interface/usergroup/usergroup_admin.php

   1 <?php
   2 require_once("../globals.php");
   3 require_once("../../library/acl.inc");
   4 require_once("$srcdir/sha1.js");
   5 require_once("$srcdir/sql.inc");
   6 require_once("$srcdir/auth.inc");
   7 require_once("$srcdir/formdata.inc.php");
   8 require_once(dirname(__FILE__) . "/../../library/classes/WSProvider.class.php");
   9 require_once ($GLOBALS['srcdir'] . "/classes/postmaster.php");
  10
  11 $alertmsg = '';
  12 $bg_msg = '';
  13 $set_active_msg=0;
  14
  15 /* Sending a mail to the admin when the breakglass user is activated only if $GLOBALS['Emergency_Login_email'] is set to 1 */
  16 $bg_count=count($access_group);
  17 $mail_id = explode(".",$SMTP_HOST);
  18 for($i=0;$i<$bg_count;$i++){
  19 if(($_GET['access_group'][$i] == "Emergency Login") && ($_GET['active'] == 'on') && ($_GET['pre_active'] == 0)){
  20   if(($_GET['get_admin_id'] == 1) && ($_GET['admin_id'] != "")){
  21         $res = sqlStatement("select username from users where id={$_GET["id"]}");
  22         $row = sqlFetchArray($res);
  23         $uname=$row['username'];
  24         $mail = new MyMailer();
  25         $mail->SetLanguage("en",$GLOBALS['fileroot'] . "/library/" );
  26         $mail->From = "admin@".$mail_id[1].".".$mail_id[2];
  27         $mail->FromName = "Administrator OpenEMR";
  28         $text_body  = "Hello Security Admin,\n\n The Emergency Login user ".$uname.
  29                                                 " was activated at ".date('l jS \of F Y h:i:s A')." \n\nThanks,\nAdmin OpenEMR.";
  30         $mail->Body = $text_body;
  31         $mail->Subject = "Emergency Login User Activated";
  32         $mail->AddAddress($_GET['admin_id']);
  33         $mail->Send();
  34 }
  35 }
  36 }
  37 /* To refresh and save variables in mail frame */
  38 if ($_GET["privatemode"]=="user_admin") {
  39     if ($_GET["mode"] == "update") {
  40       if ($_GET["username"]) {
  41         // $tqvar = addslashes(trim($_GET["username"]));
  42         $tqvar = trim(formData('username','G'));
  43         $user_data = mysql_fetch_array(sqlStatement("select * from users where id={$_GET["id"]}"));
  44         sqlStatement("update users set username='$tqvar' where id={$_GET["id"]}");
  45         sqlStatement("update groups set user='$tqvar' where user='". $user_data["username"]  ."'");
  46         //echo "query was: " ."update groups set user='$tqvar' where user='". $user_data["username"]  ."'" ;
  47       }
  48       if ($_GET["taxid"]) {
  49         $tqvar = formData('taxid','G');
  50         sqlStatement("update users set federaltaxid='$tqvar' where id={$_GET["id"]}");
  51       }
  52       if ($_GET["drugid"]) {
  53         $tqvar = formData('drugid','G');
  54         sqlStatement("update users set federaldrugid='$tqvar' where id={$_GET["id"]}");
  55       }
  56       if ($_GET["upin"]) {
  57         $tqvar = formData('upin','G');
  58         sqlStatement("update users set upin='$tqvar' where id={$_GET["id"]}");
  59       }
  60       if ($_GET["npi"]) {
  61         $tqvar = formData('npi','G');
  62         sqlStatement("update users set npi='$tqvar' where id={$_GET["id"]}");
  63       }
  64       if ($_GET["taxonomy"]) {
  65         $tqvar = formData('taxonomy','G');
  66         sqlStatement("update users set taxonomy = '$tqvar' where id= {$_GET["id"]}");
  67       }
  68       if ($_GET["lname"]) {
  69         $tqvar = formData('lname','G');
  70         sqlStatement("update users set lname='$tqvar' where id={$_GET["id"]}");
  71       }
  72       if ($_GET["job"]) {
  73         $tqvar = formData('job','G');
  74         sqlStatement("update users set specialty='$tqvar' where id={$_GET["id"]}");
  75       }
  76       if ($_GET["mname"]) {
  77               $tqvar = formData('mname','G');
  78               sqlStatement("update users set mname='$tqvar' where id={$_GET["id"]}");
  79       }
