Thanakorn
ae98dcdcdd
- .htaccess: refuse .git, .env, docker, nodejs, sdlc*, scripts, archives and app internals; security headers, HSTS over TLS, optional HTTPS redirect - uploads served through app/file.php to signed-in users only - Apache/PHP hardening config for the container (ServerTokens, expose_php) - least-privilege DB account and APP_SECRET_KEY via docker/php/provision.php; SMTP passwords re-encrypted with a random IV (secret_box.php) - Socket.IO rooms from a PHP-signed token; /emit and cron refuse empty secrets - escape notification text; CLI guards on build scripts; no fixed demo password
111 lines
3.5 KiB
PHP
111 lines
3.5 KiB
PHP
<?php
|
|
$current_page = basename($_SERVER['PHP_SELF']);
|
|
$setting_role = $_SESSION['login_role'] ?? 'viewer';
|
|
// Users Access and SMTP are owner/admin only (their API engines enforce it);
|
|
// don't offer other roles a page that can only answer "Access denied".
|
|
$setting_can_admin = in_array($setting_role, ['owner', 'admin'], true);
|
|
?>
|
|
|
|
<!-- SIDEBAR -->
|
|
<aside id="sidebar" class="sidebar overflow-y-auto d-flex flex-column">
|
|
<div class="logo-area">
|
|
<a href="<?php echo $server_url?>index.php" class="d-inline-flex">
|
|
<span class="logo-text">
|
|
<img src="<?php echo $server_url?>assets/images/logo.png" alt="" height="48"/>
|
|
</span>
|
|
</a>
|
|
</div>
|
|
|
|
<ul class="nav flex-column">
|
|
|
|
<!-- Setting -->
|
|
<li class="nav-text-space">
|
|
<small class="nav-text text-muted">Setting</small>
|
|
</li>
|
|
|
|
<li>
|
|
<a class="nav-link <?php echo $current_page === 'profile.php' ? 'active' : ''; ?>"
|
|
href="<?php echo $server_url?>setting/profile.php">
|
|
<i class="ti ti-user-circle"></i>
|
|
<span class="nav-text">Profile</span>
|
|
</a>
|
|
</li>
|
|
|
|
<li>
|
|
<a class="nav-link <?php echo $current_page === 'company.php' ? 'active' : ''; ?>"
|
|
href="<?php echo $server_url?>setting/company.php">
|
|
<i class="ti ti-building"></i>
|
|
<span class="nav-text">Company Profile</span>
|
|
</a>
|
|
</li>
|
|
|
|
<?php if ($setting_can_admin): ?>
|
|
<li>
|
|
<a class="nav-link <?php echo $current_page === 'users.php' ? 'active' : ''; ?>"
|
|
href="<?php echo $server_url?>setting/users.php">
|
|
<i class="ti ti-users"></i>
|
|
<span class="nav-text">Users Access</span>
|
|
</a>
|
|
</li>
|
|
|
|
<li>
|
|
<a class="nav-link <?php echo $current_page === 'smtp.php' ? 'active' : ''; ?>"
|
|
href="<?php echo $server_url?>setting/smtp.php">
|
|
<i class="ti ti-mail-cog"></i>
|
|
<span class="nav-text">SMTP Setting</span>
|
|
</a>
|
|
</li>
|
|
<?php endif; ?>
|
|
|
|
<li>
|
|
<a class="nav-link <?php echo $current_page === 'system_config.php' ? 'active' : ''; ?>"
|
|
href="<?php echo $server_url?>setting/system_config.php">
|
|
<i class="ti ti-adjustments-cog"></i>
|
|
<span class="nav-text">System Configuration</span>
|
|
</a>
|
|
</li>
|
|
|
|
<li>
|
|
<a class="nav-link <?php echo $current_page === 'document_types.php' ? 'active' : ''; ?>"
|
|
href="<?php echo $server_url?>setting/document_types.php">
|
|
<i class="ti ti-hash"></i>
|
|
<span class="nav-text">Document Numbering</span>
|
|
</a>
|
|
</li>
|
|
|
|
<li class="nav-text-space">
|
|
<small class="nav-text text-muted">Maintenance</small>
|
|
</li>
|
|
|
|
<li>
|
|
<a class="nav-link <?php echo $current_page === 'gl_maintenance.php' ? 'active' : ''; ?>"
|
|
href="<?php echo $server_url?>setting/gl_maintenance.php">
|
|
<i class="ti ti-database-cog"></i>
|
|
<span class="nav-text">GL Maintenance</span>
|
|
</a>
|
|
</li>
|
|
|
|
<li>
|
|
<a class="nav-link <?php echo $current_page === 'stock_maintenance.php' ? 'active' : ''; ?>"
|
|
href="<?php echo $server_url?>setting/stock_maintenance.php">
|
|
<i class="ti ti-database-import"></i>
|
|
<span class="nav-text">Stock Maintenance</span>
|
|
</a>
|
|
</li>
|
|
|
|
<!-- Back -->
|
|
<li class="nav-text-space mt-2">
|
|
<small class="nav-text text-muted">Navigation</small>
|
|
</li>
|
|
|
|
<li>
|
|
<a class="nav-link" href="<?php echo $server_url?>dashboard/index.php">
|
|
<i class="ti ti-arrow-left"></i>
|
|
<span class="nav-text">Back to App</span>
|
|
</a>
|
|
</li>
|
|
|
|
</ul>
|
|
|
|
</aside>
|