interface/usergroup/user_admin.php

   1 <?php
   2 /**
   3  * Edit user.
   4  *
   5  * @package   OpenEMR
   6  * @link      http://www.open-emr.org
   7  * @author    Brady Miller <brady.g.miller@gmail.com>
   8  * @copyright Copyright (c) 2018 Brady Miller <brady.g.miller@gmail.com>
   9  * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  10  */
  11
  12
  13 require_once("../globals.php");
  14 require_once("../../library/acl.inc");
  15 require_once("$srcdir/calendar.inc");
  16 require_once("$srcdir/options.inc.php");
  17 require_once("$srcdir/erx_javascript.inc.php");
  18
  19 use OpenEMR\Core\Header;
  20 use OpenEMR\Menu\MainMenuRole;
  21 use OpenEMR\Menu\PatientMenuRole;
  22 use OpenEMR\Services\FacilityService;
  23
  24 if (!empty($_GET)) {
  25     if (!verifyCsrfToken($_GET["csrf_token_form"])) {
  26         csrfNotVerified();
  27     }
  28 }
  29
  30 $facilityService = new FacilityService();
  31
  32 if (!$_GET["id"] || !acl_check('admin', 'users')) {
  33     exit();
  34 }
  35
  36 $res = sqlStatement("select * from users where id=?", array($_GET["id"]));
  37 for ($iter = 0; $row = sqlFetchArray($res); $iter++) {
  38                 $result[$iter] = $row;
  39 }
  40
  41 $iter = $result[0];
  42
  43 ?>
  44
  45 <html>
  46 <head>
  47
  48 <?php Header::setupHeader(['common','opener']); ?>
  49
  50 <script src="checkpwd_validation.js" type="text/javascript"></script>
  51
  52 <!-- validation library -->
  53 <!--//Not lbf forms use the new validation, please make sure you have the corresponding values in the list Page validation-->
  54 <?php    $use_validate_js = 1;?>
  55 <?php  require_once($GLOBALS['srcdir'] . "/validation/validation_script.js.php"); ?>
  56 <?php
  57 //Gets validation rules from Page Validation list.
  58 //Note that for technical reasons, we are bypassing the standard validateUsingPageRules() call.
  59 $collectthis = collectValidationPageRules("/interface/usergroup/user_admin.php");
  60 if (empty($collectthis)) {
  61     $collectthis = "undefined";
  62 } else {
  63     $collectthis = json_sanitize($collectthis["user_form"]["rules"]);
  64 }
  65 ?>
  66
  67 <script language="JavaScript">
  68
  69 /*
  70  * validation on the form with new client side validation (using validate.js).
  71  * this enable to add new rules for this form in the pageValidation list.
  72  * */
  73 var collectvalidation = <?php echo $collectthis; ?>;
  74
  75     function checkChange()
  76 {
  77   alert(<?php echo xlj('If you change e-RX Role for ePrescription, it may affect the ePrescription workflow. If you face any difficulty, contact your ePrescription vendor.'); ?>);
  78 }
  79 function submitform() {
  80
  81     var valid = submitme(1, undefined, 'user_form', collectvalidation);
  82     if (!valid) return;
  83
  84     top.restoreSession();
  85     var flag=0;
  86     <?php if (!$GLOBALS['use_active_directory']) { ?>
  87     if(document.forms[0].clearPass.value!="")
  88     {
  89         //Checking for the strong password if the 'secure password' feature is enabled
  90         if(document.forms[0].secure_pwd.value === 1)
  91         {
  92                     var pwdresult = passwordvalidate(document.forms[0].clearPass.value);
  93                     if(pwdresult == 0) {
  94                             flag=1;
  95                             alert(<?php echo xlj('The password must be at least eight characters, and should'); ?> +
  96                             '\n' +
  97                             <?php echo xlj('contain at least three of the four following items:'); ?> +
  98                             '\n' +
  99                             <?php echo xlj('A number'); ?> +
 100                             '\n' +
 101                             <?php echo xlj('A lowercase letter'); ?> +
 102                             '\n' +
 103                             <?php echo xlj('An uppercase letter'); ?> +
 104                             '\n' +
 105                             <?php echo xlj('A special character'); ?> +
 106                             '\n' +
 107                             '(' +
 108                             <?php echo xlj('not a letter or number'); ?> +
 109                             ').' +
 110                             '\n' +
 111                             <?php echo xlj('For example:'); ?> +
 112                             ' healthCare@09');
 113                             return false;
 114                     }
 115         }
 116
 117     }//If pwd null ends here
 118     <?php } ?>
 119     //Request to reset the user password if the user was deactived once the password expired.
