diff --git a/src/application/config/constants.php b/src/application/config/constants.php
index aa25e87f..994944c4 100644
--- a/src/application/config/constants.php
+++ b/src/application/config/constants.php
@@ -58,5 +58,17 @@ define('AJAX_FAILURE', 'FAILURE');
define('SETTINGS_SYSTEM', 'SETTINGS_SYSTEM');
define('SETTINGS_USER', 'SETTINGS_USER');
+
+define('PRIV_VIEW', 1);
+define('PRIV_ADD', 2);
+define('PRIV_EDIT', 4);
+define('PRIV_DELETE', 8);
+
+define('PAGE_APPOINTMENTS', 'appointments');
+define('PAGE_CUSTOMERS', 'customers');
+define('PAGE_SERVICES', 'services');
+define('PAGE_USERS', 'users');
+define('PAGE_SYSTEM_SETTINGS', 'system_settings');
+define('PAGE_USER_SETTINGS', 'user_settings');
/* End of file constants.php */
/* Location: ./application/config/constants.php */
\ No newline at end of file
diff --git a/src/application/controllers/backend.php b/src/application/controllers/backend.php
index 2668b725..e12587af 100644
--- a/src/application/controllers/backend.php
+++ b/src/application/controllers/backend.php
@@ -1,6 +1,11 @@
load->library('session');
+ }
+
/**
* Display the main backend page.
*
@@ -13,7 +18,8 @@ class Backend extends CI_Controller {
* appear when the page loads.
*/
public function index($appointment_hash = '') {
- // @task Require user to be logged in the application.
+ $this->session->set_userdata('dest_url', $this->config->item('base_url') . 'backend');
+ if (!$this->hasPrivileges(PAGE_APPOINTMENTS)) return;
$this->load->model('appointments_model');
$this->load->model('providers_model');
@@ -47,7 +53,8 @@ class Backend extends CI_Controller {
* In this page the user can manage all the customer records of the system.
*/
public function customers() {
- // @task Require user to be logged in the application.
+ $this->session->set_userdata('dest_url', $this->config->item('base_url') . 'backend/customers');
+ if (!$this->hasPrivileges(PAGE_CUSTOMERS)) return;
$this->load->model('providers_model');
$this->load->model('customers_model');
@@ -75,7 +82,8 @@ class Backend extends CI_Controller {
* from the backend services page.
*/
public function services() {
- // @task Require user to be logged in the application.
+ $this->session->set_userdata('dest_url', $this->config->item('base_url') . 'backend/services');
+ if (!$this->hasPrivileges(PAGE_SERVICES)) return;
$this->load->model('customers_model');
$this->load->model('services_model');
@@ -99,7 +107,8 @@ class Backend extends CI_Controller {
* the page where the admin defines which service can each provider provide.
*/
public function users() {
- // @task Require user to be logged in the application.
+ $this->session->set_userdata('dest_url', $this->config->item('base_url') . 'backend/users');
+ if (!$this->hasPrivileges(PAGE_USERS)) return;
$this->load->model('providers_model');
$this->load->model('secretaries_model');
@@ -127,6 +136,10 @@ class Backend extends CI_Controller {
* installation (core settings like company name, book timeout etc).
*/
public function settings() {
+ $this->session->set_userdata('dest_url', $this->config->item('base_url') . 'backend/settings');
+ if (!$this->hasPrivileges(PAGE_SYSTEM_SETTINGS)
+ && !$this->hasPrivileges(PAGE_USER_SETTINGS)) return;
+
$this->load->model('settings_model');
$this->load->model('user_model');
@@ -148,6 +161,48 @@ class Backend extends CI_Controller {
$this->load->view('backend/settings', $view);
$this->load->view('backend/footer', $view);
}
+
+ /**
+ * Check whether current user is logged in and has the required privileges to
+ * view a page.
+ *
+ * The backend page requires different privileges from the users to display pages. Not all
+ * pages are avaiable to all users. For example secretaries should not be able to edit the
+ * system users.
+ *
+ * @see Constant Definition In application/config/constants.php
+ *
+ * @param string $page This argument must match the roles field names of each section
+ * (eg "appointments", "users" ...).
+ * @param bool $redirect (OPTIONAL - TRUE) If the user has not the required privileges
+ * (either not logged in or insufficient role privileges) then the user will be redirected
+ * to another page. Set this argument to FALSE when using ajax.
+ * @return bool Returns whether the user has the required privileges to view the page or
+ * not. If the user is not logged in then he will be prompted to log in. If he hasn't the
+ * required privileges then an info message will be displayed.
+ */
+ private function hasPrivileges($page, $redirect = TRUE) {
+ // Check if user is logged in.
+ $user_id = $this->session->userdata('user_id');
+ if ($user_id == FALSE) { // User not logged in, display the login view.
+ if ($redirect) {
+ header('Location: ' . $this->config->item('base_url') . 'user/login');
+ }
+ return FALSE;
+ }
+
+ // Check if the user has the required privileges for viewing the selected page.
+ $role_slug = $this->session->userdata('role_slug');
+ $role_priv = $this->db->get_where('ea_roles', array('slug' => $role_slug))->row_array();
+ if ($role_priv[$page] < PRIV_VIEW) { // User does not have the permission to view the page.
