stephan/ms1inscription-v5
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enhance event access control and integrate new permission checks

Browse Source 
This commit introduces the `fxEveAccesCanManageBibV4` and `fxEveAccesCanQrTest` functions to improve event access management. It updates various files to utilize these new permission checks, ensuring that only authorized users can manage event registrations and access QR testing features. Additionally, redundant session checks are removed, and redirection logic is refined for better user experience across the application.
This commit is contained in:
stephan
2026-06-19 12:49:19 -04:00
parent d5fdb227dd
commit e9ad3d8a92
7 changed files with 188 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
compte.php
View File

@ -22,6 +22,7 @@ require_once('superadm/php/inc_fx_excell.php');
require_once('php/inc_fx_liste_attente.php');
require_once('php/inc_fx_inscriptions_mobile.php');
require_once('php/inc_fx_eve_acces.php');
global $objDatabase, $vPage, $vDomaine;
// vérifier les paramètres
@ -314,6 +315,11 @@ if (isset($_GET['promoteur_eve_id'])) {
header('Location: ' . $vDomaine . '/' . $strPage);
exit;
}
} elseif ($strCode === 'compte_inc_tableau_gestion_epreuves') {
if (!fxEveAccesCanManageBibV4($_SESSION['com_id'] ?? 0, $intEveIdbase)) {
header('Location: ' . $vDomaine . '/' . $strPage);
exit;
}
} elseif (!fxIsPromoteur($_SESSION['com_id'], $intEveIdbase)) {
header('Location: ' . $vDomaine . '/' . $strPage);
exit;
@ -471,7 +477,7 @@ require_once("inc_header.php");
break;
case 'compte_accueil':
//MSIN-4371
if (isset($_SESSION['usa_id'])) { ?>
if (fxEveAccesCanQrTest($_SESSION['com_id'])) { ?>
<a href="qr_test.php" target="_blank" class="btn btn-primary">
QR Test

31
inc_tableau_gestion_epreuves.php
View File

@ -1,22 +1,14 @@
<?php
// MSIN-4379 — Gestion quantités + dossards v4 (rollout superadm, fxShowBibTool4 seulement)
// MSIN-4379 — Gestion quantités + dossards v4 (droits v2 ou super admin)
include_once("php/inc_fx_modifierinscriptions.php");
include_once("php/inc_fx_memberships.php");
include_once("php/inc_fx_promoteur.php");
require_once('php/inc_fx_eve_acces.php');
require_once('superadm/php/inc_manager.php');
global $objDatabase, $vDomaine, $strLangue;
if (!isset($_SESSION['usa_id'])) {
$strRedirect = $vDomaine . '/compte/inc_tableau_promoteur';
if (!empty($_GET['promoteur_eve_id'])) {
$strRedirect .= '?promoteur_eve_id=' . urlencode($_GET['promoteur_eve_id']);
}
header('Location: ' . $strRedirect);
exit;
}
$intEveId = 0;
if ($strLangue == 'fr') {
@ -36,6 +28,15 @@ if (isset($_GET['promoteur_eve_id'])) {
$intEveId = base64_decode(urldecode($_GET['promoteur_eve_id']));
}
if ($intEveId <= 0 || (empty($_SESSION['com_id']) && empty($_SESSION['usa_id'])) || !fxEveAccesCanManageBibV4($_SESSION['com_id'] ?? 0, $intEveId)) {
$strRedirect = $vDomaine . '/compte/inc_tableau_promoteur';
if (!empty($_GET['promoteur_eve_id'])) {
$strRedirect .= '?promoteur_eve_id=' . urlencode($_GET['promoteur_eve_id']);
}
header('Location: ' . $strRedirect);
exit;
}
$strBackUrl = fxGetPromoteurBackUrl($intEveId, $strPage);
?>
<a class="btn btn-primary rounded-pill" id="link_back" href="<?php echo $strBackUrl; ?>">
@ -56,8 +57,7 @@ if (isset($_POST['btn_cancel_event_promo'])) {
fxAnnulerRetablirInscription($tabEpreuve, $int_pec_id);
}
if ($intEveId != 0) {
?>
?>
<?php
@ -72,10 +72,3 @@ if ($intEveId != 0) {
<?php afficheTexte('promoteur_back'); ?>
</a>
<?php
} else {
if ($strLangue == 'fr') {
echo "Une erreur quelconque est survenue.";
} else {
echo "A generic error occurred.";
}
}