 120     if((document.forms[0].pwd_expires.value != 0) && (document.forms[0].clearPass.value == "")) {
 121         if((document.forms[0].user_type.value != "Emergency Login") && (document.forms[0].pre_active.value == 0) && (document.forms[0].active.checked == 1) && (document.forms[0].grace_time.value != "") && (document.forms[0].current_date.value) > (document.forms[0].grace_time.value))
 122         {
 123             flag=1;
 124             document.getElementById('error_message').innerHTML=<?php echo xlj('Please reset the password.') ?>;
 125         }
 126     }
 127
 128   if (document.forms[0].access_group_id) {
 129     var sel = getSelected(document.forms[0].access_group_id.options);
 130     for (var item in sel) {
 131       if (sel[item].value == "Emergency Login") {
 132         document.forms[0].check_acl.value = 1;
 133       }
 134     }
 135   }
 136
 137         <?php if ($GLOBALS['erx_enable']) { ?>
 138     alertMsg='';
 139     f=document.forms[0];
 140     for(i=0;i<f.length;i++){
 141       if(f[i].type=='text' && f[i].value)
 142       {
 143         if(f[i].name == 'fname' || f[i].name == 'mname' || f[i].name == 'lname')
 144         {
 145           alertMsg += checkLength(f[i].name,f[i].value,35);
 146           alertMsg += checkUsername(f[i].name,f[i].value);
 147         }
 148         else if(f[i].name == 'taxid')
 149         {
 150           alertMsg += checkLength(f[i].name,f[i].value,10);
 151           alertMsg += checkFederalEin(f[i].name,f[i].value);
 152         }
 153         else if(f[i].name == 'state_license_number')
 154         {
 155           alertMsg += checkLength(f[i].name,f[i].value,10);
 156           alertMsg += checkStateLicenseNumber(f[i].name,f[i].value);
 157         }
 158         else if(f[i].name == 'npi')
 159         {
 160           alertMsg += checkLength(f[i].name,f[i].value,10);
 161           alertMsg += checkTaxNpiDea(f[i].name,f[i].value);
 162         }
 163         else if(f[i].name == 'drugid')
 164         {
 165           alertMsg += checkLength(f[i].name,f[i].value,30);
 166           alertMsg += checkAlphaNumeric(f[i].name,f[i].value);
 167         }
 168       }
 169     }
 170     if(alertMsg)
 171     {
 172       alert(alertMsg);
 173       return false;
 174     }
 175     <?php } ?>
 176
 177     if (flag === 0) {
 178         let post_url = $("#user_form").attr("action");
 179         let request_method = $("#user_form").attr("method");
 180         let form_data = $("#user_form").serialize();
 181         // submit form
 182         $.ajax({
 183             url: post_url,
 184             type: request_method,
 185             data: form_data
 186         }).done(function (r) {
 187             if (r) {
 188                 alert(r);
 189             } else {
 190                 dlgclose('reload', false);
 191             }
 192         });
 193         return false;
 194     }
 195 }
 196 //Getting the list of selected item in ACL
 197 function getSelected(opt) {
 198          var selected = new Array();
 199             var index = 0;
 200             for (var intLoop = 0; intLoop < opt.length; intLoop++) {
 201                if ((opt[intLoop].selected) ||
 202                    (opt[intLoop].checked)) {
 203                   index = selected.length;
 204                   selected[index] = new Object;
 205                   selected[index].value = opt[intLoop].value;
 206                   selected[index].index = intLoop;
 207                }
 208             }
 209             return selected;
