From e300de73feb1178367ce74feb88fce3447c577ec Mon Sep 17 00:00:00 2001 From: bradymiller Date: Sat, 7 Feb 2009 11:04:13 +0000 Subject: [PATCH] php-GACL embedding continued. --- INSTALL | 45 ++++++++++++++++++++++++++------------------- setup.php | 58 +++++++++++++++++++++++++++++++++++++++++++++------------- 2 files changed, 71 insertions(+), 32 deletions(-) diff --git a/INSTALL b/INSTALL index 5055e9d2f..e4390bb31 100644 --- a/INSTALL +++ b/INSTALL @@ -54,7 +54,7 @@ enabled on your system. These include: - PHP Index support (ensure that index.php is in your Index path in httpd.conf) - Session variables -- PHP libcurl support (optional for operation, mandatory for billing +- PHP libcurl support (optional for operation, mandatory for billing) Copy the OpenEMR folder into the root folder of the webserver. On Mandrake Linux, for example, use the command: @@ -64,7 +64,8 @@ Linux, for example, use the command: Make sure the webserver is running, and point a web-browser to setup.php located within the openemr web folder. If you installed OpenEMR in the root web directory, the URL would read: http://localhost/openemr/setup.php. -The setup script will step you through the configuration of the database. +The setup script will step you through the configuration of the OpenEMR +and embedded php-GACL databases. In step 1, you need to tell setup whether it needs to create the databases on its own, or if they you have already created them. MySQL root priveleges will @@ -107,21 +108,25 @@ The "Initial Group" is the first group that will be created. A user may belong to multiple groups, which again, can be altered on the user administration page. It is suggested that no more than one group per office be used. -Step 3 is where setup will install the database and connect to it to create the -initial tables. If no errors occur, you will see a "Continue" button at the -bottom. Before clicking this, you need to ensure that the webserver user -(often "nobody", "apache", or "www-data") has write privileges on the -library/sqlconf.php file. The command "chmod a+w library/sqlconf.php" will -grant global write permissions to the file. Be sure to set them back to -something more secure (such as chmod 644) before actively using OpenEMR. - -Should anything fail during step 3, you may have to remove the existing database -or tables before you can try again. - -Step 4 is the writing of SQL configuration to disk and the -installation/configuration of the phpGACL access controls. Should it display -errors related to file writing priviledges you may click the back button to -try again (after fixing file permission). +Step 3 is where setup will install the OpenEMR database and connect to it to +create the initial tables. Should anything fail during step 3, you may have +to remove the existing database or tables before you can try again. If no errors +occur, you will see a "Continue" button at the bottom. Before clicking this, +you need to ensure that the webserver user (often "nobody", "apache", or +"www-data") has write privileges on the openemr/library/sqlconf.php, +openemr/gacl/gacl.ini.php and openemr/gacl/gacl.class.php files and the +openemr/gacl/admin/templates_c directory. The command +"chmod a+w library/sqlconf.php" will grant global write permissions +to the file. Be sure to set them back to something more secure (such as +chmod 644) before actively using OpenEMR. + +Step 4 will initially check to ensure the proper writing priviledges in the +files and directory mentioned above in step 3. Should it display +errors related to file writing priviledges you may click the 'Check Again' +button to try again (after fixing file permission). After the file +priviledges are confirmed, it will then write setting to the SQL +configuration file, and then install and configure the embedded phpGACL +access controls. Once setup is completed, one last thing must be done before OpenEMR can be used. The file openemr/interface/globals.php must be edited by hand to reflect the @@ -161,8 +166,10 @@ and custom/faxcover.txt; it also requires the following utilities: IV. Setting Up Access Control -Since OpenEMR version 2.9.0.3, phpGACL access control software is installed -and configured automatically during OpenEMR setup. This is very powerful +Since OpenEMR version 2.9.0.3, phpGACL access control software has been +embedded in OpenEMR, and these access controls are installed and +configured automatically during OpenEMR setup. It can be administered +within OpenEMR in the admin->acl menu. This is very powerful access control software. To learn more about phpGACL (see http://phpgacl.sourceforge.net/), recommend reading the phpGACL manual, the /openemr/Documentation/README.phpgacl file, and the online wiki at diff --git a/setup.php b/setup.php index 76ba611bb..86e06f12c 100644 --- a/setup.php +++ b/setup.php @@ -61,6 +61,8 @@ include_once($conffile); (If either subdirectory doesn't exist, create it first then do the chown above).
The user name and group of apache may differ depending on your OS, i.e. for Debian they are www-data and www-data. +
  • Please restore secure permissions on the configuration files: /openemr/library/sqlconf.php,
    + /openemr/gacl/gacl.ini.php, and /openemr/gacl/gacl.class.php files.