  80       if ($_GET["facility_id"]) {
  81               $tqvar = formData('facility_id','G');
  82               sqlStatement("update users set facility_id = '$tqvar' where id = {$_GET["id"]}");
  83               //(CHEMED) Update facility name when changing the id
  84               sqlStatement("UPDATE users, facility SET users.facility = facility.name WHERE facility.id = '$tqvar' AND users.id = {$_GET["id"]}");
  85               //END (CHEMED)
  86       }
  87       if ($GLOBALS['restrict_user_facility'] && $_GET["schedule_facility"]) {
  88           sqlStatement("delete from users_facility
  89             where tablename='users'
  90             and table_id={$_GET["id"]}
  91             and facility_id not in (" . implode(",", $_GET['schedule_facility']) . ")");
  92           foreach($_GET["schedule_facility"] as $tqvar) {
  93           sqlStatement("replace into users_facility set
  94                 facility_id = '$tqvar',
  95                 tablename='users',
  96                 table_id = {$_GET["id"]}");
  97         }
  98       }
  99       if ($_GET["fname"]) {
 100               $tqvar = formData('fname','G');
 101               sqlStatement("update users set fname='$tqvar' where id={$_GET["id"]}");
 102       }
 103
 104       //(CHEMED) Calendar UI preference
 105       if ($_GET["cal_ui"]) {
 106               $tqvar = formData('cal_ui','G');
 107               sqlStatement("update users set cal_ui = '$tqvar' where id = {$_GET["id"]}");
 108
 109               // added by bgm to set this session variable if the current user has edited
 110           //   their own settings
 111           if ($_SESSION['authId'] == $_GET["id"]) {
 112             $_SESSION['cal_ui'] = $tqvar;
 113           }
 114       }
 115       //END (CHEMED) Calendar UI preference
 116
 117       if (isset($_GET['default_warehouse'])) {
 118         sqlStatement("UPDATE users SET default_warehouse = '" .
 119           formData('default_warehouse','G') .
 120           "' WHERE id = '" . formData('id','G') . "'");
 121       }
 122
 123       if (isset($_GET['irnpool'])) {
 124         sqlStatement("UPDATE users SET irnpool = '" .
 125           formData('irnpool','G') .
 126           "' WHERE id = '" . formData('id','G') . "'");
 127       }
 128      //VicarePlus: Empty string of SHA1 is validated
 129      if ($_GET["newauthPass"] && $_GET["newauthPass"] != "da39a3ee5e6b4b0d3255bfef95601890afd80709") { // account for empty
 130         $tqvar = formData('newauthPass','G');
 131 // When the user password is updated and the password history option is enabled, update the password history in database. A new password expiration is also calculated
 132         if($GLOBALS['password_history'] != 0 ){
 133                 $updatepwd = UpdatePasswordHistory($_GET["id"], $tqvar);
 134         }else
 135         {
 136                 sqlStatement("update users set password='$tqvar' where id={$_GET["id"]}");
 137                 if($GLOBALS['password_expiration_days'] != 0){
 138                         $exp_days=$GLOBALS['password_expiration_days'];
 139                         $exp_date = date('Y-m-d', strtotime("+$exp_days days"));
 140                         sqlStatement("update users set pwd_expiration_date='$exp_date' where id=$userid");
 141                 }
 142         }
 143 }
 144
 145       // for relay health single sign-on
 146       if ($_GET["ssi_relayhealth"]) {
 147         $tqvar = formData('ssi_relayhealth','G');
 148         sqlStatement("update users set ssi_relayhealth = '$tqvar' where id = {$_GET["id"]}");
 149       }
 150
 151       $tqvar  = $_GET["authorized"] ? 1 : 0;
 152       $actvar = $_GET["active"]     ? 1 : 0;
 153       $calvar = $_GET["calendar"]   ? 1 : 0;
 154
 155       sqlStatement("UPDATE users SET authorized = $tqvar, active = $actvar, " .
 156         "calendar = $calvar, see_auth = '" . $_GET['see_auth'] . "' WHERE " .