 210          }
 211
 212 function authorized_clicked() {
 213  var f = document.forms[0];
 214  f.calendar.disabled = !f.authorized.checked;
 215  f.calendar.checked  =  f.authorized.checked;
 216 }
 217
 218 </script>
 219 <style type="text/css">
 220   .physician_type_class{
 221     width: 150px !important;
 222   }
 223   #main_menu_role {
 224     width: 120px !important;
 225   }
 226 </style>
 227 </head>
 228 <body class="body_top">
 229
 230 <div class="container">
 231     <?php
 232     /*  Get the list ACL for the user */
 233     $is_super_user = acl_check('admin', 'super');
 234     $acl_name=acl_get_group_titles($iter["username"]);
 235     $bg_name='';
 236     $bg_count=count($acl_name);
 237     $selected_user_is_superuser = false;
 238     for ($i=0; $i<$bg_count; $i++) {
 239         if ($acl_name[$i] == "Emergency Login") {
 240             $bg_name=$acl_name[$i];
 241         }
 242         //check if user member on group with superuser rule
 243         if (is_group_include_superuser($acl_name[$i])) {
 244             $selected_user_is_superuser = true;
 245         }
 246     }
 247     $disabled_save = !$is_super_user && $selected_user_is_superuser ? 'disabled' : '';
 248     ?>
 249 <table><tr><td>
 250 <span class="title"><?php echo xlt('Edit User'); ?></span>&nbsp;
 251 </td><td>
 252     <a class="btn btn-default btn-save" name='form_save' id='form_save' href='#' onclick='return submitform()' <?php echo $disabled_save; ?>> <span><?php echo xlt('Save');?></span> </a>
 253     <a class="btn btn-link btn-cancel" id='cancel' href='#'><span><?php echo xlt('Cancel');?></span></a>
 254 </td></tr>
 255 </table>
 256 <br>
 257 <FORM NAME="user_form" id="user_form" METHOD="POST" ACTION="usergroup_admin.php">
 258 <input type="hidden" name="csrf_token_form" value="<?php echo attr(collectCsrfToken()); ?>" />
 259
 260 <input type=hidden name="pwd_expires" value="<?php echo attr($GLOBALS['password_expiration_days']); ?>" >
 261 <input type=hidden name="pre_active" value="<?php echo attr($iter["active"]); ?>" >
 262 <input type=hidden name="exp_date" value="<?php echo attr($iter["pwd_expiration_date"]); ?>" >
 263 <input type=hidden name="get_admin_id" value="<?php echo attr($GLOBALS['Emergency_Login_email']); ?>" >
 264 <input type=hidden name="admin_id" value="<?php echo attr($GLOBALS['Emergency_Login_email_id']); ?>" >
 265 <input type=hidden name="check_acl" value="">
 266 <?php
 267 //Calculating the grace time
 268 $current_date = date("Y-m-d");
 269 $password_exp=$iter["pwd_expiration_date"];
 270 if ($password_exp != "0000-00-00") {
 271     $grace_time1 = date("Y-m-d", strtotime($password_exp . "+".$GLOBALS['password_grace_time'] ."days"));
 272 }
 273 ?>
 274 <input type=hidden name="current_date" value="<?php echo attr(strtotime($current_date)); ?>" >
 275 <input type=hidden name="grace_time" value="<?php echo attr(strtotime($grace_time1)); ?>" >
 276 <input type=hidden name="user_type" value="<?php echo attr($bg_name); ?>" >
 277
 278 <TABLE border=0 cellpadding=0 cellspacing=0>
 279 <TR>
 280     <TD style="width:180px;"><span class=text><?php echo xlt('Username'); ?>: </span></TD>
 281     <TD style="width:270px;"><input type=entry name=username style="width:150px;" class="form-control" value="<?php echo attr($iter["username"]); ?>" disabled></td>
 282     <?php if (!$GLOBALS['use_active_directory']) { ?>
 283         <TD style="width:200px;"><span class=text>*<?php echo xlt('Your Password'); ?>*: </span></TD>
