nok/wms-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

centralize roles guards

Browse Source
This commit is contained in:
Thanakorn S
2026-05-07 09:26:39 +07:00
parent 0d2fa3e3bd
commit a24930f684
13 changed files with 37 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/contact/api/engine/manage_contact.php
+2
View File
@@ -4,6 +4,8 @@
require '../../../assets/utils/classes/FileUploader.php';
require '../../../assets/utils/classes/ContactManager.php';
require_role($user_role, ['owner', 'admin', 'staff']);
$id = (int)$data['id'];
try {
app/contact/api/engine/manage_contact_type.php
+2
View File
@@ -3,6 +3,8 @@
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/ContactManager.php';
require_role($user_role, ['owner', 'admin']);
try {
dbTransaction($pdo2, function($pdo) use ($data, $company_id, $logging) {
$contact = new ContactManager($pdo, $company_id);
app/contact/api/engine/remove_contact.php
+2
View File
@@ -3,6 +3,8 @@
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/ContactManager.php';
require_role($user_role, ['owner', 'admin']);
try {
dbTransaction($pdo2, function($pdo) use ($data, $company_id) {
app/contact/api/engine/remove_contact_type.php
+2
View File
@@ -3,6 +3,8 @@
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/ContactManager.php';
require_role($user_role, ['owner', 'admin']);
try {
dbTransaction($pdo2, function($pdo) use ($data, $company_id) {
app/ics/api/engine/approve_stock.php
+2
View File
@@ -16,6 +16,8 @@ require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/StockManager.php';
require '../../../assets/utils/classes/WarehouseManager.php';
require_role($user_role, ['owner', 'admin']);
$id = (int)($data['id'] ?? 0);
$warehouse_id = (int)($data['warehouse'] ?? 0);
$type = $data['type'] ?? '';
app/ics/api/engine/delete_stock_in.php
+2
View File
@@ -3,6 +3,8 @@
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/WarehouseManager.php';
require_role($user_role, ['owner', 'admin']);
try {
dbTransaction($pdo2, function($pdo) use ($data, $company_id) {
app/ics/api/engine/delete_stock_out.php
+2
View File
@@ -3,6 +3,8 @@
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/WarehouseManager.php';
require_role($user_role, ['owner', 'admin']);
try {
dbTransaction($pdo2, function($pdo) use ($data, $company_id) {
app/ics/api/engine/delete_stock_transfer.php
+2
View File
@@ -3,6 +3,8 @@
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/WarehouseManager.php';
require_role($user_role, ['owner', 'admin']);
try {
dbTransaction($pdo2, function($pdo) use ($data, $company_id) {
app/include_ending.php
+1 -1
View File
@@ -1,7 +1,7 @@
<div class="row">
<div class="col-12">
<footer class="text-center py-2 mt-6 text-secondary ">
<p class="mb-0">Copyright © 2026 InApp Inventory Dashboard. Developed by <a href="https://codescandy.com/"
<p class="mb-0">Copyright © 2026 TRx WMS. Developed by <a href="https://codescandy.com/"
target="_blank" class="text-primary">CodesCandy</a> </p>
</footer>
</div>
app/inventory/api/engine/manager.php
+15 -11
View File
@@ -1,17 +1,21 @@
<?php
<?php
session_start();
require '../../../assets/utils/db_auth.php';
$sql = "SELECT *
FROM user
WHERE
username not in ('support','extra')";
$sth = $pdo1->query($sql);
require_role($user_role, ['owner', 'admin']);
$sth = $pdo1->prepare(
"SELECT u.user_id, u.name, u.surname, u.email
FROM user u
INNER JOIN company_map_user m
ON m.user_id = u.user_id
AND m.company_id = :company_id
ORDER BY u.name ASC"
);
$sth->execute([':company_id' => $company_id]);
db_check($sth, $answer);
$answer["output"] = $sth->fetchAll(PDO::FETCH_ASSOC);
$answer["success"] = 1;
$answer['output'] = $sth->fetchAll(PDO::FETCH_ASSOC);
$answer['success'] = 1;
exit(json_encode($answer));
?>
?>
app/setting/api/engine/manage_company.php
+2
View File
@@ -3,6 +3,8 @@
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/FileUploader.php';
require_role($user_role, ['owner', 'admin']);
// ─── Allowed upload MIME types ────────────────────────────────────────────
const ALLOWED_MIME = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];
const MAX_SIZE = 2 * 1024 * 1024; // 2 MB
app/setting/api/engine/manage_smtp.php
+1 -14
View File
@@ -2,20 +2,7 @@
session_start();
require '../../../assets/utils/db_auth.php';
// ─── Role guard: only owner/admin ────────────────────────────────────────
$sth = $pdo1->prepare("
SELECT role FROM company_map_user
WHERE company_id = :company_id AND user_id = :user_id
LIMIT 1
");
$sth->execute([':company_id' => $company_id, ':user_id' => $user_id]);
db_check($sth, $answer);
if (!in_array($sth->fetchColumn(), ['owner', 'admin'], true)) {
$answer['message'] = 'You do not have permission to change SMTP settings.';
http_response_code(403);
exit(json_encode($answer));
}
require_role($user_role, ['owner', 'admin']);
// ─── Encrypt password — same method/key/iv as config.php ─────────────────
function encrypt_password(string $plain): string {
app/setting/api/engine/test_smtp.php
+2
View File
@@ -2,6 +2,8 @@
session_start();
require '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin']);
try {
$to = trim($data['test_email'] ?? '');