interface/usergroup/usergroup_admin.php

   1 <?php
   2 /**
   3  * This script Assign acl 'Emergency login'.
   4  *
   5  * @package OpenEMR
   6  * @link    http://www.open-emr.org
   7  * @author  Roberto Vasquez <robertogagliotta@gmail.com>
   8  * @author  Brady Miller <brady.g.miller@gmail.com>
   9  * @copyright Copyright (c) 2015 Roberto Vasquez <robertogagliotta@gmail.com>
  10  * @copyright Copyright (c) 2017 Brady Miller <brady.g.miller@gmail.com>
  11  * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  12  */
  13
  14 require_once("../globals.php");
  15 require_once("../../library/acl.inc");
  16 require_once("$srcdir/auth.inc");
  17
  18 use OpenEMR\Core\Header;
  19
  20 if (!acl_check('admin', 'users')) {
  21     die(xlt('Access denied'));
  22 }
  23
  24 $alertmsg = '';
  25 $bg_msg = '';
  26 $set_active_msg=0;
  27 $show_message=0;
  28
  29 /* Sending a mail to the admin when the breakglass user is activated only if $GLOBALS['Emergency_Login_email'] is set to 1 */
  30 $bg_count=count($access_group);
  31 $mail_id = explode(".", $SMTP_HOST);
  32 for ($i=0; $i<$bg_count; $i++) {
  33     if (($_POST['access_group'][$i] == "Emergency Login") && ($_POST['active'] == 'on') && ($_POST['pre_active'] == 0)) {
  34         if (($_POST['get_admin_id'] == 1) && ($_POST['admin_id'] != "")) {
  35             $res = sqlStatement("select username from users where id= ? ", array($_POST["id"]));
  36             $row = sqlFetchArray($res);
  37             $uname=$row['username'];
  38             $mail = new MyMailer();
  39             $mail->From = $GLOBALS["practice_return_email_path"];
  40             $mail->FromName = "Administrator OpenEMR";
  41             $text_body  = "Hello Security Admin,\n\n The Emergency Login user ".$uname.
  42                                               " was activated at ".date('l jS \of F Y h:i:s A')." \n\nThanks,\nAdmin OpenEMR.";
  43             $mail->Body = $text_body;
  44             $mail->Subject = "Emergency Login User Activated";
  45             $mail->AddAddress($_POST['admin_id']);
  46             $mail->Send();
  47         }
  48     }
  49 }
  50
  51 /* To refresh and save variables in mail frame */
  52 if (isset($_POST["privatemode"]) && $_POST["privatemode"] =="user_admin") {
  53     if ($_POST["mode"] == "update") {
  54         if (isset($_POST["username"])) {
  55             // $tqvar = addslashes(trim($_POST["username"]));
  56             $tqvar = trim(formData('username', 'P'));
  57             $user_data = sqlFetchArray(sqlStatement("select * from users where id= ? ", array($_POST["id"])));
  58             sqlStatement("update users set username='$tqvar' where id= ? ", array($_POST["id"]));
  59             sqlStatement("update groups set user='$tqvar' where user= ?", array($user_data["username"]));
  60             //echo "query was: " ."update groups set user='$tqvar' where user='". $user_data["username"]  ."'" ;
  61         }
  62
  63         if ($_POST["taxid"]) {
  64             $tqvar = formData('taxid', 'P');
  65             sqlStatement("update users set federaltaxid='$tqvar' where id= ? ", array($_POST["id"]));
  66         }
  67
  68         if ($_POST["state_license_number"]) {
  69             $tqvar = formData('state_license_number', 'P');
  70             sqlStatement("update users set state_license_number='$tqvar' where id= ? ", array($_POST["id"]));
  71         }
  72
  73         if ($_POST["drugid"]) {
  74             $tqvar = formData('drugid', 'P');
  75             sqlStatement("update users set federaldrugid='$tqvar' where id= ? ", array($_POST["id"]));
  76         }
  77
  78         if ($_POST["upin"]) {
  79             $tqvar = formData('upin', 'P');
  80             sqlStatement("update users set upin='$tqvar' where id= ? ", array($_POST["id"]));
