<?php
require('connection.inc.php');
require('security.php');
error_reporting(E_ALL);
ini_set('display_errors', 1);
// Function to check if the user has the required permission
function hasPermission($role_id, $permission_name, $conn) {
$query = "SELECT rp.role_permissions_id
FROM role_permissions rp
INNER JOIN permissions p ON rp.permission_id = p.permission_id
WHERE rp.role_id = ? AND p.permission_name = ?";
$stmt = $conn->prepare($query);
$stmt->bind_param("is", $role_id, $permission_name); // Binding parameters (integer and string)
$stmt->execute();
$result = $stmt->get_result();
return $result->num_rows > 0; // Return true if permission exists
}
// Generate CSRF token if not set
if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
// Get user's role from session
$user_role_id = $_SESSION['role_id'];
// Define the required permission for this page
$permission_name = "View Roles and Permissions";
// Check if the user is logged in by verifying session variables
if (!isset($_SESSION['user_id'])) {
// If not logged in, redirect to the login page (index.php)
header('Location: index.php');
exit();
}
$permission = '';
if (isset($_POST['submit'])) {
// Check CSRF token
if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
echo "
<script src='https://cdn.jsdelivr.net/npm/sweetalert2@11'></script>
<script>
document.addEventListener('DOMContentLoaded', function() {
Swal.fire({
icon: 'error',
title: 'Security Warning',
text: 'Invalid CSRF token. Please try again.',
});
});
</script>
";
exit();
}
$roleId = $_POST['role_id'];
$permissions = isset($_POST['permissions']) ? $_POST['permissions'] : [];
// Delete existing permissions for the role
$deleteQuery = "DELETE FROM role_permissions WHERE role_id = ?";
$stmt = $conn->prepare($deleteQuery);
$stmt->bind_param("i", $roleId);
$stmt->execute();
// Insert new permissions
foreach ($permissions as $permissionId) {
$insertQuery = "INSERT INTO role_permissions (role_id, permission_id) VALUES (?, ?)";
$stmt = $conn->prepare($insertQuery);
$stmt->bind_param("ii", $roleId, $permissionId);
$stmt->execute();
}
unset($_SESSION['csrf_token']);
echo "
<script src='https://cdn.jsdelivr.net/npm/sweetalert2@11'></script>
<script>
document.addEventListener('DOMContentLoaded', function() {
Swal.fire({
title: 'Success!',
text: 'Permissions updated successfully!',
icon: 'success',
confirmButtonText: 'OK'
}).then(() => {
window.location.href = 'role_permissions.php'; // Redirect after confirmation
});
});
</script>";
}
?>
<!DOCTYPE html>
<html lang="zxx">
<!-- Mirrored from demo.dashboardpack.com/user-management-html/role_permissions.html by HTTrack Website Copier/3.x [XR&CO'2014], Mon, 02 Dec 2024 05:54:56 GMT -->
<head>
<!-- Required meta tags -->
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />
<title>Management Admin</title>
<link rel="icon" href="img/mini_logo.png" type="image/png">
<!-- Bootstrap CSS -->
<link rel="stylesheet" href="css/bootstrap1.min.css" />
<!-- themefy CSS -->
<link rel="stylesheet" href="vendors/themefy_icon/themify-icons.css" />
<!-- owl carousel CSS -->
<link rel="stylesheet" href="vendors/owl_carousel/css/owl.carousel.css" />
<!-- gijgo css -->
<link rel="stylesheet" href="vendors/gijgo/gijgo.min.css" />
<!-- font awesome CSS -->
<link rel="stylesheet" href="vendors/font_awesome/css/all.min.css" />
<link rel="stylesheet" href="vendors/tagsinput/tagsinput.css" />
<!-- date picker -->
<link rel="stylesheet" href="vendors/datepicker/date-picker.css" />
