From e9ad3d8a9285eb7c98da1dd735bd52d40a4d86c8 Mon Sep 17 00:00:00 2001 From: stephan Date: Fri, 19 Jun 2026 12:49:19 -0400 Subject: [PATCH] Enhance event access control and integrate new permission checks This commit introduces the `fxEveAccesCanManageBibV4` and `fxEveAccesCanQrTest` functions to improve event access management. It updates various files to utilize these new permission checks, ensuring that only authorized users can manage event registrations and access QR testing features. Additionally, redundant session checks are removed, and redirection logic is refined for better user experience across the application. --- compte.php | 8 ++- inc_tableau_gestion_epreuves.php | 31 ++++------ inc_tableau_promoteur.php | 3 +- php/inc_fx_eve_acces.php | 37 ++++++++++++ php/inc_fx_promoteur.php | 36 +++++++++++- qr_test.php | 13 +++++ sql/MSIN-eve-acces-v2-bib-qr-seed.sql | 82 +++++++++++++++++++++++++++ 7 files changed, 188 insertions(+), 22 deletions(-) create mode 100644 sql/MSIN-eve-acces-v2-bib-qr-seed.sql diff --git a/compte.php b/compte.php index d13dbb1..5ccfbb1 100644 --- a/compte.php +++ b/compte.php @@ -22,6 +22,7 @@ require_once('superadm/php/inc_fx_excell.php'); require_once('php/inc_fx_liste_attente.php'); require_once('php/inc_fx_inscriptions_mobile.php'); +require_once('php/inc_fx_eve_acces.php'); global $objDatabase, $vPage, $vDomaine; // vérifier les paramètres @@ -314,6 +315,11 @@ if (isset($_GET['promoteur_eve_id'])) { header('Location: ' . $vDomaine . '/' . $strPage); exit; } + } elseif ($strCode === 'compte_inc_tableau_gestion_epreuves') { + if (!fxEveAccesCanManageBibV4($_SESSION['com_id'] ?? 0, $intEveIdbase)) { + header('Location: ' . $vDomaine . '/' . $strPage); + exit; + } } elseif (!fxIsPromoteur($_SESSION['com_id'], $intEveIdbase)) { header('Location: ' . $vDomaine . '/' . $strPage); exit; @@ -471,7 +477,7 @@ require_once("inc_header.php"); break; case 'compte_accueil': //MSIN-4371 - if (isset($_SESSION['usa_id'])) { ?> + if (fxEveAccesCanQrTest($_SESSION['com_id'])) { ?> QR Test diff --git a/inc_tableau_gestion_epreuves.php b/inc_tableau_gestion_epreuves.php index 8dcda63..da2ce48 100644 --- a/inc_tableau_gestion_epreuves.php +++ b/inc_tableau_gestion_epreuves.php @@ -1,22 +1,14 @@ @@ -56,8 +57,7 @@ if (isset($_POST['btn_cancel_event_promo'])) { fxAnnulerRetablirInscription($tabEpreuve, $int_pec_id); } -if ($intEveId != 0) { - ?> +?>
  • fxGetVar($sql); + + return ($intNb != null && intval($intNb) > 0); +} + function fxEveAccesGrant($intComId, $intEveId, $intRoleId, $intExpireDays, $intGrantedBy, $strNote = '') { global $objDatabase; diff --git a/php/inc_fx_promoteur.php b/php/inc_fx_promoteur.php index 5c18a94..68392fd 100644 --- a/php/inc_fx_promoteur.php +++ b/php/inc_fx_promoteur.php @@ -2724,7 +2724,27 @@ function fxBibRequirePromoteurSession() { return !empty($_SESSION['com_id']) || !empty($_SESSION['usa_id']); } -/** Gate AJAX bib v4 — session + CSRF (même règle que toggle_lock / save_auto_config). */ +/** Resout eve_id depuis la requete AJAX bib (eve_id direct ou via epr_id). */ +function fxBibResolveEveIdFromRequest() { + global $objDatabase; + + if (!empty($_REQUEST['eve_id'])) { + return intval($_REQUEST['eve_id']); + } + + $intEprId = intval($_REQUEST['epr_id'] ?? 0); + if ($intEprId <= 0) { + return 0; + } + + $intEveId = intval($objDatabase->fxGetVar( + 'SELECT eve_id FROM inscriptions_epreuves WHERE epr_id = ' . $intEprId . ' LIMIT 1' + )); + + return ($intEveId > 0) ? $intEveId : 0; +} + +/** Gate AJAX bib v4 — session, droits v2 par evenement (usa_id = bypass), CSRF. */ function fxBibRequireAjaxAccess() { if (!fxBibRequirePromoteurSession()) { echo json_encode([ @@ -2734,6 +2754,20 @@ function fxBibRequireAjaxAccess() { exit; } + if (empty($_SESSION['usa_id'])) { + require_once __DIR__ . '/inc_fx_eve_acces.php'; + $intComId = intval($_SESSION['com_id'] ?? 