");
  96           foreach($_GET["schedule_facility"] as $tqvar) {
  97           sqlStatement("replace into users_facility set
  98                 facility_id = '$tqvar',
  99                 tablename='users',
 100                 table_id = {$_GET["id"]}");
 101         }
 102       }
 103       if ($_GET["fname"]) {
 104               $tqvar = formData('fname','G');
 105               sqlStatement("update users set fname='$tqvar' where id={$_GET["id"]}");
 106       }
 107
 108       //(CHEMED) Calendar UI preference
 109       if ($_GET["cal_ui"]) {
 110               $tqvar = formData('cal_ui','G');
 111               sqlStatement("update users set cal_ui = '$tqvar' where id = {$_GET["id"]}");
 112
 113               // added by bgm to set this session variable if the current user has edited
 114           //   their own settings
 115           if ($_SESSION['authId'] == $_GET["id"]) {
 116             $_SESSION['cal_ui'] = $tqvar;
 117           }
 118       }
 119       //END (CHEMED) Calendar UI preference
 120
 121       if (isset($_GET['default_warehouse'])) {
 122         sqlStatement("UPDATE users SET default_warehouse = '" .
 123           formData('default_warehouse','G') .
 124           "' WHERE id = '" . formData('id','G') . "'");
 125       }
 126
 127       if (isset($_GET['irnpool'])) {
 128         sqlStatement("UPDATE users SET irnpool = '" .
 129           formData('irnpool','G') .
 130           "' WHERE id = '" . formData('id','G') . "'");
 131       }
 132      //VicarePlus: Empty string of SHA1 is validated
 133      if ($_GET["newauthPass"] && $_GET["newauthPass"] != "da39a3ee5e6b4b0d3255bfef95601890afd80709") { // account for empty
 134         $tqvar = formData('newauthPass','G');
 135 // When the user password is updated and the password history option is enabled, update the password history in database. A new password expiration is also calculated
 136         if($GLOBALS['password_history'] != 0 ){
 137                 $updatepwd = UpdatePasswordHistory($_GET["id"], $tqvar);
 138         }else
 139         {
 140                 sqlStatement("update users set password='$tqvar' where id={$_GET["id"]}");
 141                 if($GLOBALS['password_expiration_days'] != 0){
 142                         $exp_days=$GLOBALS['password_expiration_days'];
 143                         $exp_date = date('Y-m-d', strtotime("+$exp_days days"));
 144                         sqlStatement("update users set pwd_expiration_date='$exp_date' where id=$userid");
 145                 }
 146         }
 147 }
 148
 149       // for relay health single sign-on
 150       if ($_GET["ssi_relayhealth"]) {
 151         $tqvar = formData('ssi_relayhealth','G');
 152         sqlStatement("update users set ssi_relayhealth = '$tqvar' where id = {$_GET["id"]}");
 153       }
 154
 155       $tqvar  = $_GET["authorized"] ? 1 : 0;
 156       $actvar = $_GET["active"]     ? 1 : 0;
 157       $calvar = $_GET["calendar"]   ? 1 : 0;
 158
 159       sqlStatement("UPDATE users SET authorized = $tqvar, active = $actvar, " .
 160         "calendar = $calvar, see_auth = '" . $_GET['see_auth'] . "' WHERE " .
