From abb63c293f3e560be2cc20769740a754e9e261cb Mon Sep 17 00:00:00 2001 From: stephan Date: Wed, 1 Jul 2026 13:48:43 -0400 Subject: [PATCH] Enhance session management and access control for super admins This commit introduces improvements to session management by implementing a new check for super admin sessions, allowing them to bypass certain access restrictions. It updates the logout function to retain super admin session data and modifies event access functions to grant permissions based on super admin status. Additionally, the session timeout duration is adjusted for better alignment with site requirements. The version code is updated to reflect these changes. --- compte.php | 3 +- php/inc_fx_compte.php | 33 +++++++++++++++------- php/inc_fx_eve_acces.php | 37 +++++++++++++++++++++---- php/inc_fx_inscriptions_gestion.php | 8 ++++++ php/inc_start_time.php | 6 +++- superadm/php/inc_fx_eve_acces_admin.php | 10 ++++--- superadm/php/inc_start_time.php | 29 ++++++++++++++----- 7 files changed, 97 insertions(+), 29 deletions(-) diff --git a/compte.php b/compte.php index 2085c56..7bc9a46 100644 --- a/compte.php +++ b/compte.php @@ -344,7 +344,8 @@ if (isset($_GET['promoteur_eve_id'])) { header('Location: ' . $vDomaine . '/' . $strPage); exit; } - } elseif (!fxIsPromoteur($_SESSION['com_id'], $intEveIdbase) + } elseif (empty($_SESSION['usa_id']) + && !fxIsPromoteur($_SESSION['com_id'], $intEveIdbase) && !fxEveAccesComHasV2ForEvent($_SESSION['com_id'], $intEveIdbase)) { header('Location: ' . $vDomaine . '/' . $strPage); exit; diff --git a/php/inc_fx_compte.php b/php/inc_fx_compte.php index ac7e192..ecf9988 100644 --- a/php/inc_fx_compte.php +++ b/php/inc_fx_compte.php @@ -1292,32 +1292,45 @@ function fxLogout($strLangue = 'fr') { global $vDomaine; + $tabSuperAdmin = array(); + if (!empty($_SESSION['usa_id'])) { + $tabSuperAdmin = array( + 'usa_id' => $_SESSION['usa_id'], + 'usa_info' => $_SESSION['usa_info'] ?? null, + 'logged' => $_SESSION['logged'] ?? time(), + ); + } + unset($_SESSION['com_id']); unset($_SESSION['com_info']); unset($_SESSION['com_prenom']); - //unset($_SESSION['logged']); unset($_SESSION['vadmin_texte']); unset($_SESSION['url_retour']); unset($_SESSION['msg_erreur']); unset($_SESSION['promoteur_eve_id']); unset($_SESSION['epr_id_bib']); unset($_SESSION['com_affilie']); - // - $_SESSION = []; // Vide toutes les variables de session -// Optionnel : détruit la session complètement (ID, fichier, etc.) - session_destroy(); + $strNoPanier = $_SESSION['no_panier'] ?? null; + + $_SESSION = array(); $_SESSION['date_maj'] = time(); - // session_unset(); - // session_destroy(); + foreach ($tabSuperAdmin as $strKey => $mixValue) { + if ($mixValue !== null) { + $_SESSION[$strKey] = $mixValue; + } + } - if ($strLangue == 'fr') + if ($strLangue == 'fr') { $strPage = 'compte'; - else + } else { $strPage = 'account'; + } - fxViderPanier($_SESSION['no_panier'], 1); + if ($strNoPanier !== null && $strNoPanier !== '') { + fxViderPanier($strNoPanier, 1); + } if (!empty($_GET['redirect']) && $_GET['redirect'] === 'mobile') { $strTarget = $vDomaine . ($strLangue === 'en' ? '/mobile/en' : '/mobile'); diff --git a/php/inc_fx_eve_acces.php b/php/inc_fx_eve_acces.php index 0bea0a8..e30e5a8 100644 --- a/php/inc_fx_eve_acces.php +++ b/php/inc_fx_eve_acces.php @@ -9,14 +9,13 @@ function fxEveAccesIsEnabled() { static $blnEnabled = null; - if ($blnEnabled !== null) { - return $blnEnabled; - } - global $objDatabase; if (!isset($objDatabase)) { - $blnEnabled = false; + return false; + } + + if ($blnEnabled !== null) { return $blnEnabled; } @@ -26,6 +25,12 @@ function fxEveAccesIsEnabled() return $blnEnabled; } +/** Super admin connecte (canal usa_id) — bypass total des droits v2 sur le site promoteur. */ +function fxEveAccesIsSuperAdminSession() +{ + return !empty($_SESSION['usa_id']); +} + /** * Corps SELECT des acces actifs (remplace l'ancienne vue v_eve_acces_actif). * Pas de vue stockee : evite le DEFINER non copiable par Navicat / releve. @@ -164,6 +169,10 @@ function fxEveAccesGetEventIds($intComId) /** Acces web gestion inscriptions : vue API/page OU au moins une permission action inscriptions_gestion.