  81         }
  82
  83         if ($_POST["npi"]) {
  84             $tqvar = formData('npi', 'P');
  85             sqlStatement("update users set npi='$tqvar' where id= ? ", array($_POST["id"]));
  86         }
  87
  88         if ($_POST["taxonomy"]) {
  89             $tqvar = formData('taxonomy', 'P');
  90             sqlStatement("update users set taxonomy = '$tqvar' where id= ? ", array($_POST["id"]));
  91         }
  92
  93         if ($_POST["lname"]) {
  94             $tqvar = formData('lname', 'P');
  95             sqlStatement("update users set lname='$tqvar' where id= ? ", array($_POST["id"]));
  96         }
  97
  98         if ($_POST["job"]) {
  99             $tqvar = formData('job', 'P');
 100             sqlStatement("update users set specialty='$tqvar' where id= ? ", array($_POST["id"]));
 101         }
 102
 103         if ($_POST["mname"]) {
 104               $tqvar = formData('mname', 'P');
 105               sqlStatement("update users set mname='$tqvar' where id= ? ", array($_POST["id"]));
 106         }
 107
 108         if ($_POST["facility_id"]) {
 109               $tqvar = formData('facility_id', 'P');
 110               sqlStatement("update users set facility_id = '$tqvar' where id = ? ", array($_POST["id"]));
 111               //(CHEMED) Update facility name when changing the id
 112               sqlStatement("UPDATE users, facility SET users.facility = facility.name WHERE facility.id = '$tqvar' AND users.id = {$_POST["id"]}");
 113               //END (CHEMED)
 114         }
 115
 116         if ($GLOBALS['restrict_user_facility'] && $_POST["schedule_facility"]) {
 117             sqlStatement("delete from users_facility
 118             where tablename='users'
 119             and table_id= ?
 120             and facility_id not in (" . implode(",", $_POST['schedule_facility']) . ")", array($_POST["id"]));
 121             foreach ($_POST["schedule_facility"] as $tqvar) {
 122                 sqlStatement("replace into users_facility set
 123                 facility_id = '$tqvar',
 124                 tablename='users',
 125                 table_id = {$_POST["id"]}");
 126             }
 127         }
 128
 129         if ($_POST["fname"]) {
 130               $tqvar = formData('fname', 'P');
 131               sqlStatement("update users set fname='$tqvar' where id= ? ", array($_POST["id"]));
 132         }
 133
 134         if (isset($_POST['default_warehouse'])) {
 135             sqlStatement("UPDATE users SET default_warehouse = '" .
 136             formData('default_warehouse', 'P') .
 137             "' WHERE id = '" . formData('id', 'P') . "'");
 138         }
 139
 140         if (isset($_POST['irnpool'])) {
 141             sqlStatement("UPDATE users SET irnpool = '" .
 142             formData('irnpool', 'P') .
 143             "' WHERE id = '" . formData('id', 'P') . "'");
 144         }
 145
 146         if ($_POST["adminPass"] && $_POST["clearPass"]) {
 147               require_once("$srcdir/authentication/password_change.php");
 148               $clearAdminPass=$_POST['adminPass'];
 149               $clearUserPass=$_POST['clearPass'];
 150               $password_err_msg="";
 151               $success=update_password($_SESSION['authId'], $_POST['id'], $clearAdminPass, $clearUserPass, $password_err_msg);
 152             if (!$success) {
 153                 error_log($password_err_msg);
 154                 $alertmsg.=$password_err_msg;
 155             }
 156         }
 157
 158         $tqvar  = $_POST["authorized"] ? 1 : 0;
 159         $actvar = $_POST["active"]     ? 1 : 0;
 160         $calvar = $_POST["calendar"]   ? 1 : 0;
 161
 162         sqlStatement("UPDATE users SET authorized = $tqvar, active = $actvar, " .
 163         "calendar = $calvar, see_auth = ? WHERE " .