<link rel="stylesheet" href="vendors/vectormap-home/vectormap-2.0.2.css" />
<!-- scrollabe -->
<link rel="stylesheet" href="vendors/scroll/scrollable.css" />
<!-- text editor css -->
<link rel="stylesheet" href="vendors/text_editor/summernote-bs4.css" />
<!-- morris css -->
<link rel="stylesheet" href="vendors/morris/morris.css">
<!-- metarial icon css -->
<link rel="stylesheet" href="vendors/material_icon/material-icons.css" />
<!-- menu css -->
<link rel="stylesheet" href="css/metisMenu.css">
<!-- style CSS -->
<link rel="stylesheet" href="css/style1.css" />
<link rel="stylesheet" href="css/colors/default.css" id="colorSkinCSS">
<script src='https://cdn.jsdelivr.net/npm/sweetalert2@11'></script>
<style>
.nice_Select2.nice_Select_line::after {
margin-top: 0px !important;
}
</style>
</head>
<body class="crm_body_bg">
<?php
// Your PHP code for checking permission goes here
if (!hasPermission($user_role_id, $permission_name, $conn)) {
// Destroy the session to log the user out
session_unset(); // Unset all session variables
session_destroy(); // Destroy the session
// Show SweetAlert and then redirect
echo "<script>
document.addEventListener('DOMContentLoaded', function() {
Swal.fire({
icon: 'error',
title: 'Access Denied',
text: 'You do not have permission to access this page.',
showConfirmButton: false,
timer: 3000
}).then(function() {
window.location.href = 'index.php'; // Redirect after the alert
});
});
</script>";
exit();
}
?>
<!-- main content part here -->
<!-- sidebar -->
<?php require('sidebar.inc.php'); ?>
<!--/ sidebar -->
<section class="main_content dashboard_part large_header_bg">
<!-- menu -->
<?php require('header.inc.php'); ?>
<!--/ menu -->
<div class="main_content_iner overly_inner ">
<div class="container-fluid p-0 ">
<!-- page title -->
<div class="row">
<div class="col-12">
<div class="page_title_box d-flex flex-wrap align-items-center justify-content-between">
<div class="page_title_left d-flex align-items-center">
<h3 class="f_s_25 f_w_700 dark_text mr_30" >Permissions</h3>
<ol class="breadcrumb page_bradcam mb-0">
<li class="breadcrumb-item"><a href="javascript:void(0);">Home</a></li>
<li class="breadcrumb-item active">Permissions</li>
</ol>
</div>
<div class="page_title_right">
<div class="page_date_button d-flex align-items-center">
<!-- <img src="img/icon/calender_icon.svg" alt="">
August 1, 2020 - August 31, 2020 -->
</div>
</div>
</div>
</div>
</div>
<div class="row">
<div class="col-12">
<div class="white_card card_height_100 mb_30">
<div class="white_card_header">
<div class="box_header m-0">
<div class="main-title">
<h3 class="m-0">Add New Role </h3>
</div>
</div>
</div>
<?php
require('connection.inc.php');
// Fetch all roles
$rolesQuery = "SELECT * FROM roles WHERE deleted_at IS NULL AND role_name != 'customer'";
$rolesResult = mysqli_query($conn, $rolesQuery);
?>
<div class="white_card_body">
<form id="rolePermissionForm" method="post">
<?php
if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
?>
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token']; ?>">
<div class="row">
<div class="col-lg-6 pb-2">
<select id="roleDropdown" class="nice_Select2 nice_Select_line wide" name="role_id" style="display: none;" required>
<option value="">Select Role</option>
<?php
while ($role = mysqli_fetch_assoc($rolesResult)) {
echo "<option value='" . $role['role_id'] . "'>" . $role['role_name'] . "</option>";
}
?>
</select>
</div>
<div class="col-lg-12" id="permissionsContainer">
<!-- Permissions checkboxes will be dynamically populated here -->