 161         "id = {$_GET["id"]}");
 162       //Display message when Emergency Login user was activated
 163       $bg_count=count($_GET['access_group']);
 164       for($i=0;$i<$bg_count;$i++){
 165         if(($_GET['access_group'][$i] == "Emergency Login") && ($_GET['pre_active'] == 0) && ($actvar == 1)){
 166          $show_message = 1;
 167         }
 168       }
 169       if(($_GET['access_group'])){
 170         for($i=0;$i<$bg_count;$i++){
 171         if(($_GET['access_group'][$i] == "Emergency Login") && ($_GET['user_type']) == "" && ($_GET['check_acl'] == 1) && ($_GET['active']) != ""){
 172          $set_active_msg=1;
 173         }
 174       }
 175     }
 176       if ($_GET["comments"]) {
 177         $tqvar = formData('comments','G');
 178         sqlStatement("update users set info = '$tqvar' where id = {$_GET["id"]}");
 179       }
 180         $erxrole = formData('erxrole','G');
 181         sqlStatement("update users set newcrop_user_role = '$erxrole' where id = {$_GET["id"]}");
 182
 183       if (isset($phpgacl_location) && acl_check('admin', 'acl')) {
 184         // Set the access control group of user
 185         $user_data = mysql_fetch_array(sqlStatement("select username from users where id={$_GET["id"]}"));
 186         set_user_aro($_GET['access_group'], $user_data["username"],
 187           formData('fname','G'), formData('mname','G'), formData('lname','G'));
 188       }
 189
 190       $ws = new WSProvider($_GET['id']);
 191
 192     }
 193 }
 194
 195 /* To refresh and save variables in mail frame  - Arb*/
 196 if (isset($_POST["mode"])) {
 197   if ($_POST["mode"] == "new_user") {
 198     if ($_POST["authorized"] != "1") {
 199       $_POST["authorized"] = 0;
 200     }
 201     // $_POST["info"] = addslashes($_POST["info"]);
 202
 203     $calvar = $_POST["calendar"] ? 1 : 0;
 204
 205     $res = sqlStatement("select distinct username from users where username != ''");
 206     $doit = true;
 207     while ($row = mysql_fetch_array($res)) {
 208       if ($doit == true && $row['username'] == trim(formData('rumple'))) {
 209         $doit = false;
 210       }
 211     }
 212
 213     if ($doit == true) {
 214       //if password expiration option is enabled,  calculate the expiration date of the password
 215       if($GLOBALS['password_expiration_days'] != 0){
 216       $exp_days = $GLOBALS['password_expiration_days'];
 217       $exp_date = date('Y-m-d', strtotime("+$exp_days days"));
 218       }
 219       $prov_id = idSqlStatement("insert into users set " .
 220         "username = '"         . trim(formData('rumple'       )) .
 221         "', password = '"      . trim(formData('newauthPass'  )) .
 222         "', fname = '"         . trim(formData('fname'        )) .
 223         "', mname = '"         . trim(formData('mname'        )) .
 224         "', lname = '"         . trim(formData('lname'        )) .
 225         "', federaltaxid = '"  . trim(formData('federaltaxid' )) .
 226         "', state_license_number = '"  . trim(formData('state_license_number' )) .
 227         "', newcrop_user_role = '"  . trim(formData('erxrole' )) .
 228         "', authorized = '"    . trim(formData('authorized'   )) .
 229         "', info = '"          . trim(formData('info'         )) .
 230         "', federaldrugid = '" . trim(formData('federaldrugid')) .
 231         "', upin = '"          . trim(formData('upin'         )) .
 232         "', npi  = '"          . trim(formData('npi'          )).
 233         "', taxonomy = '"      . trim(formData('taxonomy'     )) .
 234         "', facility_id = '"   . trim(formData('facility_id'  )) .
 235         "', specialty = '"     . trim(formData('specialty'    )) .
 236         "', see_auth = '"      . trim(formData('see_auth'     )) .
 237         "', cal_ui = '"        . trim(formData('cal_ui'       )) .
 238         "', default_warehouse = '" . trim(formData('default_warehouse')) .
 239         "', irnpool = '"       . trim(formData('irnpool'      )) .
 240         "', calendar = '"      . $calvar                         .
 241         "', pwd_expiration_date = '" . trim("$exp_date") .
 242         "'");
 243       //set the facility name from the selected facility_id
 244       sqlStatement("UPDATE users, facility SET users.facility = facility.name WHERE facility.id = '" . trim(formData('facility_id')) . "' AND users.username = '" . trim(formData('rumple')) . "'");
 245
 246       sqlStatement("insert into groups set name = '" . trim(formData('groupname')) .
 247         "', user = '" . trim(formData('rumple')) . "'");
 248
 249       if (isset($phpgacl_location) && acl_check('admin', 'acl') && trim(formData('rumple'))) {
 250         // Set the access control group of user
 251         set_user_aro($_POST['access_group'], trim(formData('rumple')),
 252           trim(formData('fname')), trim(formData('mname')), trim(formData('lname')));
 253       }
 254
 255       $ws = new WSProvider($prov_id);
 256
 257     } else {
 258       $alertmsg .= xl('User','','',' ') . trim(formData('rumple')) . xl('already exists.','',' ');
 259     }
 260    if($_POST['access_group']){
 261          $bg_count=count($_POST['access_group']);
 262          for($i=0;$i<$bg_count;$i++){
 263           if($_POST['access_group'][$i] == "Emergency Login"){
 264              $set_active_msg=1;
 265            }
 266         }
 267       }
 268   }
 269   else if ($_POST["mode"] == "new_group") {
 270     $res = sqlStatement("select distinct name, user from groups");
 271     for ($iter = 0; $row = sqlFetchArray($res); $iter++)
 272       $result[$iter] = $row;
 273     $doit = 1;
 274     foreach ($result as $iter) {
 275       if ($doit == 1 && $iter{"name"} == trim(formData('groupname')) && $iter{"user"} == trim(formData('rumple')))
 276         $doit--;
 277     }
 278     if ($doit == 1) {
 279       sqlStatement("insert into groups set name = '" . trim(formData('groupname')) .