    • In order to take full advantage of the documents capability you @@ -74,6 +76,10 @@ include_once($conffile); "/tmp" won't work on your system.

    +Access controls (php-GACL) are installed for fine-grained security, +and can be administered in OpenEMR's admin->acl menu. +

    +

    There's much information and many extra tools bundled within the OpenEMR installation directory. Please refer to openemr/Documentation.
    Many forms and other useful scripts can be found at openemr/contrib. @@ -88,7 +94,7 @@ using Firefox is recommended.

    -The initial OpenEMR user is "admin" and the password is "pass". +The initial OpenEMR user is "" and the password is "pass". You should change this password!

    @@ -318,8 +324,13 @@ if ($upgrade != 1) { fclose($fd);*/ flush(); } -echo "\n
    Please make sure 'library/sqlconf.php' is world-writeable for the next step.
    \n"; - +echo "\n
    Next step will ensure the following files or directories are world-writeable:
    \n"; +foreach ($writableFileList as $tempFile) { + echo " 'openemr/$tempFile' file
    "; +} +foreach ($writableDirList as $tempDir) { + echo " 'openemr/$tempDir' directory
    "; +} echo "

    \n @@ -339,33 +350,54 @@ break; case 4: echo "Step $state

    \n"; -echo "Writing SQL Configuration to disk and configuring access controls (php-GACL)...

    "; +echo "Checking to ensure files are ready...
    "; //ensure required files and directories are writable before moving on $errorWritable = 0; foreach ($writableFileList as $tempFile) { - if (!(is_writable($tempFile))) { - echo "ERROR. Could not open config file '$tempFile' for writing.
    "; - echo "(ensure '$tempFile' is world-writeable, then go back in browser and try again).

    "; + if (is_writable($tempFile)) { + echo "'openemr/$tempFile' file is ready.
    "; + } + else { + echo "
    UNABLE to open configuration file 'openemr/$tempFile' for writing.
    "; + echo "(ensure 'openemr/$tempFile' file is world-writeable)

    "; flush(); $errorWritable = 1; } } foreach ($writableDirList as $tempDir) { - if (!(is_writable($tempDir))) { - echo "ERROR. Could not open directory '$tempDir' for writing.
    "; - echo "(ensure '$tempDir' is world-writeable, then go back in browser and try again).

    "; + if (is_writable($tempDir)) { + echo "'openemr/$tempDir' directory is ready.
    "; + } + else { + echo "
    UNABLE to open directory 'openemr/$tempDir' for writing.
    "; + echo "(ensure 'openemr/$tempDir' directory is world-writeable)

    "; flush(); $errorWritable = 1; } } if ($errorWritable) { + echo "You can't proceed until all files are ready.
    "; + echo "Fix above file permissions and then click the 'Check Again' button to re-check files.
    "; + flush(); + echo " + \n + + + + + + + + +
    \n +

    \n"; break; } //passed all file tests, now can write sql configuration and configure php-GACL - +echo "
    Files are all ready, now writing SQL Configuration to disk and configuring access controls (php-GACL)...

    "; echo "Writing SQL Configuration...
    "; @touch($conffile); // php bug $fd = @fopen($conffile, 'w'); @@ -416,8 +448,7 @@ if ($it_died != 0) { } fclose($fd); -echo "Successfully wrote SQL configuration.
    "; -echo "PLEASE restore secure permissions on the 'library/sqlconf.php' file.


    "; +echo "Successfully wrote SQL configuration.

    "; echo "Installing and Configuring Access Controls (php-GACL)
    "; @@ -508,6 +539,7 @@ echo "Gave the '$iuser' user (password is 'pass') administrator access.
    "; echo "
    \n \n +\n
    \n

    \n"; -- 2.11.4.GIT