</div>
<div class="col-12">
<div class="create_report_btn mt_10">
<button type="submit" name="submit" class="btn_1 radius_btn d-block text-center">
Add Permissions
</button>
</div>
</div>
</div>
</form>
</div>
</div>
</div>
</div>
<div class="row">
<div class="col-lg-12">
<div class="white_card card_height_100 mb_30 pt-4">
<div class="white_card_body">
<div class="QA_section">
<div class="white_box_tittle list_header">
<h4>Role & Permissions</h4>
</div>
<div class="QA_table mb_30">
<!-- table-responsive -->
<table class="table lms_table_active3 ">
<thead>
<tr>
<th scope="col">#</th>
<th scope="col">Roles</th>
<th scope="col">Permissions</th>
</tr>
</thead>
<tbody>
<?php
require('connection.inc.php');
error_reporting(E_ALL);
ini_set('display_errors', 1);
// Query to fetch roles and their permissions
$sql = "
SELECT roles.role_name, GROUP_CONCAT(permissions.permission_name SEPARATOR ', ') AS permissions
FROM roles
LEFT JOIN role_permissions ON roles.role_id = role_permissions.role_id
LEFT JOIN permissions ON role_permissions.permission_id = permissions.permission_id
WHERE roles.deleted_at IS NULL AND roles.role_name != 'customer'
GROUP BY roles.role_id
";
$read = mysqli_query($conn, $sql);
if ($read) {
$index = 1; // To display the row number
while ($row = mysqli_fetch_assoc($read)) {
?>
<tr>
<th scope="row"><?php echo $index++; ?></th>
<td><?php echo $row['role_name']; ?></td>
<td><?php echo $row['permissions']; ?></td>
</tr>
<?php
}
} else {
echo "Error: " . mysqli_error($conn);
}
?>
</tbody>
</table>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<!-- footer part -->
<?php require('footer.inc.php'); ?>
</section>
<!-- main content part end -->
<!-- ### CHAT_MESSAGE_BOX ### -->
<div class="CHAT_MESSAGE_POPUPBOX">
<div class="CHAT_POPUP_HEADER">
<div class="MSEESAGE_CHATBOX_CLOSE">
<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">
<path d="M7.09939 5.98831L11.772 10.661C12.076 10.965 12.076 11.4564 11.772 11.7603C11.468 12.0643 10.9766 12.0643 10.6726 11.7603L5.99994 7.08762L1.32737 11.7603C1.02329 12.0643 0.532002 12.0643 0.228062 11.7603C-0.0760207 11.4564 -0.0760207 10.965 0.228062 10.661L4.90063 5.98831L0.228062 1.3156C-0.0760207 1.01166 -0.0760207 0.520226 0.228062 0.216286C0.379534 0.0646715 0.578697 -0.0114918 0.777717 -0.0114918C0.976738 -0.0114918 1.17576 0.0646715 1.32737 0.216286L5.99994 4.889L10.6726 0.216286C10.8243 0.0646715 11.0233 -0.0114918 11.2223 -0.0114918C11.4213 -0.0114918 11.6203 0.0646715 11.772 0.216286C12.076 0.520226 12.076 1.01166 11.772 1.3156L7.09939 5.98831Z" fill="white"/>
</svg>
</div>
<h3>Chat with us</h3>
<div class="Chat_Listed_member">
<ul>
<li>
<a href="#">
<div class="member_thumb">
<img src="img/staf/1.png" alt="">
</div>
</a>
</li>
<li>
<a href="#">
<div class="member_thumb">
<img src="img/staf/2.png" alt="">
</div>
</a>
</li>
<li>
<a href="#">
<div class="member_thumb">
<img src="img/staf/3.png" alt="">
</div>
</a>
</li>
<li>
<a href="#">
<div class="member_thumb">
<img src="img/staf/4.png" alt="">
</div>
</a>
</li>
<li>
<a href="#">
<div class="member_thumb">
<img src="img/staf/5.png" alt="">
</div>
</a>
</li>
<li>
<a href="#">
<div class="member_thumb">
<div class="more_member_count">
<span>90+</span>
</div>
</div>
</a>
</li>
</ul>
</div>
</div>
<div class="CHAT_POPUP_BODY">
<p class="mesaged_send_date">
Sunday, 12 January
</p>
<div class="CHATING_SENDER">
<div class="SMS_thumb">
<img src="img/staf/1.png" alt="">
</div>
<div class="SEND_SMS_VIEW">
<P>Hi! Welcome .