 280         "', user = '" . trim(formData('rumple')) . "'");
 281     } else {
 282       $alertmsg .= "User " . trim(formData('rumple')) .
 283         " is already a member of group " . trim(formData('groupname')) . ". ";
 284     }
 285   }
 286 }
 287
 288 if (isset($_GET["mode"])) {
 289
 290   /*******************************************************************
 291   // This is the code to delete a user.  Note that the link which invokes
 292   // this is commented out.  Somebody must have figured it was too dangerous.
 293   //
 294   if ($_GET["mode"] == "delete") {
 295     $res = sqlStatement("select distinct username, id from users where id = '" .
 296       $_GET["id"] . "'");
 297     for ($iter = 0; $row = sqlFetchArray($res); $iter++)
 298       $result[$iter] = $row;
 299
 300     // TBD: Before deleting the user, we should check all tables that
 301     // reference users to make sure this user is not referenced!
 302
 303     foreach($result as $iter) {
 304       sqlStatement("delete from groups where user = '" . $iter{"username"} . "'");
 305     }
 306     sqlStatement("delete from users where id = '" . $_GET["id"] . "'");
 307   }
 308   *******************************************************************/
 309
 310   if ($_GET["mode"] == "delete_group") {
 311     $res = sqlStatement("select distinct user from groups where id = '" .
 312       $_GET["id"] . "'");
 313     for ($iter = 0; $row = sqlFetchArray($res); $iter++)
 314       $result[$iter] = $row;
 315     foreach($result as $iter)
 316       $un = $iter{"user"};
 317     $res = sqlStatement("select name, user from groups where user = '$un' " .
 318       "and id != '" . $_GET["id"] . "'");
 319
 320     // Remove the user only if they are also in some other group.  I.e. every
 321     // user must be a member of at least one group.
 322     if (sqlFetchArray($res) != FALSE) {
 323       sqlStatement("delete from groups where id = '" . $_GET["id"] . "'");
 324     } else {
 325       $alertmsg .= "You must add this user to some other group before " .
 326         "removing them from this group. ";
 327     }
 328   }
 329 }
 330
 331 $form_inactive = empty($_REQUEST['form_inactive']) ? false : true;
 332
 333 ?>
 334 <html>
 335 <head>
 336
 337 <link rel="stylesheet" href="<?php echo $css_header;?>" type="text/css">
 338 <link rel="stylesheet" href="<?php echo $css_header;?>" type="text/css">
 339 <link rel="stylesheet" type="text/css" href="<?php echo $GLOBALS['webroot'] ?>/library/js/fancybox/jquery.fancybox-1.2.6.css" media="screen" />
 340 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/dialog.js"></script>
 341 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/js/jquery.1.3.2.js"></script>
 342 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/js/common.js"></script>
 343 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/js/fancybox/jquery.fancybox-1.2.6.js"></script>
 344 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/js/jquery-ui.js"></script>
 345 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/js/jquery.easydrag.handler.beta2.js"></script>
 346 <script type="text/javascript">
 347
 348 $(document).ready(function(){
 349
 350     // fancy box
 351     enable_modals();
 352
 353     tabbify();
 354
 355     // special size for
 356         $(".iframe_medium").fancybox( {
 357                 'overlayOpacity' : 0.0,
 358                 'showCloseButton' : true,
 359                 'frameHeight' : 450,
 360                 'frameWidth' : 660
 361         });
 362
 363         $(function(){
 364                 // add drag and drop functionality to fancybox
 365                 $("#fancy_outer").easydrag();
 366         });
 367 });
 368
 369 </script>
 370 <script language="JavaScript">
 371
 372 function authorized_clicked() {
 373  var f = document.forms[0];
 374  f.calendar.disabled = !f.authorized.checked;
 375  f.calendar.checked  =  f.authorized.checked;
 376 }
 377
 378 </script>
 379
 380 </head>
 381 <body class="body_top">
 382
 383 <div>
 384     <div>
 385        <table>
 386           <tr >
 387                 <td><b><?php xl('User / Groups','e'); ?></b></td>
