3 * This script Assign acl 'Emergency login'.
6 * @link http://www.open-emr.org
7 * @author Roberto Vasquez <robertogagliotta@gmail.com>
8 * @author Brady Miller <brady.g.miller@gmail.com>
9 * @copyright Copyright (c) 2015 Roberto Vasquez <robertogagliotta@gmail.com>
10 * @copyright Copyright (c) 2017 Brady Miller <brady.g.miller@gmail.com>
11 * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
14 require_once("../globals.php");
15 require_once("../../library/acl.inc");
16 require_once("$srcdir/auth.inc");
18 use OpenEMR\Core\Header
;
20 if (!acl_check('admin', 'user')) {
21 die(xlt('Access denied'));
29 /* Sending a mail to the admin when the breakglass user is activated only if $GLOBALS['Emergency_Login_email'] is set to 1 */
30 $bg_count=count($access_group);
31 $mail_id = explode(".", $SMTP_HOST);
32 for ($i=0; $i<$bg_count; $i++
) {
33 if (($_POST['access_group'][$i] == "Emergency Login") && ($_POST['active'] == 'on') && ($_POST['pre_active'] == 0)) {
34 if (($_POST['get_admin_id'] == 1) && ($_POST['admin_id'] != "")) {
35 $res = sqlStatement("select username from users where id= ? ", array($_POST["id"]));
36 $row = sqlFetchArray($res);
37 $uname=$row['username'];
38 $mail = new MyMailer();
39 $mail->From
= $GLOBALS["practice_return_email_path"];
40 $mail->FromName
= "Administrator OpenEMR";
41 $text_body = "Hello Security Admin,\n\n The Emergency Login user ".$uname.
42 " was activated at ".date('l jS \of F Y h:i:s A')." \n\nThanks,\nAdmin OpenEMR.";
43 $mail->Body
= $text_body;
44 $mail->Subject
= "Emergency Login User Activated";
45 $mail->AddAddress($_POST['admin_id']);
51 /* To refresh and save variables in mail frame */
52 if (isset($_POST["privatemode"]) && $_POST["privatemode"] =="user_admin") {
53 if ($_POST["mode"] == "update") {
54 if (isset($_POST["username"])) {
55 // $tqvar = addslashes(trim($_POST["username"]));
56 $tqvar = trim(formData('username', 'P'));
57 $user_data = sqlFetchArray(sqlStatement("select * from users where id= ? ", array($_POST["id"])));
58 sqlStatement("update users set username='$tqvar' where id= ? ", array($_POST["id"]));
59 sqlStatement("update groups set user='$tqvar' where user= ?", array($user_data["username"]));
60 //echo "query was: " ."update groups set user='$tqvar' where user='". $user_data["username"] ."'" ;
63 if ($_POST["taxid"]) {
64 $tqvar = formData('taxid', 'P');
65 sqlStatement("update users set federaltaxid='$tqvar' where id= ? ", array($_POST["id"]));
68 if ($_POST["state_license_number"]) {
69 $tqvar = formData('state_license_number', 'P');
70 sqlStatement("update users set state_license_number='$tqvar' where id= ? ", array($_POST["id"]));
73 if ($_POST["drugid"]) {
74 $tqvar = formData('drugid', 'P');
75 sqlStatement("update users set federaldrugid='$tqvar' where id= ? ", array($_POST["id"]));
79 $tqvar = formData('upin', 'P');
80 sqlStatement("update users set upin='$tqvar' where id= ? ", array($_POST["id"]));
84 $tqvar = formData('npi', 'P');
85 sqlStatement("update users set npi='$tqvar' where id= ? ", array($_POST["id"]));
88 if ($_POST["taxonomy"]) {
89 $tqvar = formData('taxonomy', 'P');
90 sqlStatement("update users set taxonomy = '$tqvar' where id= ? ", array($_POST["id"]));
93 if ($_POST["lname"]) {
94 $tqvar = formData('lname', 'P');
95 sqlStatement("update users set lname='$tqvar' where id= ? ", array($_POST["id"]));
99 $tqvar = formData('job', 'P');
100 sqlStatement("update users set specialty='$tqvar' where id= ? ", array($_POST["id"]));
103 if ($_POST["mname"]) {
104 $tqvar = formData('mname', 'P');
105 sqlStatement("update users set mname='$tqvar' where id= ? ", array($_POST["id"]));
108 if ($_POST["facility_id"]) {
109 $tqvar = formData('facility_id', 'P');
110 sqlStatement("update users set facility_id = '$tqvar' where id = ? ", array($_POST["id"]));