 157         "id = {$_GET["id"]}");
 158       //Display message when Emergency Login user was activated
 159       $bg_count=count($_GET['access_group']);
 160       for($i=0;$i<$bg_count;$i++){
 161         if(($_GET['access_group'][$i] == "Emergency Login") && ($_GET['pre_active'] == 0) && ($actvar == 1)){
 162          $show_message = 1;
 163         }
 164       }
 165       if(($_GET['access_group'])){
 166         for($i=0;$i<$bg_count;$i++){
 167         if(($_GET['access_group'][$i] == "Emergency Login") && ($_GET['user_type']) == "" && ($_GET['check_acl'] == 1) && ($_GET['active']) != ""){
 168          $set_active_msg=1;
 169         }
 170       }
 171     }
 172       if ($_GET["comments"]) {
 173         $tqvar = formData('comments','G');
 174         sqlStatement("update users set info = '$tqvar' where id = {$_GET["id"]}");
 175       }
 176
 177       if (isset($phpgacl_location) && acl_check('admin', 'acl')) {
 178         // Set the access control group of user
 179         $user_data = mysql_fetch_array(sqlStatement("select username from users where id={$_GET["id"]}"));
 180         set_user_aro($_GET['access_group'], $user_data["username"],
 181           formData('fname','G'), formData('mname','G'), formData('lname','G'));
 182       }
 183
 184       $ws = new WSProvider($_GET['id']);
 185
 186     }
 187 }
 188
 189 /* To refresh and save variables in mail frame  - Arb*/
 190 if (isset($_POST["mode"])) {
 191   if ($_POST["mode"] == "new_user") {
 192     if ($_POST["authorized"] != "1") {
 193       $_POST["authorized"] = 0;
 194     }
 195     // $_POST["info"] = addslashes($_POST["info"]);
 196
 197     $calvar = $_POST["calendar"] ? 1 : 0;
 198
 199     $res = sqlStatement("select distinct username from users where username != ''");
 200     $doit = true;
 201     while ($row = mysql_fetch_array($res)) {
 202       if ($doit == true && $row['username'] == trim(formData('rumple'))) {
 203         $doit = false;
 204       }
 205     }
 206
 207     if ($doit == true) {
 208       //if password expiration option is enabled,  calculate the expiration date of the password
 209       if($GLOBALS['password_expiration_days'] != 0){
 210       $exp_days = $GLOBALS['password_expiration_days'];
 211       $exp_date = date('Y-m-d', strtotime("+$exp_days days"));
 212       }
 213       $prov_id = idSqlStatement("insert into users set " .
 214         "username = '"         . trim(formData('rumple'       )) .
 215         "', password = '"      . trim(formData('newauthPass'  )) .
 216         "', fname = '"         . trim(formData('fname'        )) .
 217         "', mname = '"         . trim(formData('mname'        )) .
 218         "', lname = '"         . trim(formData('lname'        )) .
 219         "', federaltaxid = '"  . trim(formData('federaltaxid' )) .
 220         "', authorized = '"    . trim(formData('authorized'   )) .
 221         "', info = '"          . trim(formData('info'         )) .
 222         "', federaldrugid = '" . trim(formData('federaldrugid')) .
 223         "', upin = '"          . trim(formData('upin'         )) .
 224         "', npi  = '"          . trim(formData('npi'          )).
 225         "', taxonomy = '"      . trim(formData('taxonomy'     )) .
 226         "', facility_id = '"   . trim(formData('facility_id'  )) .
 227         "', specialty = '"     . trim(formData('specialty'    )) .
 228         "', see_auth = '"      . trim(formData('see_auth'     )) .
 229         "', cal_ui = '"        . trim(formData('cal_ui'       )) .
 230         "', default_warehouse = '" . trim(formData('default_warehouse')) .
 231         "', irnpool = '"       . trim(formData('irnpool'      )) .
 232         "', calendar = '"      . $calvar                         .
 233         "', pwd_expiration_date = '" . trim("$exp_date") .
 234         "'");
 235       //set the facility name from the selected facility_id
 236       sqlStatement("UPDATE users, facility SET users.facility = facility.name WHERE facility.id = '" . trim(formData('facility_id')) . "' AND users.username = '" . trim(formData('rumple')) . "'");
 237
 238       sqlStatement("insert into groups set name = '" . trim(formData('groupname')) .
 239         "', user = '" . trim(formData('rumple')) . "'");
 240
 241       if (isset($phpgacl_location) && acl_check('admin', 'acl') && trim(formData('rumple'))) {
 242         // Set the access control group of user
 243         set_user_aro($_POST['access_group'], trim(formData('rumple')),
 244           trim(formData('fname')), trim(formData('mname')), trim(formData('lname')));
 245       }
 246
 247       $ws = new WSProvider($prov_id);
 248
 249     } else {
 250       $alertmsg .= xl('User','','',' ') . trim(formData('rumple')) . xl('already exists.','',' ');
 251     }
 252    if($_POST['access_group']){
 253          $bg_count=count($_POST['access_group']);
 254          for($i=0;$i<$bg_count;$i++){
 255           if($_POST['access_group'][$i] == "Emergency Login"){
 256              $set_active_msg=1;
 257            }
 258         }
 259       }
 260   }
 261   else if ($_POST["mode"] == "new_group") {
 262     $res = sqlStatement("select distinct name, user from groups");
 263     for ($iter = 0; $row = sqlFetchArray($res); $iter++)
 264       $result[$iter] = $row;
 265     $doit = 1;
 266     foreach ($result as $iter) {
 267       if ($doit == 1 && $iter{"name"} == trim(formData('groupname')) && $iter{"user"} == trim(formData('rumple')))
 268         $doit--;
 269     }
 270     if ($doit == 1) {
 271       sqlStatement("insert into groups set name = '" . trim(formData('groupname')) .