 164         "id = ? ", array($_POST['see_auth'], $_POST["id"]));
 165       //Display message when Emergency Login user was activated
 166         $bg_count=count($_POST['access_group']);
 167         for ($i=0; $i<$bg_count; $i++) {
 168             if (($_POST['access_group'][$i] == "Emergency Login") && ($_POST['pre_active'] == 0) && ($actvar == 1)) {
 169                 $show_message = 1;
 170             }
 171         }
 172
 173         if (($_POST['access_group'])) {
 174             for ($i=0; $i<$bg_count; $i++) {
 175                 if (($_POST['access_group'][$i] == "Emergency Login") && ($_POST['user_type']) == "" && ($_POST['check_acl'] == 1) && ($_POST['active']) != "") {
 176                     $set_active_msg=1;
 177                 }
 178             }
 179         }
 180
 181         if ($_POST["comments"]) {
 182             $tqvar = formData('comments', 'P');
 183             sqlStatement("update users set info = '$tqvar' where id = ? ", array($_POST["id"]));
 184         }
 185
 186         $erxrole = formData('erxrole', 'P');
 187         sqlStatement("update users set newcrop_user_role = '$erxrole' where id = ? ", array($_POST["id"]));
 188
 189         if ($_POST["physician_type"]) {
 190             $physician_type = formData('physician_type');
 191             sqlStatement("update users set physician_type = '$physician_type' where id = ? ", array($_POST["id"]));
 192         }
 193
 194         if ($_POST["main_menu_role"]) {
 195               $mainMenuRole = filter_input(INPUT_POST, 'main_menu_role');
 196               sqlStatement("update `users` set `main_menu_role` = ? where `id` = ? ", array($mainMenuRole, $_POST["id"]));
 197         }
 198
 199         if ($_POST["erxprid"]) {
 200             $erxprid = formData('erxprid', 'P');
 201             sqlStatement("update users set weno_prov_id = '$erxprid' where id = ? ", array($_POST["id"]));
 202         }
 203
 204         // Set the access control group of user
 205         $user_data = sqlFetchArray(sqlStatement("select username from users where id= ?", array($_POST["id"])));
 206         set_user_aro(
 207             $_POST['access_group'],
 208             $user_data["username"],
 209             formData('fname', 'P'),
 210             formData('mname', 'P'),
 211             formData('lname', 'P')
 212         );
 213     }
 214 }
 215
 216 /* To refresh and save variables in mail frame  - Arb*/
 217 if (isset($_POST["mode"])) {
 218     if ($_POST["mode"] == "new_user") {
 219         if ($_POST["authorized"] != "1") {
 220             $_POST["authorized"] = 0;
 221         }
 222
 223         // $_POST["info"] = addslashes($_POST["info"]);
 224
 225         $calvar = $_POST["calendar"] ? 1 : 0;
 226
 227         $res = sqlStatement("select distinct username from users where username != ''");
 228         $doit = true;
 229         while ($row = sqlFetchArray($res)) {
 230             if ($doit == true && $row['username'] == trim(formData('rumple'))) {
 231                 $doit = false;
 232             }
 233         }
 234
 235         if ($doit == true) {
 236             require_once("$srcdir/authentication/password_change.php");
 237
 238           //if password expiration option is enabled,  calculate the expiration date of the password
 239             if ($GLOBALS['password_expiration_days'] != 0) {
 240                 $exp_days = $GLOBALS['password_expiration_days'];
 241                 $exp_date = date('Y-m-d', strtotime("+$exp_days days"));
 242             }
 243
 244             $insertUserSQL=
 245             "insert into users set " .
 246             "username = '"         . trim(formData('rumple')) .
 247             "', password = '"      . 'NoLongerUsed'                  .
 248             "', fname = '"         . trim(formData('fname')) .
 249             "', mname = '"         . trim(formData('mname')) .
 250             "', lname = '"         . trim(formData('lname')) .
 251             "', federaltaxid = '"  . trim(formData('federaltaxid')) .
 252             "', state_license_number = '"  . trim(formData('state_license_number')) .
 253             "', newcrop_user_role = '"  . trim(formData('erxrole')) .
 254             "', physician_type = '"  . trim(formData('physician_type')) .
 255             "', main_menu_role = '"  . trim(formData('main_menu_role')) .