 284         <TD class='text' style="width:280px;"><input type='password' name=adminPass style="width:150px;"  class="form-control" value="" autocomplete='off'><font class="mandatory"></font></TD>
 285     <?php } ?>
 286 </TR>
 287     <?php if (!$GLOBALS['use_active_directory']) { ?>
 288 <TR>
 289     <TD style="width:180px;"><span class=text></span></TD>
 290     <TD style="width:270px;"></td>
 291     <TD style="width:200px;"><span class=text><?php echo xlt('User\'s New Password'); ?>: </span></TD>
 292     <TD class='text' style="width:280px;">    <input type=text name=clearPass style="width:150px;"  class="form-control" value=""><font class="mandatory"></font></td>
 293 </TR>
 294     <?php } ?>
 295
 296 <TR height="30" style="valign:middle;">
 297   <td class='text'>
 298     <?php echo xlt('Clear 2FA'); ?>:
 299   </td>
 300   <td title='<?php echo xla('Remove multi-factor authentications for this person.'); ?>'>
 301     <input type="checkbox" name="clear_2fa" value='1' />
 302   </td>
 303 <td colspan="2"><span class=text><?php echo xlt('Provider'); ?>:
 304  <input type="checkbox" name="authorized" onclick="authorized_clicked()"<?php
 305     if ($iter["authorized"]) {
 306         echo " checked";
 307     } ?> />
 308  &nbsp;&nbsp;<span class='text'><?php echo xlt('Calendar'); ?>:
 309  <input type="checkbox" name="calendar"<?php
 310     if ($iter["calendar"]) {
 311         echo " checked";
 312     }
 313
 314     if (!$iter["authorized"]) {
 315         echo " disabled";
 316     } ?> />
 317  &nbsp;&nbsp;<span class='text'><?php echo xlt('Active'); ?>:
 318  <input type="checkbox" name="active"<?php echo ($iter["active"]) ? " checked" : ""; ?>/>
 319 </TD>
 320 </TR>
 321
 322 <TR>
 323 <TD><span class=text><?php echo xlt('First Name'); ?>: </span></TD>
 324 <TD><input type=entry name=fname id=fname style="width:150px;" class="form-control" value="<?php echo attr($iter["fname"]); ?>"><span class="mandatory"></span></td>
 325 <td><span class=text><?php echo xlt('Middle Name'); ?>: </span></TD><td><input type=entry name=mname style="width:150px;"  value="<?php echo attr($iter["mname"]); ?>"></td>
 326 </TR>
 327
 328 <TR>
 329 <td><span class=text><?php echo xlt('Last Name'); ?>: </span></td><td><input type=entry name=lname id=lname style="width:150px;"  class="form-control" value="<?php echo attr($iter["lname"]); ?>"><span class="mandatory"></span></td>
 330 <td><span class=text><?php echo xlt('Default Facility'); ?>: </span></td><td><select name=facility_id style="width:150px;" class="form-control">
 331 <?php
 332 $fres = $facilityService->getAllBillingLocations();
 333 if ($fres) {
 334     for ($iter2 = 0; $iter2 < sizeof($fres); $iter2++) {
 335                 $result[$iter2] = $fres[$iter2];
 336     }
 337
 338     foreach ($result as $iter2) {
 339         ?>
 340           <option value="<?php echo attr($iter2['id']); ?>" <?php if ($iter['facility_id'] == $iter2['id']) {
 341                 echo "selected";
 342 } ?>><?php echo text($iter2['name']); ?></option>
 343 <?php
 344     }
 345 }
 346 ?>
 347 </select></td>
 348 </tr>
 349
 350 <?php if ($GLOBALS['restrict_user_facility']) { ?>
 351 <tr>
 352  <td colspan=2>&nbsp;</td>
 353  <td><span class=text><?php echo xlt('Schedule Facilities:');?></td>
 354  <td>
 355   <select name="schedule_facility[]" multiple style="width:150px;" class="form-control">
 356 <?php
 357   $userFacilities = getUserFacilities($_GET['id']);
 358   $ufid = array();
 359 foreach ($userFacilities as $uf) {
 360     $ufid[] = $uf['id'];
 361 }
 362