How can I help you?</P>
</div>
</div>
<div class="CHATING_SENDER CHATING_RECEIVEr">
<div class="SEND_SMS_VIEW">
<P>Hello</P>
</div>
<div class="SMS_thumb">
<img src="img/staf/1.png" alt="">
</div>
</div>
</div>
<div class="CHAT_POPUP_BOTTOM">
<div class="chat_input_box d-flex align-items-center">
<div class="input-group">
<input type="text" class="form-control" placeholder="Write your message" aria-label="Recipient's username" aria-describedby="basic-addon2">
<div class="input-group-append">
<button class="btn " type="button">
<!-- svg -->
<svg width="22" height="22" viewBox="0 0 22 22" fill="none" xmlns="http://www.w3.org/2000/svg">
<path d="M18.7821 3.21895C14.4908 -1.07281 7.50882 -1.07281 3.2183 3.21792C-1.07304 7.50864 -1.07263 14.4908 3.21872 18.7824C7.50882 23.0729 14.4908 23.0729 18.7817 18.7815C23.0726 14.4908 23.0724 7.50906 18.7821 3.21895ZM17.5813 17.5815C13.9525 21.2103 8.04773 21.2108 4.41871 17.5819C0.78907 13.9525 0.789485 8.04714 4.41871 4.41832C8.04752 0.789719 13.9521 0.789304 17.5817 4.41874C21.2105 8.04755 21.2101 13.9529 17.5813 17.5815ZM6.89503 8.02162C6.89503 7.31138 7.47107 6.73534 8.18131 6.73534C8.89135 6.73534 9.46739 7.31117 9.46739 8.02162C9.46739 8.73228 8.89135 9.30811 8.18131 9.30811C7.47107 9.30811 6.89503 8.73228 6.89503 8.02162ZM12.7274 8.02162C12.7274 7.31138 13.3038 6.73534 14.0141 6.73534C14.7241 6.73534 15.3002 7.31117 15.3002 8.02162C15.3002 8.73228 14.7243 9.30811 14.0141 9.30811C13.3038 9.30811 12.7274 8.73228 12.7274 8.02162ZM15.7683 13.2898C14.9712 15.1332 13.1043 16.3243 11.0126 16.3243C8.8758 16.3243 6.99792 15.1272 6.22834 13.2744C6.09642 12.9573 6.24681 12.593 6.56438 12.4611C6.64238 12.4289 6.72328 12.4136 6.80293 12.4136C7.04687 12.4136 7.27836 12.5577 7.37772 12.7973C7.95376 14.1842 9.38048 15.0799 11.0126 15.0799C12.6077 15.0799 14.0261 14.1836 14.626 12.7959C14.7625 12.4804 15.1288 12.335 15.4441 12.4717C15.7594 12.6084 15.9048 12.9745 15.7683 13.2898Z" fill="#707DB7"/>
</svg>
<!-- svg -->
</button>
<button class="btn" type="button">
<!-- svg -->
<svg width="22" height="22" viewBox="0 0 22 22" fill="none" xmlns="http://www.w3.org/2000/svg">
<path d="M11 0.289062C4.92455 0.289062 0 5.08402 0 10.9996C0 16.9152 4.92455 21.7101 11 21.7101C17.0755 21.7101 22 16.9145 22 10.9996C22 5.08472 17.0755 0.289062 11 0.289062ZM11 20.3713C5.68423 20.3713 1.375 16.1755 1.375 10.9996C1.375 5.82371 5.68423 1.62788 11 1.62788C16.3158 1.62788 20.625 5.82371 20.625 10.9996C20.625 16.1755 16.3158 20.3713 11 20.3713ZM15.125 10.3302H11.6875V6.98314C11.6875 6.61363 11.3795 6.31373 11 6.31373C10.6205 6.31373 10.3125 6.61363 10.3125 6.98314V10.3302H6.875C6.4955 10.3302 6.1875 10.6301 6.1875 10.9996C6.1875 11.3691 6.4955 11.669 6.875 11.669H10.3125V15.016C10.3125 15.3855 10.6205 15.6854 11 15.6854C11.3795 15.6854 11.6875 15.3855 11.6875 15.016V11.669H15.125C15.5045 11.669 15.8125 11.3691 15.8125 10.9996C15.8125 10.6301 15.5045 10.3302 15.125 10.3302Z" fill="#707DB7"/>
</svg>
<!-- svg -->
<input type="file">
</button>
</div>
</div>
</div>
</div>
</div>
<!--/### CHAT_MESSAGE_BOX ### -->
<div id="back-top" style="display: none;">