3
inc_tableau_promoteur.php
View File

@ -4,6 +4,7 @@
include_once("php/inc_fx_modifierinscriptions.php");
include_once("php/inc_fx_memberships.php");
include_once("php/inc_fx_promoteur.php");
require_once('php/inc_fx_eve_acces.php');
require_once('superadm/php/inc_manager.php');
global $objDatabase, $vDomaine, $strLangue;
@ -233,7 +234,7 @@ if ($intEveId != 0) {
</li><?php
}
if (isset($_SESSION['usa_id'])) {
if (fxEveAccesCanManageBibV4($_SESSION['com_id'] ?? 0, $intEveId)) {
?>
<li class="nav-item">
<a class="nav-list"

37
php/inc_fx_eve_acces.php
View File

@ -171,6 +171,43 @@ function fxEveAccesGetEventIdsWithAnyPermission($intComId, $arrPermKeys)
return $arrIds;
}
function fxEveAccesIsSuperAdminSession()
{
return !empty($_SESSION['usa_id']);
}
/** Permissions gestion bib v4 (quantites + dossards). */
function fxEveAccesBibV4PermKeys()
{
return array('dossards.manage', 'epreuves.edit_qte');
}
function fxEveAccesCanManageBibV4($intComId, $intEveId)
{
if (fxEveAccesIsSuperAdminSession()) {
return true;
}
return fxEveAccesHasAnyPermission(intval($intComId), intval($intEveId), fxEveAccesBibV4PermKeys());
}
/** Outil debug QR — acces v2 actif avec tools.qr_test (pas de bypass super admin). */
function fxEveAccesCanQrTest($intComId)
{
if (!fxEveAccesIsEnabled() || intval($intComId) <= 0) {
return false;
}
global $objDatabase;
$sql = "SELECT COUNT(*) FROM v_eve_acces_permissions
WHERE com_id = " . intval($intComId) . "
AND perm_key = 'tools.qr_test'";
$intNb = $objDatabase->fxGetVar($sql);
return ($intNb != null && intval($intNb) > 0);
}
function fxEveAccesGrant($intComId, $intEveId, $intRoleId, $intExpireDays, $intGrantedBy, $strNote = '')
{
global $objDatabase;

36
php/inc_fx_promoteur.php
View File

@ -2724,7 +2724,27 @@ function fxBibRequirePromoteurSession() {
return !empty($_SESSION['com_id']) || !empty($_SESSION['usa_id']);
}
/** Gate AJAX bib v4 — session + CSRF (même règle que toggle_lock / save_auto_config). */
/** Resout eve_id depuis la requete AJAX bib (eve_id direct ou via epr_id). */
function fxBibResolveEveIdFromRequest() {
global $objDatabase;
if (!empty($_REQUEST['eve_id'])) {
return intval($_REQUEST['eve_id']);
}
$intEprId = intval($_REQUEST['epr_id'] ?? 0);
if ($intEprId <= 0) {
return 0;
}
$intEveId = intval($objDatabase->fxGetVar(
'SELECT eve_id FROM inscriptions_epreuves WHERE epr_id = ' . $intEprId . ' LIMIT 1'
));
return ($intEveId > 0) ? $intEveId : 0;
}
/** Gate AJAX bib v4 — session, droits v2 par evenement (usa_id = bypass), CSRF. */
function fxBibRequireAjaxAccess() {
if (!fxBibRequirePromoteurSession()) {
echo json_encode([
@ -2734,6 +2754,20 @@ function fxBibRequireAjaxAccess() {
exit;
}
if (empty($_SESSION['usa_id'])) {
require_once __DIR__ . '/inc_fx_eve_acces.php';
$intComId = intval($_SESSION['com_id'] ?? 0);
$intEveId = fxBibResolveEveIdFromRequest();
if ($intComId <= 0 || $intEveId <= 0 || !fxEveAccesCanManageBibV4($intComId, $intEveId)) {
echo json_encode([
'success' => false,
'message' => fxBibMsg('bib_v4_ajax_unauthorized'),
]);
exit;
}
}
$strToken = $_POST['csrf_token'] ?? $_REQUEST['csrf_token'] ?? '';
if (!fxBibValidateCsrf($strToken)) {
echo json_encode([