 272         "', user = '" . trim(formData('rumple')) . "'");
 273     } else {
 274       $alertmsg .= "User " . trim(formData('rumple')) .
 275         " is already a member of group " . trim(formData('groupname')) . ". ";
 276     }
 277   }
 278 }
 279
 280 if (isset($_GET["mode"])) {
 281
 282   /*******************************************************************
 283   // This is the code to delete a user.  Note that the link which invokes
 284   // this is commented out.  Somebody must have figured it was too dangerous.
 285   //
 286   if ($_GET["mode"] == "delete") {
 287     $res = sqlStatement("select distinct username, id from users where id = '" .
 288       $_GET["id"] . "'");
 289     for ($iter = 0; $row = sqlFetchArray($res); $iter++)
 290       $result[$iter] = $row;
 291
 292     // TBD: Before deleting the user, we should check all tables that
 293     // reference users to make sure this user is not referenced!
 294
 295     foreach($result as $iter) {
 296       sqlStatement("delete from groups where user = '" . $iter{"username"} . "'");
 297     }
 298     sqlStatement("delete from users where id = '" . $_GET["id"] . "'");
 299   }
 300   *******************************************************************/
 301
 302   if ($_GET["mode"] == "delete_group") {
 303     $res = sqlStatement("select distinct user from groups where id = '" .
 304       $_GET["id"] . "'");
 305     for ($iter = 0; $row = sqlFetchArray($res); $iter++)
 306       $result[$iter] = $row;
 307     foreach($result as $iter)
 308       $un = $iter{"user"};
 309     $res = sqlStatement("select name, user from groups where user = '$un' " .
 310       "and id != '" . $_GET["id"] . "'");
 311
 312     // Remove the user only if they are also in some other group.  I.e. every
 313     // user must be a member of at least one group.
 314     if (sqlFetchArray($res) != FALSE) {
 315       sqlStatement("delete from groups where id = '" . $_GET["id"] . "'");
 316     } else {
 317       $alertmsg .= "You must add this user to some other group before " .
 318         "removing them from this group. ";
 319     }
 320   }
 321 }
 322
 323 $form_inactive = empty($_REQUEST['form_inactive']) ? false : true;
 324
 325 ?>
 326 <html>
 327 <head>
 328
 329 <link rel="stylesheet" href="<?php echo $css_header;?>" type="text/css">
 330 <link rel="stylesheet" href="<?php echo $css_header;?>" type="text/css">
 331 <link rel="stylesheet" type="text/css" href="<?php echo $GLOBALS['webroot'] ?>/library/js/fancybox/jquery.fancybox-1.2.6.css" media="screen" />
 332 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/dialog.js"></script>
 333 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/js/jquery.1.3.2.js"></script>
 334 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/js/common.js"></script>
 335 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/js/fancybox/jquery.fancybox-1.2.6.js"></script>
 336 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/js/jquery-ui.js"></script>
 337 <script type="text/javascript" src="<?php echo $GLOBALS['webroot'] ?>/library/js/jquery.easydrag.handler.beta2.js"></script>
 338 <script type="text/javascript">
 339
 340 $(document).ready(function(){
 341
 342     // fancy box
 343     enable_modals();
 344
 345     tabbify();
 346
 347     // special size for
 348         $(".iframe_medium").fancybox( {
 349                 'overlayOpacity' : 0.0,
 350                 'showCloseButton' : true,
 351                 'frameHeight' : 450,
 352                 'frameWidth' : 660
 353         });
 354
 355         $(function(){
 356                 // add drag and drop functionality to fancybox
 357                 $("#fancy_outer").easydrag();
 358         });
 359 });
 360
 361 </script>
 362 <script language="JavaScript">
 363
 364 function authorized_clicked() {
 365  var f = document.forms[0];
 366  f.calendar.disabled = !f.authorized.checked;
 367  f.calendar.checked  =  f.authorized.checked;
 368 }
 369
 370 </script>
 371
 372 </head>
 373 <body class="body_top">
 374
 375 <div>
 376     <div>
 377        <table>
 378           <tr >