0); + $intEveId = fxBibResolveEveIdFromRequest(); + + if ($intComId <= 0 || $intEveId <= 0 || !fxEveAccesCanManageBibV4($intComId, $intEveId)) { + echo json_encode([ + 'success' => false, + 'message' => fxBibMsg('bib_v4_ajax_unauthorized'), + ]); + exit; + } + } + $strToken = $_POST['csrf_token'] ?? $_REQUEST['csrf_token'] ?? ''; if (!fxBibValidateCsrf($strToken)) { echo json_encode([ diff --git a/qr_test.php b/qr_test.php index 787e342..6cd05c5 100644 --- a/qr_test.php +++ b/qr_test.php @@ -6,6 +6,19 @@ require_once('php/inc_fonctions.php'); ini_set('display_errors',1); error_reporting(E_ALL); require_once('php/inc_fx_panier.php'); +require_once('php/inc_fx_eve_acces.php'); + +if (empty($_SESSION['com_id'])) { + header('Location: /compte'); + exit; +} + +if (!fxEveAccesCanQrTest($_SESSION['com_id'])) { + header('HTTP/1.1 403 Forbidden'); + echo 'Acces refuse'; + exit; +} + ini_set('display_errors',1); error_reporting(E_ALL); global $objDatabase; diff --git a/sql/MSIN-eve-acces-v2-bib-qr-seed.sql b/sql/MSIN-eve-acces-v2-bib-qr-seed.sql new file mode 100644 index 0000000..be1af99 --- /dev/null +++ b/sql/MSIN-eve-acces-v2-bib-qr-seed.sql @@ -0,0 +1,82 @@ +/* + MSIN - Acces evenement v2 - Bib v4 + QR test debug + Executer APRES MSIN-eve-acces-v2-phase1-seed.sql +*/ + +SET NAMES utf8mb4; + + +INSERT INTO `inscriptions_eve_permissions` + (`perm_key`, `perm_group`, `perm_label_fr`, `perm_label_en`, `perm_description_fr`, `perm_description_en`, `perm_phase`, `perm_actif`, `perm_tri`) +VALUES + ('tools.qr_test', 'tools', 'Outil test QR', 'QR test tool', + 'Page debug scanner QR (qr_test.php)', NULL, 2, 1, 810) +ON DUPLICATE KEY UPDATE + `perm_group` = VALUES(`perm_group`), + `perm_label_fr` = VALUES(`perm_label_fr`), + `perm_label_en` = VALUES(`perm_label_en`), + `perm_description_fr` = VALUES(`perm_description_fr`), + `perm_description_en` = VALUES(`perm_description_en`), + `perm_phase` = VALUES(`perm_phase`), + `perm_actif` = VALUES(`perm_actif`), + `perm_tri` = VALUES(`perm_tri`); + + +INSERT INTO `inscriptions_eve_roles` + (`role_code`, `role_label_fr`, `role_label_en`, `role_description_fr`, `role_description_en`, `role_icone`, `role_systeme`, `role_actif`, `role_tri`) +VALUES + ('bib_ops', 'Gestion dossards', 'Bib management', + 'Quantites epreuves et gestion dossards v4', + 'Race quantities and bib management v4', + 'fa-hashtag', 1, 1, 35), + ('qr_debug', 'Debug QR', 'QR debug', + 'Outil interne test scanner QR', + 'Internal QR scanner test tool', + 'fa-qrcode', 1, 1, 36) +ON DUPLICATE KEY UPDATE + `role_label_fr` = VALUES(`role_label_fr`), + `role_label_en` = VALUES(`role_label_en`), + `role_description_fr` = VALUES(`role_description_fr`), + `role_description_en` = VALUES(`role_description_en`), + `role_icone` = VALUES(`role_icone`), + `role_systeme` = VALUES(`role_systeme`), + `role_actif` = VALUES(`role_actif`), + `role_tri` = VALUES(`role_tri`); + + +DELETE erp FROM inscriptions_eve_role_permissions erp +INNER JOIN inscriptions_eve_roles r ON r.role_id = erp.role_id +WHERE r.role_code = 'owner'; + +INSERT INTO inscriptions_eve_role_permissions (role_id, perm_key) +SELECT r.role_id, p.perm_key +FROM inscriptions_eve_roles r +CROSS JOIN inscriptions_eve_permissions p +WHERE r.role_code = 'owner' + AND p.perm_actif = 1; + + +DELETE erp FROM inscriptions_eve_role_permissions erp +INNER JOIN inscriptions_eve_roles r ON r.role_id = erp.role_id +WHERE r.role_code = 'bib_ops'; + +INSERT INTO inscriptions_eve_role_permissions (role_id, perm_key) +SELECT r.role_id, p.perm_key +FROM inscriptions_eve_roles r +INNER JOIN inscriptions_eve_permissions p + ON p.perm_key IN ('dossards.view', 'dossards.manage', 'epreuves.view', 'epreuves.edit_qte') + AND p.perm_actif = 1 +WHERE r.role_code = 'bib_ops'; + + +DELETE erp FROM inscriptions_eve_role_permissions erp +INNER JOIN inscriptions_eve_roles r ON r.role_id = erp.role_id +WHERE r.role_code = 'qr_debug'; + +INSERT INTO inscriptions_eve_role_permissions (role_id, perm_key) +SELECT r.role_id, p.perm_key +FROM inscriptions_eve_roles r +INNER JOIN inscriptions_eve_permissions p + ON p.perm_key IN ('tools.qr_test') + AND p.perm_actif = 1 +WHERE r.role_code = 'qr_debug';