 363   $fres = $facilityService->getAllServiceLocations();
 364 if ($fres) {
 365     foreach ($fres as $frow) :
 366 ?>
 367    <option <?php echo in_array($frow['id'], $ufid) || $frow['id'] == $iter['facility_id'] ? "selected" : null ?>
 368            class="form-control" value="<?php echo attr($frow['id']); ?>"><?php echo text($frow['name']) ?></option>
 369 <?php
 370     endforeach;
 371 }
 372 ?>
 373   </select>
 374  </td>
 375 </tr>
 376 <?php } ?>
 377
 378 <TR>
 379 <TD><span class=text><?php echo xlt('Federal Tax ID'); ?>: </span></TD><TD><input type=text name=taxid style="width:150px;"  class="form-control" value="<?php echo attr($iter["federaltaxid"]); ?>"></td>
 380 <TD><span class=text><?php echo xlt('DEA Number'); ?>: </span></TD><TD><input type=text name=drugid style="width:150px;"  class="form-control" value="<?php echo attr($iter["federaldrugid"]); ?>"></td>
 381 </TR>
 382
 383 <tr>
 384 <td><span class="text"><?php echo xlt('UPIN'); ?>: </span></td><td><input type="text" name="upin" style="width:150px;" class="form-control" value="<?php echo attr($iter["upin"]); ?>"></td>
 385 <td class='text'><?php echo xlt('See Authorizations'); ?>: </td>
 386 <td><select name="see_auth" style="width:150px;" class="form-control" >
 387 <?php
 388 foreach (array(1 => xl('None'), 2 => xl('Only Mine'), 3 => xl('All')) as $key => $value) {
 389     echo " <option value='" . attr($key) . "'";
 390     if ($key == $iter['see_auth']) {
 391         echo " selected";
 392     }
 393
 394     echo ">" . text($value) . "</option>\n";
 395 }
 396 ?>
 397 </select></td>
 398 </tr>
 399
 400 <tr>
 401 <td><span class="text"><?php echo xlt('NPI'); ?>: </span></td><td><input type="text" name="npi" style="width:150px;" class="form-control" value="<?php echo attr($iter["npi"]); ?>"></td>
 402 <td><span class="text"><?php echo xlt('Job Description'); ?>: </span></td><td><input type="text" name="job" style="width:150px;" class="form-control" value="<?php echo attr($iter["specialty"]); ?>"></td>
 403 </tr>
 404
 405 <tr>
 406 <td><span class="text"><?php echo xlt('Taxonomy'); ?>: </span></td>
 407 <td><input type="text" name="taxonomy" style="width:150px;" class="form-control" value="<?php echo attr($iter["taxonomy"]); ?>"></td>
 408 <td>&nbsp;</td><td>&nbsp;</td></tr>
 409
 410 <tr>
 411 <td><span class="text"><?php echo xlt('State License Number'); ?>: </span></td>
 412 <td><input type="text" name="state_license_number" style="width:150px;" class="form-control" value="<?php echo attr($iter["state_license_number"]); ?>"></td>
 413 <td class='text'><?php echo xlt('NewCrop eRX Role'); ?>:</td>
 414 <td>
 415     <?php echo generate_select_list("erxrole", "newcrop_erx_role", $iter['newcrop_user_role'], '', xl('Select Role'), '', '', '', array('style'=>'width:150px')); ?>
 416 </td>
 417 </tr>
 418 <tr>
 419 <td><span class="text"><?php echo xlt('Weno Provider ID'); ?>: </span></td><td><input type="text" name="erxprid" style="width:150px;" class="form-control" value="<?php echo attr($iter["weno_prov_id"]); ?>"></td>
 420 </tr>
 421
 422 <tr>
 423   <td><span class="text"><?php echo xlt('Provider Type'); ?>: </span></td>
 424   <td><?php echo generate_select_list("physician_type", "physician_type", $iter['physician_type'], '', xl('Select Type'), 'physician_type_class', '', '', ''); ?></td>
 425 </tr>
 426 <tr>
 427   <td>
 428     <span class="text"><?php echo xlt('Main Menu Role'); ?>: </span>
 429   </td>
 430   <td>
 431     <?php
 432     $menuMain = new MainMenuRole();