* */ function fxEveAccesHasInscrGestionWebAccess($intComId, $intEveId) { + if (fxEveAccesIsSuperAdminSession()) { + return true; + } + if (fxEveAccesComEventHasGrantsAllKit(intval($intComId), intval($intEveId))) { return true; } @@ -294,6 +303,10 @@ function fxEveAccesComEventHasGrantsAllKit($intComId, $intEveId) function fxEveAccesHasPermission($intComId, $intEveId, $strPermKey) { + if (fxEveAccesIsSuperAdminSession()) { + return true; + } + global $objDatabase; if (!fxEveAccesIsEnabled()) { @@ -315,6 +328,10 @@ function fxEveAccesHasPermission($intComId, $intEveId, $strPermKey) function fxEveAccesHasAnyPermission($intComId, $intEveId, $arrPermKeys) { + if (fxEveAccesIsSuperAdminSession()) { + return true; + } + global $objDatabase; if (!fxEveAccesIsEnabled() || empty($arrPermKeys)) { @@ -374,9 +391,13 @@ function fxEveAccesGetEventIdsWithAnyPermission($intComId, $arrPermKeys) return $arrIds; } -/** Outil debug QR — permission v2 tools.qr_test uniquement (pas de bypass super admin). */ +/** Outil debug QR — super admin : acces libre ; promoteur : permission v2 tools.qr_test. */ function fxEveAccesCanQrTest($intComId) { + if (fxEveAccesIsSuperAdminSession()) { + return true; + } + if (!fxEveAccesIsEnabled() || intval($intComId) <= 0) { return false; } @@ -544,6 +565,10 @@ function fxEveAccesResolveEveIdFromParId($intParId) */ function fxEveAccesAssertPromoteurAction($intComId, $intEveId, $strPermKey) { + if (fxEveAccesIsSuperAdminSession()) { + return true; + } + $intComId = intval($intComId); $intEveId = intval($intEveId); diff --git a/php/inc_fx_inscriptions_gestion.php b/php/inc_fx_inscriptions_gestion.php index 89820a7..d648ba7 100644 --- a/php/inc_fx_inscriptions_gestion.php +++ b/php/inc_fx_inscriptions_gestion.php @@ -97,11 +97,19 @@ function fxInscrGestionGetPromoteurEveIds($intComId) { } function fxInscrGestionCanAccess($intComId, $intEveId) { + if (!empty($_SESSION['usa_id'])) { + return true; + } + fxInscrGestionLoadEveAcces(); return fxEveAccesHasInscrGestionWebAccess(intval($intComId), intval($intEveId)); } function fxInscrGestionCanScan($intComId, $intEveId) { + if (!empty($_SESSION['usa_id'])) { + return true; + } + fxInscrGestionLoadEveAcces(); return fxEveAccesHasAnyPermission(intval($intComId), intval($intEveId), fxInscrGestionPermKeysScan()); } diff --git a/php/inc_start_time.php b/php/inc_start_time.php index 2767180..dd68f71 100644 --- a/php/inc_start_time.php +++ b/php/inc_start_time.php @@ -44,4 +44,8 @@ if (isset($_SESSION['date_maj']) && (time() - $_SESSION['date_maj'] > $inactive) /* if (!isset($_SESSION['no_panier']) && isset($_COOKIE['no_panier'])) $_SESSION['no_panier'] = $_COOKIE['no_panier']; */ -$_SESSION['date_maj'] = time(); \ No newline at end of file +$_SESSION['date_maj'] = time(); + +if (!empty($_SESSION['usa_id'])) { + $_SESSION['logged'] = time(); +} \ No newline at end of file diff --git a/superadm/php/inc_fx_eve_acces_admin.php b/superadm/php/inc_fx_eve_acces_admin.php index fc1ccb2..3b80570 100644 --- a/superadm/php/inc_fx_eve_acces_admin.php +++ b/superadm/php/inc_fx_eve_acces_admin.php @@ -230,7 +230,7 @@ function fxEveAccesAdminGetRoleAssignments($intRoleId, $strStatut = null) } $sql = "SELECT ea.ea_id, ea.com_id, ea.eve_id, ea.ea_statut, ea.ea_created_at, ea.ea_revoked_at, - c.com_nom, c.com_prenom, c.com_courriel, + c.com_nom, c.com_prenom, c.com_courriel, c.com_lastvisit, e.eve_nom_fr, e.eve_date_fin FROM inscriptions_eve_acces ea INNER JOIN inscriptions_comptes c ON c.com_id = ea.com_id @@ -314,14 +314,15 @@ function fxEveAccesAdminRenderRoleAssignmentsBlock($intRoleId, $arrOpts = array( Compte Événement Statut - Depuis + Assigné le + Dernière connexion Aucune assignation.'; + echo 'Aucune assignation.'; } else { foreach ($arrRows as $arrAssign) { $strCompte = trim($arrAssign['com_prenom'] . ' ' . $arrAssign['com_nom']); @@ -348,7 +349,8 @@ function fxEveAccesAdminRenderRoleAssignmentsBlock($intRoleId, $arrOpts = array( - + + Fiche compte diff --git a/superadm/php/inc_start_time.php b/superadm/php/inc_start_time.php index 1fc8369..bb75891 100644 --- a/superadm/php/inc_start_time.php +++ b/superadm/php/inc_start_time.php @@ -1,11 +1,26 @@ $inactive) - header('Location: logout.php'); - -$_SESSION['logged'] = time(); \ No newline at end of file +if (!empty($_SESSION['usa_id'])) { + $intLastActivity = intval($_SESSION['logged'] ?? 0); + if (!empty($_SESSION['date_maj'])) { + $intLastActivity = max($intLastActivity, intval($_SESSION['date_maj'])); + } + + if ($intLastActivity <= 0) { + $_SESSION['logged'] = time(); + } elseif ((time() - $intLastActivity) > $inactive) { + header('Location: logout.php'); + exit; + } + + $_SESSION['logged'] = time(); +} elseif (!empty($_SESSION['logged']) && (time() - intval($_SESSION['logged'])) > $inactive) { + header('Location: logout.php'); + exit; +} elseif (!empty($_SESSION['logged'])) { + $_SESSION['logged'] = time(); +}