 388                 <td><a href="usergroup_admin_add.php" class="iframe_medium css_button"><span><?php xl('Add User','e'); ?></span></a>
 389                 </td>
 390                 <td><a href="facility_user.php" class="css_button"><span><?php xl('View Facility Specific User Information','e'); ?></span></a>
 391                 </td>
 392           </tr>
 393         </table>
 394     </div>
 395     <div style="width:650px;">
 396         <div>
 397
 398 <form name='userlist' method='post' action='usergroup_admin.php' onsubmit='return top.restoreSession()'>
 399     <input type='checkbox' name='form_inactive' value='1' onclick='submit()' <?php if ($form_inactive) echo 'checked '; ?>/>
 400     <span class='text' style = "margin-left:-3px"> <?php xl('Include inactive users','e'); ?> </span>
 401 </form>
 402 <?php
 403 if($set_active_msg == 1){
 404 echo "<font class='alert'>".xl('Emergency Login ACL is chosen. The user is still in active state, please de-activate the user and activate the same when required during emergency situations. Visit Administration->Users for activation or de-activation.')."</font><br>";
 405 }
 406 if ($show_message == 1){
 407  echo "<font class='alert'>".xl('The following Emergency Login User is activated:')." "."<b>".$_GET['fname']."</b>"."</font><br>";
 408  echo "<font class='alert'>".xl('Emergency Login activation email will be circulated only if following settings in the interface/globals.php file are configured:')." \$GLOBALS['Emergency_Login_email'], \$GLOBALS['Emergency_Login_email_id']</font>";
 409 }
 410
 411 ?>
 412 <table cellpadding="1" cellspacing="0" class="showborder">
 413         <tbody><tr height="22" class="showborder_head">
 414                 <th width="180px"><b><?php xl('Username','e'); ?></b></th>
 415                 <th width="270px"><b><?php xl('Real Name','e'); ?></b></th>
 416                 <th width="320px"><b><span class="bold"><?php xl('Additional Info','e'); ?></span></b></th>
 417                 <th><b><?php xl('Authorized','e'); ?>?</b></th>
 418
 419                 <?php
 420 $query = "SELECT * FROM users WHERE username != '' ";
 421 if (!$form_inactive) $query .= "AND active = '1' ";
 422 $query .= "ORDER BY username";
 423 $res = sqlStatement($query);
 424 for ($iter = 0;$row = sqlFetchArray($res);$iter++)
 425   $result4[$iter] = $row;
 426 foreach ($result4 as $iter) {
 427   if ($iter{"authorized"}) {
 428     $iter{"authorized"} = xl('yes');
 429   } else {
 430       $iter{"authorized"} = "";
 431   }
 432   print "<tr height=20  class='text' style='border-bottom: 1px dashed;'>
 433                 <td class='text'><b><a href='user_admin.php?id=" . $iter{"id"} .
 434     "' class='iframe_medium' onclick='top.restoreSession()'><span>" . $iter{"username"} . "</span></a></b>" ."&nbsp;</td>
 435         <td><span class='text'>" .$iter{"fname"} . ' ' . $iter{"lname"}."</span>&nbsp;</td>
 436         <td><span class='text'>" .$iter{"info"} . "</span>&nbsp;</td>
 437         <td align='left'><span class='text'>" .$iter{"authorized"} . "</span>&nbsp;</td>";
 438   print "<td><!--<a href='usergroup_admin.php?mode=delete&id=" . $iter{"id"} .
 439     "' class='link_submit'>[Delete]</a>--></td>";
 440   print "</tr>\n";
 441 }
 442 ?>
 443         </tbody></table>
 444 <?php
 445 if (empty($GLOBALS['disable_non_default_groups'])) {
 446   $res = sqlStatement("select * from groups order by name");
 447   for ($iter = 0;$row = sqlFetchArray($res);$iter++)
 448     $result5[$iter] = $row;
 449
 450   foreach ($result5 as $iter) {
 451     $grouplist{$iter{"name"}} .= $iter{"user"} .
 452       "(<a class='link_submit' href='usergroup_admin.php?mode=delete_group&id=" .
 453       $iter{"id"} . "' onclick='top.restoreSession()'>Remove</a>), ";
 454   }
 455
 456   foreach ($grouplist as $groupname => $list) {
 457     print "<span class='bold'>" . $groupname . "</span><br>\n<span class='text'>" .
 458       substr($list,0,strlen($list)-2) . "</span><br>\n";
 459   }
 460 }
 461 ?>
 462         </div>
 463     </div>
 464 </div>
 465
 466
 467 <script language="JavaScript">
 468 <?php
 469   if ($alertmsg = trim($alertmsg)) {
 470     echo "alert('$alertmsg');\n";
 471   }
 472 ?>
 473 </script>
 474
 475 </body>
 476 </html>