 433     echo $menuMain->displayMenuRoleSelector($iter["main_menu_role"]);
 434     ?>
 435   </td>
 436   <td>
 437     <span class="text"><?php echo xlt('Patient Menu Role'); ?>: </span>
 438   </td>
 439   <td>
 440     <?php
 441     $menuPatient = new PatientMenuRole();
 442     echo $menuPatient->displayMenuRoleSelector($iter["patient_menu_role"]);
 443     ?>
 444   </td>
 445
 446
 447 </tr>
 448 <?php if ($GLOBALS['inhouse_pharmacy']) { ?>
 449 <tr>
 450  <td class="text"><?php echo xlt('Default Warehouse'); ?>: </td>
 451  <td class='text'>
 452 <?php
 453 echo generate_select_list(
 454     'default_warehouse',
 455     'warehouse',
 456     $iter['default_warehouse'],
 457     ''
 458 );
 459 ?>
 460  </td>
 461  <td class="text"><?php echo xlt('Invoice Refno Pool'); ?>: </td>
 462  <td class='text'>
 463 <?php
 464 echo generate_select_list(
 465     'irnpool',
 466     'irnpool',
 467     $iter['irnpool'],
 468     xl('Invoice reference number pool, if used')
 469 );
 470 ?>
 471  </td>
 472 </tr>
 473 <?php } ?>
 474
 475  <tr>
 476 <td class='text'><?php echo xlt('Access Control'); ?>:</td>
 477  <td><select id="access_group_id" name="access_group[]" multiple style="width:150px;" class="form-control">
 478 <?php
 479 // Collect the access control group of user
 480 $list_acl_groups = acl_get_group_title_list($is_super_user || $selected_user_is_superuser);
 481 $username_acl_groups = acl_get_group_titles($iter["username"]);
 482 foreach ($list_acl_groups as $value) {
 483     if (($username_acl_groups) && in_array($value, $username_acl_groups)) {
 484         // Modified 6-2009 by BM - Translate group name if applicable
 485         echo " <option value='" . attr($value) . "' selected>" . text(xl_gacl_group($value)) . "</option>\n";
 486     } else {
 487         // Modified 6-2009 by BM - Translate group name if applicable
 488         echo " <option value='" . attr($value) . "'>" . text(xl_gacl_group($value)) . "</option>\n";
 489     }
 490 }
 491     ?>
 492   </select></td>
 493   <td><span class=text><?php echo xlt('Additional Info'); ?>:</span></td>
 494   <td><textarea style="width:150px;" name="comments" wrap=auto rows=4 cols=25 class="form-control"><?php echo text($iter["info"]); ?></textarea></td>
 495
 496   </tr>
 497   <tr height="20" valign="bottom">
 498   <td colspan="4" class="text">
 499       <p>*<?php echo xlt('You must enter your own password to change user passwords. Leave blank to keep password unchanged.'); ?></p>
 500     <?php
 501     if (!$is_super_user && $selected_user_is_superuser) {
 502         echo '<p class="redtext">*' . xlt('View mode - only administrator can edit another administrator user') . '.</p>';
 503     }
 504     ?>
 505 <!--
 506 Display red alert if entered password matched one of last three passwords/Display red alert if user password was expired and the user was inactivated previously
 507 -->
 508   <div class="redtext" id="error_message">&nbsp;</div>
 509   </td>
 510   </tr>
 511
 512 </table>
 513
 514 <INPUT TYPE="HIDDEN" NAME="id" VALUE="<?php echo attr($_GET["id"]); ?>">
 515 <INPUT TYPE="HIDDEN" NAME="mode" VALUE="update">
 516 <INPUT TYPE="HIDDEN" NAME="privatemode" VALUE="user_admin">
 517
 518 <INPUT TYPE="HIDDEN" NAME="secure_pwd" VALUE="<?php echo attr($GLOBALS['secure_password']); ?>">
 519 </FORM>
 520 <script language="JavaScript">
 521 $(function(){
 522     $("#cancel").click(function() {
 523           dlgclose();
 524      });
 525
 526 });
 527 </script>
 528
 529 <div class="container">
 530
 531 </BODY>
 532
 533 </HTML>