 256             "', weno_prov_id = '"  . trim(formData('erxprid')) .
 257             "', authorized = '"    . trim(formData('authorized')) .
 258             "', info = '"          . trim(formData('info')) .
 259             "', federaldrugid = '" . trim(formData('federaldrugid')) .
 260             "', upin = '"          . trim(formData('upin')) .
 261             "', npi  = '"          . trim(formData('npi')).
 262             "', taxonomy = '"      . trim(formData('taxonomy')) .
 263             "', facility_id = '"   . trim(formData('facility_id')) .
 264             "', specialty = '"     . trim(formData('specialty')) .
 265             "', see_auth = '"      . trim(formData('see_auth')) .
 266             "', default_warehouse = '" . trim(formData('default_warehouse')) .
 267             "', irnpool = '"       . trim(formData('irnpool')) .
 268             "', calendar = '"      . $calvar                         .
 269             "', pwd_expiration_date = '" . trim("$exp_date") .
 270             "'";
 271
 272             $clearAdminPass=$_POST['adminPass'];
 273             $clearUserPass=$_POST['stiltskin'];
 274             $password_err_msg="";
 275             $prov_id="";
 276             $success = update_password(
 277                 $_SESSION['authId'],
 278                 0,
 279                 $clearAdminPass,
 280                 $clearUserPass,
 281                 $password_err_msg,
 282                 true,
 283                 $insertUserSQL,
 284                 trim(formData('rumple')),
 285                 $prov_id
 286             );
 287             error_log($password_err_msg);
 288             $alertmsg .=$password_err_msg;
 289             if ($success) {
 290                   //set the facility name from the selected facility_id
 291                   sqlStatement("UPDATE users, facility SET users.facility = facility.name WHERE facility.id = '" . trim(formData('facility_id')) . "' AND users.username = '" . trim(formData('rumple')) . "'");
 292
 293                   sqlStatement("insert into groups set name = '" . trim(formData('groupname')) .
 294                     "', user = '" . trim(formData('rumple')) . "'");
 295
 296                 if (trim(formData('rumple'))) {
 297                               // Set the access control group of user
 298                               set_user_aro(
 299                                   $_POST['access_group'],
 300                                   trim(formData('rumple')),
 301                                   trim(formData('fname')),
 302                                   trim(formData('mname')),
 303                                   trim(formData('lname'))
 304                               );
 305                 }
 306             }
 307         } else {
 308             $alertmsg .= xl('User', '', '', ' ') . trim(formData('rumple')) . xl('already exists.', '', ' ');
 309         }
 310
 311         if ($_POST['access_group']) {
 312             $bg_count=count($_POST['access_group']);
 313             for ($i=0; $i<$bg_count; $i++) {
 314                 if ($_POST['access_group'][$i] == "Emergency Login") {
 315                       $set_active_msg=1;
 316                 }
 317             }
 318         }
 319     } else if ($_POST["mode"] == "new_group") {
 320         $res = sqlStatement("select distinct name, user from groups");
 321         for ($iter = 0; $row = sqlFetchArray($res); $iter++) {
 322             $result[$iter] = $row;
 323         }
 324
 325         $doit = 1;
 326         foreach ($result as $iter) {
 327             if ($doit == 1 && $iter{"name"} == trim(formData('groupname')) && $iter{"user"} == trim(formData('rumple'))) {
 328                 $doit--;
 329             }
 330         }
 331
 332         if ($doit == 1) {
 333             sqlStatement("insert into groups set name = '" . trim(formData('groupname')) .
 334             "', user = '" . trim(formData('rumple')) . "'");
 335         } else {
 336             $alertmsg .= "User " . trim(formData('rumple')) .
 337             " is already a member of group " . trim(formData('groupname')) . ". ";
 338         }
 339     }
 340 }
 341
 342 if (isset($_GET["mode"])) {
 343   /*******************************************************************
 344   // This is the code to delete a user.  Note that the link which invokes
 345   // this is commented out.  Somebody must have figured it was too dangerous.
 346   //
 347   if ($_GET["mode"] == "delete") {
 348     $res = sqlStatement("select distinct username, id from users where id = '" .