<a title="Go to Top" href="#">
<i class="ti-angle-up"></i>
</a>
</div>
<!-- footer -->
<script src="js/jquery1-3.4.1.min.js"></script>
<!-- popper js -->
<script src="js/popper1.min.js"></script>
<!-- bootstarp js -->
<script src="js/bootstrap1.min.js"></script>
<!-- waypoints js -->
<script src="vendors/count_up/jquery.waypoints.min.js"></script>
<!-- waypoints js -->
<script src="vendors/chartlist/Chart.min.js"></script>
<!-- counterup js -->
<script src="vendors/count_up/jquery.counterup.min.js"></script>
<!-- owl carousel -->
<script src="vendors/owl_carousel/js/owl.carousel.min.js"></script>
<!-- datepicker -->
<script src="vendors/datepicker/datepicker.js"></script>
<script src="vendors/datepicker/datepicker.en.js"></script>
<script src="vendors/datepicker/datepicker.custom.js"></script>
<script src="js/chart.min.js"></script>
<script src="vendors/chartjs/roundedBar.min.js"></script>
<!-- progressbar js -->
<script src="vendors/progressbar/jquery.barfiller.js"></script>
<!-- tag input -->
<script src="vendors/tagsinput/tagsinput.js"></script>
<!-- text editor js -->
<script src="vendors/text_editor/summernote-bs4.js"></script>
<script src='https://cdn.jsdelivr.net/npm/sweetalert2@11'></script>
<script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>
<!-- datatable CSS -->
<link rel="stylesheet" href="vendors/datatable/css/jquery.dataTables.min.css" />
<link rel="stylesheet" href="vendors/datatable/css/responsive.dataTables.min.css" />
<link rel="stylesheet" href="vendors/datatable/css/buttons.dataTables.min.css" />
<!-- select2 CSS -->
<link rel="stylesheet" href="vendors/niceselect/css/nice-select.css" />
<!-- nice select -->
<script src="vendors/niceselect/js/jquery.nice-select.min.js"></script>
<!-- responsive table -->
<script src="vendors/datatable/js/jquery.dataTables.min.js"></script>
<script src="vendors/datatable/js/dataTables.responsive.min.js"></script>
<script src="vendors/datatable/js/dataTables.buttons.min.js"></script>
<script src="vendors/datatable/js/buttons.flash.min.js"></script>
<script src="vendors/datatable/js/jszip.min.js"></script>
<script src="vendors/datatable/js/pdfmake.min.js"></script>
<script src="vendors/datatable/js/vfs_fonts.js"></script>
<script src="vendors/datatable/js/buttons.html5.min.js"></script>
<script src="vendors/datatable/js/buttons.print.min.js"></script>
<!-- sidebar menu -->
<script src="js/metisMenu.js"></script>
<script src="js/custom.js"></script>
<script>
$(document).ready(function () {
// Fetch permissions dynamically when a role is selected
$('#roleDropdown').change(function () {
const roleId = $(this).val();
if (roleId) {
$.ajax({
url: 'fetch_permissions.php', // Backend file to fetch permissions
type: 'POST',
data: { role_id: roleId },
success: function (response) {
$('#permissionsContainer').html(response);
}
});
} else {
$('#permissionsContainer').html('');
}
});
});
</script>
</body>
<!-- Mirrored from demo.dashboardpack.com/user-management-html/role_permissions.html by HTTrack Website Copier/3.x [XR&CO'2014], Mon, 02 Dec 2024 05:54:56 GMT -->
</html>