111 //(CHEMED) Update facility name when changing the id
112 sqlStatement("UPDATE users, facility SET users.facility = facility.name WHERE facility.id = '$tqvar' AND users.id = {$_POST["id
"]}");
116 if ($GLOBALS['restrict_user_facility'] && $_POST["schedule_facility"]) {
117 sqlStatement("delete from users_facility
118 where tablename='users'
120 and facility_id not in (" . implode(",", $_POST['schedule_facility']) . ")", array($_POST["id"]));
121 foreach ($_POST["schedule_facility"] as $tqvar) {
122 sqlStatement("replace into users_facility set
123 facility_id = '$tqvar',
125 table_id = {$_POST["id
"]}");
129 if ($_POST["fname"]) {
130 $tqvar = formData('fname', 'P');
131 sqlStatement("update users set fname='$tqvar' where id= ? ", array($_POST["id"]));
134 if (isset($_POST['default_warehouse'])) {
135 sqlStatement("UPDATE users SET default_warehouse = '" .
136 formData('default_warehouse', 'P') .
137 "' WHERE id = '" . formData('id', 'P') . "'");
140 if (isset($_POST['irnpool'])) {
141 sqlStatement("UPDATE users SET irnpool = '" .
142 formData('irnpool', 'P') .
143 "' WHERE id = '" . formData('id', 'P') . "'");
146 if ($_POST["adminPass"] && $_POST["clearPass"]) {
147 require_once("$srcdir/authentication/password_change.php");
148 $clearAdminPass=$_POST['adminPass'];
149 $clearUserPass=$_POST['clearPass'];
150 $password_err_msg="";
151 $success=update_password($_SESSION['authId'], $_POST['id'], $clearAdminPass, $clearUserPass, $password_err_msg);
153 error_log($password_err_msg);
154 $alertmsg.=$password_err_msg;
158 $tqvar = $_POST["authorized"] ?
1 : 0;
159 $actvar = $_POST["active"] ?
1 : 0;
160 $calvar = $_POST["calendar"] ?
1 : 0;
162 sqlStatement("UPDATE users SET authorized = $tqvar, active = $actvar, " .
163 "calendar = $calvar, see_auth = ? WHERE " .
164 "id = ? ", array($_POST['see_auth'], $_POST["id"]));
165 //Display message when Emergency Login user was activated
166 $bg_count=count($_POST['access_group']);
167 for ($i=0; $i<$bg_count; $i++
) {
168 if (($_POST['access_group'][$i] == "Emergency Login") && ($_POST['pre_active'] == 0) && ($actvar == 1)) {
173 if (($_POST['access_group'])) {
174 for ($i=0; $i<$bg_count; $i++
) {
175 if (($_POST['access_group'][$i] == "Emergency Login") && ($_POST['user_type']) == "" && ($_POST['check_acl'] == 1) && ($_POST['active']) != "") {
181 if ($_POST["comments"]) {
182 $tqvar = formData('comments', 'P');
183 sqlStatement("update users set info = '$tqvar' where id = ? ", array($_POST["id"]));
186 $erxrole = formData('erxrole', 'P');
187 sqlStatement("update users set newcrop_user_role = '$erxrole' where id = ? ", array($_POST["id"]));
189 if ($_POST["physician_type"]) {
190 $physician_type = formData('physician_type');
191 sqlStatement("update users set physician_type = '$physician_type' where id = ? ", array($_POST["id"]));
194 if ($_POST["main_menu_role"]) {
195 $mainMenuRole = filter_input(INPUT_POST
, 'main_menu_role');
196 sqlStatement("update `users` set `main_menu_role` = ? where `id` = ? ", array($mainMenuRole, $_POST["id"]));
199 if ($_POST["erxprid"]) {
200 $erxprid = formData('erxprid', 'P');
201 sqlStatement("update users set weno_prov_id = '$erxprid' where id = ? ", array($_POST["id"]));
204 // Set the access control group of user
205 $user_data = sqlFetchArray(sqlStatement("select username from users where id= ?", array($_POST["id"])));
207 $_POST['access_group'],
208 $user_data["username"],
209 formData('fname', 'P'),
210 formData('mname', 'P'),
211 formData('lname', 'P')
216 /* To refresh and save variables in mail frame - Arb*/
217 if (isset($_POST["mode"])) {
218 if ($_POST["mode"] == "new_user") {
219 if ($_POST["authorized"] != "1") {
220 $_POST["authorized"] = 0;
223 // $_POST["info"] = addslashes($_POST["info"]);
225 $calvar = $_POST["calendar"] ?