 349       $_GET["id"] . "'");
 350     for ($iter = 0; $row = sqlFetchArray($res); $iter++)
 351       $result[$iter] = $row;
 352
 353     // TBD: Before deleting the user, we should check all tables that
 354     // reference users to make sure this user is not referenced!
 355
 356     foreach($result as $iter) {
 357       sqlStatement("delete from groups where user = '" . $iter{"username"} . "'");
 358     }
 359     sqlStatement("delete from users where id = '" . $_GET["id"] . "'");
 360   }
 361   *******************************************************************/
 362
 363     if ($_GET["mode"] == "delete_group") {
 364         $res = sqlStatement("select distinct user from groups where id = ?", array($_GET["id"]));
 365         for ($iter = 0; $row = sqlFetchArray($res); $iter++) {
 366             $result[$iter] = $row;
 367         }
 368
 369         foreach ($result as $iter) {
 370             $un = $iter{"user"};
 371         }
 372
 373         $res = sqlStatement("select name, user from groups where user = '$un' " .
 374         "and id != ?", array($_GET["id"]));
 375
 376         // Remove the user only if they are also in some other group.  I.e. every
 377         // user must be a member of at least one group.
 378         if (sqlFetchArray($res) != false) {
 379               sqlStatement("delete from groups where id = ?", array($_GET["id"]));
 380         } else {
 381               $alertmsg .= "You must add this user to some other group before " .
 382                 "removing them from this group. ";
 383         }
 384     }
 385 }
 386 // added for form submit's from usergroup_admin_add and user_admin.php
 387 // sjp 12/29/17
 388 if (isset($_REQUEST["mode"])) {
 389     exit(trim($alertmsg));
 390 }
 391
 392 $form_inactive = empty($_REQUEST['form_inactive']) ? false : true;
 393
 394 ?>
 395 <html>
 396 <head>
 397 <title><?php echo xlt('User / Group');?></title>
 398
 399 <?php Header::setupHeader(['common','jquery-ui']); ?>
 400
 401 <script type="text/javascript">
 402
 403 $(document).ready(function(){
 404
 405     tabbify();
 406
 407     $(".medium_modal").on('click', function(e) {
 408         e.preventDefault();e.stopPropagation();
 409         dlgopen('', '', 660, 450, '', '', {
 410             type: 'iframe',
 411             url: $(this).attr('href')
 412         });
 413     });
 414
 415 });
 416
 417 function authorized_clicked() {
 418  var f = document.forms[0];
 419  f.calendar.disabled = !f.authorized.checked;
 420  f.calendar.checked  =  f.authorized.checked;
 421 }
 422
 423 </script>
 424
 425 </head>
 426 <body class="body_top">
 427
 428 <div class="container">
 429     <div class="row">
 430         <div class="col-xs-12">
 431             <div class="page-title">
 432                 <h2><?php echo xlt('User / Groups');?></h2>
 433             </div>
 434         </div>
 435     </div>
 436     <div class="row">
 437         <div class="col-xs-12">
 438             <div class="btn-group">
 439                 <a href="usergroup_admin_add.php" class="medium_modal btn btn-default btn-add"><?php echo xlt('Add User'); ?></a>
 440                 <a href="facility_user.php" class="btn btn-default btn-show"><?php echo xlt('View Facility Specific User Information'); ?></a>
 441             </div>
 442             <form name='userlist' method='post' style="display: inline;" class="form-inline" class="pull-right" action='usergroup_admin.php' onsubmit='return top.restoreSession()'>
 443                 <div class="checkbox">
 444                     <label for="form_inactive">
 445                         <input type='checkbox' class="form-control" id="form_inactive" name='form_inactive' value='1' onclick='submit()' <?php echo ($form_inactive) ? 'checked ' : ''; ?>>
 446                         <?php echo xlt('Include inactive users'); ?>
 447                     </label>
 448                 </div>
 449             </form>
 450         </div>
 451     </div>
 452     <div class="row">
 453         <div class="col-xs-12">
 454             <?php
 455             if ($set_active_msg == 1) {
 456                 echo "<div class='alert alert-danger'>".xlt('Emergency Login ACL is chosen. The user is still in active state, please de-activate the user and activate the same when required during emergency situations. Visit Administration->Users for activation or de-activation.')."</div><br>";