13
qr_test.php
View File

@ -6,6 +6,19 @@ require_once('php/inc_fonctions.php');
ini_set('display_errors',1);
error_reporting(E_ALL);
require_once('php/inc_fx_panier.php');
require_once('php/inc_fx_eve_acces.php');
if (empty($_SESSION['com_id'])) {
header('Location: /compte');
exit;
}
if (!fxEveAccesCanQrTest($_SESSION['com_id'])) {
header('HTTP/1.1 403 Forbidden');
echo 'Acces refuse';
exit;
}
ini_set('display_errors',1);
error_reporting(E_ALL);
global $objDatabase;

82
sql/MSIN-eve-acces-v2-bib-qr-seed.sql Normal file
View File

@ -0,0 +1,82 @@
/*
MSIN - Acces evenement v2 - Bib v4 + QR test debug
Executer APRES MSIN-eve-acces-v2-phase1-seed.sql
*/
SET NAMES utf8mb4;
INSERT INTO `inscriptions_eve_permissions`
(`perm_key`, `perm_group`, `perm_label_fr`, `perm_label_en`, `perm_description_fr`, `perm_description_en`, `perm_phase`, `perm_actif`, `perm_tri`)
VALUES
('tools.qr_test', 'tools', 'Outil test QR', 'QR test tool',
'Page debug scanner QR (qr_test.php)', NULL, 2, 1, 810)
ON DUPLICATE KEY UPDATE
`perm_group` = VALUES(`perm_group`),
`perm_label_fr` = VALUES(`perm_label_fr`),
`perm_label_en` = VALUES(`perm_label_en`),
`perm_description_fr` = VALUES(`perm_description_fr`),
`perm_description_en` = VALUES(`perm_description_en`),
`perm_phase` = VALUES(`perm_phase`),
`perm_actif` = VALUES(`perm_actif`),
`perm_tri` = VALUES(`perm_tri`);
INSERT INTO `inscriptions_eve_roles`
(`role_code`, `role_label_fr`, `role_label_en`, `role_description_fr`, `role_description_en`, `role_icone`, `role_systeme`, `role_actif`, `role_tri`)
VALUES
('bib_ops', 'Gestion dossards', 'Bib management',
'Quantites epreuves et gestion dossards v4',
'Race quantities and bib management v4',
'fa-hashtag', 1, 1, 35),
('qr_debug', 'Debug QR', 'QR debug',
'Outil interne test scanner QR',
'Internal QR scanner test tool',
'fa-qrcode', 1, 1, 36)
ON DUPLICATE KEY UPDATE
`role_label_fr` = VALUES(`role_label_fr`),
`role_label_en` = VALUES(`role_label_en`),
`role_description_fr` = VALUES(`role_description_fr`),
`role_description_en` = VALUES(`role_description_en`),
`role_icone` = VALUES(`role_icone`),
`role_systeme` = VALUES(`role_systeme`),
`role_actif` = VALUES(`role_actif`),
`role_tri` = VALUES(`role_tri`);
DELETE erp FROM inscriptions_eve_role_permissions erp
INNER JOIN inscriptions_eve_roles r ON r.role_id = erp.role_id
WHERE r.role_code = 'owner';
INSERT INTO inscriptions_eve_role_permissions (role_id, perm_key)
SELECT r.role_id, p.perm_key
FROM inscriptions_eve_roles r
CROSS JOIN inscriptions_eve_permissions p
WHERE r.role_code = 'owner'
AND p.perm_actif = 1;
DELETE erp FROM inscriptions_eve_role_permissions erp
INNER JOIN inscriptions_eve_roles r ON r.role_id = erp.role_id
WHERE r.role_code = 'bib_ops';
INSERT INTO inscriptions_eve_role_permissions (role_id, perm_key)
SELECT r.role_id, p.perm_key
FROM inscriptions_eve_roles r
INNER JOIN inscriptions_eve_permissions p
ON p.perm_key IN ('dossards.view', 'dossards.manage', 'epreuves.view', 'epreuves.edit_qte')
AND p.perm_actif = 1
WHERE r.role_code = 'bib_ops';
DELETE erp FROM inscriptions_eve_role_permissions erp
INNER JOIN inscriptions_eve_roles r ON r.role_id = erp.role_id
WHERE r.role_code = 'qr_debug';
INSERT INTO inscriptions_eve_role_permissions (role_id, perm_key)
SELECT r.role_id, p.perm_key
FROM inscriptions_eve_roles r
INNER JOIN inscriptions_eve_permissions p
ON p.perm_key IN ('tools.qr_test')
AND p.perm_actif = 1
WHERE r.role_code = 'qr_debug';