1 : 0;
227 $res = sqlStatement("select distinct username from users where username != ''");
229 while ($row = sqlFetchArray($res)) {
230 if ($doit == true && $row['username'] == trim(formData('rumple'))) {
236 require_once("$srcdir/authentication/password_change.php");
238 //if password expiration option is enabled, calculate the expiration date of the password
239 if ($GLOBALS['password_expiration_days'] != 0) {
240 $exp_days = $GLOBALS['password_expiration_days'];
241 $exp_date = date('Y-m-d', strtotime("+$exp_days days"));
245 "insert into users set " .
246 "username = '" . trim(formData('rumple')) .
247 "', password = '" . 'NoLongerUsed' .
248 "', fname = '" . trim(formData('fname')) .
249 "', mname = '" . trim(formData('mname')) .
250 "', lname = '" . trim(formData('lname')) .
251 "', federaltaxid = '" . trim(formData('federaltaxid')) .
252 "', state_license_number = '" . trim(formData('state_license_number')) .
253 "', newcrop_user_role = '" . trim(formData('erxrole')) .
254 "', physician_type = '" . trim(formData('physician_type')) .
255 "', main_menu_role = '" . trim(formData('main_menu_role')) .
256 "', weno_prov_id = '" . trim(formData('erxprid')) .
257 "', authorized = '" . trim(formData('authorized')) .
258 "', info = '" . trim(formData('info')) .
259 "', federaldrugid = '" . trim(formData('federaldrugid')) .
260 "', upin = '" . trim(formData('upin')) .
261 "', npi = '" . trim(formData('npi')).
262 "', taxonomy = '" . trim(formData('taxonomy')) .
263 "', facility_id = '" . trim(formData('facility_id')) .
264 "', specialty = '" . trim(formData('specialty')) .
265 "', see_auth = '" . trim(formData('see_auth')) .
266 "', default_warehouse = '" . trim(formData('default_warehouse')) .
267 "', irnpool = '" . trim(formData('irnpool')) .
268 "', calendar = '" . $calvar .
269 "', pwd_expiration_date = '" . trim("$exp_date") .
272 $clearAdminPass=$_POST['adminPass'];
273 $clearUserPass=$_POST['stiltskin'];
274 $password_err_msg="";
276 $success = update_password(
284 trim(formData('rumple')),
287 error_log($password_err_msg);
288 $alertmsg .=$password_err_msg;
290 //set the facility name from the selected facility_id
291 sqlStatement("UPDATE users, facility SET users.facility = facility.name WHERE facility.id = '" . trim(formData('facility_id')) . "' AND users.username = '" . trim(formData('rumple')) . "'");
293 sqlStatement("insert into groups set name = '" . trim(formData('groupname')) .