 457             }
 458
 459             if ($show_message == 1) {
 460                 echo "<div class='alert alert-danger'>".xlt('The following Emergency Login User is activated:')." "."<b>".text($_GET['fname'])."</b>"."</div><br>";
 461                 echo "<div class='alert alert-danger'>".xlt('Emergency Login activation email will be circulated only if following settings in the interface/globals.php file are configured:')." \$GLOBALS['Emergency_Login_email'], \$GLOBALS['Emergency_Login_email_id']</div>";
 462             }
 463
 464             ?>
 465             <div class="table-responsive">
 466                 <table class="table table-striped">
 467                     <thead>
 468                     <tr>
 469                         <th><?php echo xlt('Username'); ?></th>
 470                         <th><?php echo xlt('Real Name'); ?></th>
 471                         <th><?php echo xlt('Additional Info'); ?></th>
 472                         <th><?php echo xlt('Authorized'); ?>?</th>
 473                         <th></th>
 474                     </tr>
 475                     <tbody>
 476                         <?php
 477                         $query = "SELECT * FROM users WHERE username != '' ";
 478                         if (!$form_inactive) {
 479                             $query .= "AND active = '1' ";
 480                         }
 481
 482                         $query .= "ORDER BY username";
 483                         $res = sqlStatement($query);
 484                         for ($iter = 0; $row = sqlFetchArray($res); $iter++) {
 485                             $result4[$iter] = $row;
 486                         }
 487
 488                         foreach ($result4 as $iter) {
 489                             if ($iter{"authorized"}) {
 490                                 $iter{"authorized"} = xl('yes');
 491                             } else {
 492                                 $iter{"authorized"} = "";
 493                             }
 494
 495                             print "<tr>
 496                                 <td><b><a href='user_admin.php?id=" . attr($iter{"id"}) .
 497                                 "' class='medium_modal' onclick='top.restoreSession()'>" . text($iter{"username"}) . "</a></b>" ."&nbsp;</td>
 498                                 <td>" . text($iter{"fname"}) . ' ' . text($iter{"lname"}) ."&nbsp;</td>
 499                                 <td>" . text($iter{"info"}) . "&nbsp;</td>
 500                                 <td align='left'><span>" .text($iter{"authorized"}) . "&nbsp;</td>";
 501                             print "<td><!--<a href='usergroup_admin.php?mode=delete&id=" . attr($iter{"id"}) .
 502                                 "' class='link_submit'>[Delete]</a>--></td>";
 503                             print "</tr>\n";
 504                         }
 505                         ?>
 506                     </tbody>
 507                 </table>
 508             </div>
 509             <?php
 510             if (empty($GLOBALS['disable_non_default_groups'])) {
 511                 $res = sqlStatement("select * from groups order by name");
 512                 for ($iter = 0; $row = sqlFetchArray($res); $iter++) {
 513                     $result5[$iter] = $row;
 514                 }
 515
 516                 foreach ($result5 as $iter) {
 517                     $grouplist{$iter{"name"}} .= $iter{"user"} .
 518                         "(<a class='link_submit' href='usergroup_admin.php?mode=delete_group&id=" .
 519                         attr($iter{"id"}) . "' onclick='top.restoreSession()'>" . xlt('Remove') . "</a>), ";
 520                 }
 521
 522                 foreach ($grouplist as $groupname => $list) {
 523                     print "<span class='bold'>" . text($groupname) . "</span><br>\n<span>" .
 524                         text(substr($list, 0, strlen($list)-2)) . "</span><br>\n";
 525                 }
 526             }
 527             ?>
 528         </div>
 529     </div>
 530 </div>
 531 <script language="JavaScript">
 532 <?php
 533 if ($alertmsg = trim($alertmsg)) {
 534     echo "alert('$alertmsg');\n";
 535 }
 536 ?>
 537 </script>
 538 </body>
 539 </html>