 379                 <td><b><?php xl('User / Groups','e'); ?></b></td>
 380                 <td><a href="usergroup_admin_add.php" class="iframe_medium css_button"><span><?php xl('Add User','e'); ?></span></a>
 381                 </td>
 382           </tr>
 383         </table>
 384     </div>
 385     <div style="width:650px;">
 386         <div>
 387
 388 <form name='userlist' method='post' action='usergroup_admin.php' onsubmit='return top.restoreSession()'>
 389     <input type='checkbox' name='form_inactive' value='1' onclick='submit()' <?php if ($form_inactive) echo 'checked '; ?>/>
 390     <span class='text' style = "margin-left:-3px"> <?php xl('Include inactive users','e'); ?> </span>
 391 </form>
 392 <?php
 393 if($set_active_msg == 1){
 394 echo "<font class='alert'>".xl('Emergency Login ACL is chosen. The user is still in active state, please de-activate the user and activate the same when required during emergency situations. Visit Administration->Users for activation or de-activation.')."</font><br>";
 395 }
 396 if ($show_message == 1){
 397  echo "<font class='alert'>".xl('The following Emergency Login User is activated:')." "."<b>".$_GET['fname']."</b>"."</font><br>";
 398  echo "<font class='alert'>".xl('Emergency Login activation email will be circulated only if following settings in the interface/globals.php file are configured:')." \$GLOBALS['Emergency_Login_email'], \$GLOBALS['Emergency_Login_email_id']</font>";
 399 }
 400
 401 ?>
 402 <table cellpadding="1" cellspacing="0" class="showborder">
 403         <tbody><tr height="22" class="showborder_head">
 404                 <th width="180px"><b><?php xl('Username','e'); ?></b></th>
 405                 <th width="270px"><b><?php xl('Real Name','e'); ?></b></th>
 406                 <th width="320px"><b><span class="bold"><?php xl('Additional Info','e'); ?></span></b></th>
 407                 <th><b><?php xl('Authorized','e'); ?>?</b></th>
 408
 409                 <?php
 410 $query = "SELECT * FROM users WHERE username != '' ";
 411 if (!$form_inactive) $query .= "AND active = '1' ";
 412 $query .= "ORDER BY username";
 413 $res = sqlStatement($query);
 414 for ($iter = 0;$row = sqlFetchArray($res);$iter++)
 415   $result4[$iter] = $row;
 416 foreach ($result4 as $iter) {
 417   if ($iter{"authorized"}) {
 418     $iter{"authorized"} = xl('yes');
 419   } else {
 420       $iter{"authorized"} = "";
 421   }
 422   print "<tr height=20  class='text' style='border-bottom: 1px dashed;'>
 423                 <td class='text'><b><a href='user_admin.php?id=" . $iter{"id"} .
 424     "' class='iframe_medium' onclick='top.restoreSession()'><span>" . $iter{"username"} . "</span></a></b>" ."&nbsp;</td>
 425         <td><span class='text'>" .$iter{"fname"} . ' ' . $iter{"lname"}."</span>&nbsp;</td>
 426         <td><span class='text'>" .$iter{"info"} . "</span>&nbsp;</td>
 427         <td align='left'><span class='text'>" .$iter{"authorized"} . "</span>&nbsp;</td>";
 428   print "<td><!--<a href='usergroup_admin.php?mode=delete&id=" . $iter{"id"} .
 429     "' class='link_submit'>[Delete]</a>--></td>";
 430   print "</tr>\n";
 431 }
 432 ?>
 433         </tbody></table>
 434 <?php
 435 if (empty($GLOBALS['disable_non_default_groups'])) {
 436   $res = sqlStatement("select * from groups order by name");
 437   for ($iter = 0;$row = sqlFetchArray($res);$iter++)
 438     $result5[$iter] = $row;
 439
 440   foreach ($result5 as $iter) {
 441     $grouplist{$iter{"name"}} .= $iter{"user"} .
 442       "(<a class='link_submit' href='usergroup_admin.php?mode=delete_group&id=" .
 443       $iter{"id"} . "' onclick='top.restoreSession()'>Remove</a>), ";
 444   }
 445
 446   foreach ($grouplist as $groupname => $list) {
 447     print "<span class='bold'>" . $groupname . "</span><br>\n<span class='text'>" .
 448       substr($list,0,strlen($list)-2) . "</span><br>\n";
 449   }
 450 }
 451 ?>
 452         </div>
 453     </div>
 454 </div>
 455
 456
 457 <script language="JavaScript">
 458 <?php
 459   if ($alertmsg = trim($alertmsg)) {
 460     echo "alert('$alertmsg');\n";
 461   }
 462 ?>
 463 </script>
 464
 465 </body>
 466 </html>