294 "', user = '" . trim(formData('rumple')) . "'");
296 if (trim(formData('rumple'))) {
297 // Set the access control group of user
299 $_POST['access_group'],
300 trim(formData('rumple')),
301 trim(formData('fname')),
302 trim(formData('mname')),
303 trim(formData('lname'))
308 $alertmsg .= xl('User', '', '', ' ') . trim(formData('rumple')) . xl('already exists.', '', ' ');
311 if ($_POST['access_group']) {
312 $bg_count=count($_POST['access_group']);
313 for ($i=0; $i<$bg_count; $i++
) {
314 if ($_POST['access_group'][$i] == "Emergency Login") {
319 } else if ($_POST["mode"] == "new_group") {
320 $res = sqlStatement("select distinct name, user from groups");
321 for ($iter = 0; $row = sqlFetchArray($res); $iter++
) {
322 $result[$iter] = $row;
326 foreach ($result as $iter) {
327 if ($doit == 1 && $iter{"name"} == trim(formData('groupname')) && $iter{"user"} == trim(formData('rumple'))) {
333 sqlStatement("insert into groups set name = '" . trim(formData('groupname')) .
334 "', user = '" . trim(formData('rumple')) . "'");
336 $alertmsg .= "User " . trim(formData('rumple')) .
337 " is already a member of group " . trim(formData('groupname')) . ". ";
342 if (isset($_GET["mode"])) {
343 /*******************************************************************
344 // This is the code to delete a user. Note that the link which invokes
345 // this is commented out. Somebody must have figured it was too dangerous.
347 if ($_GET["mode"] == "delete") {
348 $res = sqlStatement("select distinct username, id from users where id = '" .
350 for ($iter = 0; $row = sqlFetchArray($res); $iter++)
351 $result[$iter] = $row;
353 // TBD: Before deleting the user, we should check all tables that
354 // reference users to make sure this user is not referenced!
356 foreach($result as $iter) {
357 sqlStatement("delete from groups where user = '" . $iter{"username"} . "'");
359 sqlStatement("delete from users where id = '" . $_GET["id"] . "'");
361 *******************************************************************/
363 if ($_GET["mode"] == "delete_group") {
364 $res = sqlStatement("select distinct user from groups where id = ?", array($_GET["id"]));
365 for ($iter = 0; $row = sqlFetchArray($res); $iter++
) {
366 $result[$iter] = $row;
369 foreach ($result as $iter) {
373 $res = sqlStatement("select name, user from groups where user = '$un' " .
374 "and id != ?", array($_GET["id"]));
376 // Remove the user only if they are also in some other group. I.e. every
377 // user must be a member of at least one group.
378 if (sqlFetchArray($res) != false) {
379 sqlStatement("delete from groups where id = ?", array($_GET["id"]));
381 $alertmsg .= "You must add this user to some other group before " .
382 "removing them from this group. ";
386 // added for form submit's from usergroup_admin_add and user_admin.php
388 if (isset($_REQUEST["mode"])) {
389 exit(trim($alertmsg));
392 $form_inactive = empty($_REQUEST['form_inactive']) ?
false : true;
397 <title
><?php
echo xlt('User / Group');?
></title
>
399 <?php Header
::setupHeader(['common','jquery-ui']); ?
>
401 <script type
="text/javascript">
403 $
(document
).ready(function(){
407 $
(".medium_modal").on('click', function(e
) {
408 e
.preventDefault();e
.stopPropagation();
409 dlgopen('', '', 660, 450, '', '', {
411 url
: $
(this
).attr('href')
417 function authorized_clicked() {
418 var f
= document
.forms
[0];
419 f
.calendar
.disabled
= !f
.authorized
.checked
;
420 f
.calendar
.checked
= f
.authorized
.checked
;
426 <body
class="body_top">
428 <div
class="container">
430 <div
class="col-xs-12">
431 <div
class="page-title">
432 <h2
><?php
echo xlt('User / Groups');?
></h2
>
437 <div
class="col-xs-12">
438 <div
class="btn-group">
439 <a href
="usergroup_admin_add.php" class="medium_modal btn btn-default btn-add"><?php
echo xlt('Add User'); ?