+ if ($redirect) {
+ header('Location: ' . $this->config->item('base_url') . 'user/no_privileges');
+ }
+ return FALSE;
+ }
+
+ return TRUE;
+ }
}
/* End of file backend.php */
diff --git a/src/application/controllers/backend_api.php b/src/application/controllers/backend_api.php
index 79a08689..b864c18d 100644
--- a/src/application/controllers/backend_api.php
+++ b/src/application/controllers/backend_api.php
@@ -811,10 +811,8 @@ class Backend_api extends CI_Controller {
$settings = json_decode($_POST['settings'], true);
$this->settings_model->save_settings($settings);
} else if ($_POST['type'] == SETTINGS_USER) {
- $this->load->library('session');
$this->load->model('user_model');
- $user_id = $this->session->userdata('user_id');
- $this->user_model->save_settings($_POST['settings'], $user_id);
+ $this->user_model->save_settings(json_decode($_POST['settings'], true));
}
echo json_encode(AJAX_SUCCESS);
diff --git a/src/application/controllers/user.php b/src/application/controllers/user.php
new file mode 100644
index 00000000..c3bb6a05
--- /dev/null
+++ b/src/application/controllers/user.php
@@ -0,0 +1,62 @@
+load->library('session');
+ }
+
+ public function index() {
+ header('Location: ' . $this->config->item('base_url') . 'user/login');
+ }
+
+ public function login() {
+ $view['base_url'] = $this->config->item('base_url');
+ $view['dest_url'] = $this->session->userdata('dest_url');
+ $this->load->view('user/login', $view);
+ }
+
+ public function logout() {
+
+ }
+
+ public function forgot_password() {
+
+ }
+
+ public function no_privileges() {
+ // can't view the requested page.
+ }
+
+ /**
+ * [AJAX] Check whether the user has entered the correct login credentials.
+ */
+ public function ajax_check_login() {
+ try {
+ if (!isset($_POST['username']) || !isset($_POST['password'])) {
+ throw new Exception('Invalid credentials given!');
+ }
+
+ $this->load->helper('general');
+ $this->load->model('user_model');
+
+ $hash_password = $this->hash_password($_POST['password']);
+ $user_data = $this->user_model->check_login($_POST['username'], $hash_password);
+
+ if ($user_data) {
+ $this->session->set_userdata($user_data); // Save data on user's session.
+ echo json_encode(AJAX_SUCCESS);
+ } else {
+ echo json_encode(AJAX_SUCCESS);
+ }
+
+ } catch(Exception $exc) {
+ echo json_encode(array(
+ 'exceptions' => array(exceptionToJavaScript($exc))
+ ));
+ }
+ }
+}
+
+/* End of file user.php */
+/* Location: ./application/controllers/user.php */
\ No newline at end of file
diff --git a/src/application/helpers/general_helper.php b/src/application/helpers/general_helper.php
index 0066474a..8f31c5a0 100644
--- a/src/application/helpers/general_helper.php
+++ b/src/application/helpers/general_helper.php
@@ -25,5 +25,18 @@ function date3339($timestamp=0) {
return $date;
}
+/**
+ * Generate a hash of password string.
+ *
+ * For user security, all system passwords are stored in hash string into the database. Use
+ * this method to produce the hash.
+ *
+ * @param string $password Given string password.
+ * @return string Returns the hash string of the given password.
+ */
+function hash_password($password) {
+ return md5($password); // @task include salt and hash more times.
+}
+
/* End of file general_helper.php */
/* Location: ./application/helpers/general_helper.php */
\ No newline at end of file
diff --git a/src/application/models/user_model.php b/src/application/models/user_model.php
index fbacc999..0fb003e8 100644
--- a/src/application/models/user_model.php
+++ b/src/application/models/user_model.php
@@ -18,22 +18,32 @@ class User_Model extends CI_Model {
* @return array Returns an array with user settings.
*/
public function get_settings($user_id) {
- $settings = $this->db->get_where('ea_user_settings', array('id_users' => $user_id))->row_array();
- unset($settings['id_users']);
- return $settings;
+ $user = $this->db->get_where('ea_users', array('id' => $user_id))->row_array();
+ $user['settings'] = $this->db->get_where('ea_user_settings', array('id_users' => $user_id))->row_array();
+ unset($user['settings']['id_users']);
+ return $user;
}
/**
* This method saves the user settings into the database.
*
- * @param array $settings Contains the current users settings.
- * @param numeric $user_id User record id of the settings.
+ * @param array $user Contains the current users settings.
* @return bool Returns the operation result.
*/
- public function save_settings($settings, $user_id) {
- $settings['id_users'] = $user_id;
- $this->db->where('id_users', $user_id);
- return $this->db->update('ea_user_settings', $settings);
+ public function save_settings($user) {
+ $user_settings = $user['settings'];
+ $user_settings['id_users'] = $user['id'];
+ unset($user['settings']);
+
+ if (!$this->db->update('ea_users', $user, array('id' => $user['id']))) {
+ return FALSE;
+ }
+
+ if (!$this->db->update('ea_user_settings', $user_settings, array('id_users' => $user['id']))) {
+ return FALSE;
+ }
+
+ return TRUE;
}
}
diff --git a/src/application/views/backend/settings.php b/src/application/views/backend/settings.php
index 9a86721c..7487582b 100644
--- a/src/application/views/backend/settings.php
+++ b/src/application/views/backend/settings.php
@@ -91,7 +91,7 @@
record. After that you can add break periods.
-