></a
>
440 <a href
="facility_user.php" class="btn btn-default btn-show"><?php
echo xlt('View Facility Specific User Information'); ?
></a
>
442 <form name
='userlist' method
='post' style
="display: inline;" class="form-inline" class="pull-right" action
='usergroup_admin.php' onsubmit
='return top.restoreSession()'>
443 <div
class="checkbox">
444 <label
for="form_inactive">
445 <input type
='checkbox' class="form-control" id
="form_inactive" name
='form_inactive' value
='1' onclick
='submit()' <?php
echo ($form_inactive) ?
'checked ' : ''; ?
>>
446 <?php
echo xlt('Include inactive users'); ?
>
453 <div
class="col-xs-12">
455 if ($set_active_msg == 1) {
456 echo "<div class='alert alert-danger'>".xlt('Emergency Login ACL is chosen. The user is still in active state, please de-activate the user and activate the same when required during emergency situations. Visit Administration->Users for activation or de-activation.')."</div><br>";
459 if ($show_message == 1) {
460 echo "<div class='alert alert-danger'>".xlt('The following Emergency Login User is activated:')." "."<b>".text($_GET['fname'])."</b>"."</div><br>";
461 echo "<div class='alert alert-danger'>".xlt('Emergency Login activation email will be circulated only if following settings in the interface/globals.php file are configured:')." \$GLOBALS['Emergency_Login_email'], \$GLOBALS['Emergency_Login_email_id']</div>";
465 <div
class="table-responsive">
466 <table
class="table table-striped">
469 <th
><?php
echo xlt('Username'); ?
></th
>
470 <th
><?php
echo xlt('Real Name'); ?
></th
>
471 <th
><?php
echo xlt('Additional Info'); ?
></th
>
472 <th
><?php
echo xlt('Authorized'); ?
>?
</th
>
477 $query = "SELECT * FROM users WHERE username != '' ";
478 if (!$form_inactive) {
479 $query .= "AND active = '1' ";
482 $query .= "ORDER BY username";
483 $res = sqlStatement($query);
484 for ($iter = 0; $row = sqlFetchArray($res); $iter++
) {
485 $result4[$iter] = $row;
488 foreach ($result4 as $iter) {
489 if ($iter{"authorized"}) {
490 $iter{"authorized"} = xl('yes');
492 $iter{"authorized"} = "";
496 <td><b><a href='user_admin.php?id=" . attr($iter{"id"}) .
497 "' class='medium_modal' onclick='top.restoreSession()'>" . text($iter{"username"}) . "</a></b>" ." </td>
498 <td>" . text($iter{"fname"}) . ' ' . text($iter{"lname"}) ." </td>
499 <td>" . text($iter{"info"}) . " </td>
500 <td align='left'><span>" .text($iter{"authorized"}) . " </td>";
501 print "<td><!--<a href='usergroup_admin.php?mode=delete&id=" . attr($iter{"id"}) .
502 "' class='link_submit'>[Delete]</a>--></td>";
510 if (empty($GLOBALS['disable_non_default_groups'])) {
511 $res = sqlStatement("select * from groups order by name");
512 for ($iter = 0; $row = sqlFetchArray($res); $iter++
) {
513 $result5[$iter] = $row;
516 foreach ($result5 as $iter) {
517 $grouplist{$iter{"name"}} .= $iter{"user"} .
518 "(<a class='link_submit' href='usergroup_admin.php?mode=delete_group&id=" .
519 attr($iter{"id"}) . "' onclick='top.restoreSession()'>" . xlt('Remove') . "</a>), ";
522 foreach ($grouplist as $groupname => $list) {
523 print "<span class='bold'>" . text($groupname) . "</span><br>\n<span>" .
524 text(substr($list, 0, strlen($list)-2)) . "</span><br>\n";
531 <script language
="JavaScript">
533 if ($alertmsg = trim($alertmsg)) {
534 echo "alert('$alertmsg');\n";