fix: restrict acess for non admin profile

deployment/Dockerfile

@@ -13,10 +13,14 @@ RUN apt-get autoclean && apt-get update && apt-get install -y \
     unzip \
     zip \
     git \
-    libzip-dev
+    libzip-dev \
+    libjpeg-dev \
+    libpng-dev \
+    libfreetype6-dev
 
 RUN apt-get install -y libicu-dev
-RUN docker-php-ext-install intl mysqli pdo pdo_mysql zip
+RUN docker-php-ext-configure gd --with-freetype --with-jpeg
+RUN docker-php-ext-install intl mysqli pdo pdo_mysql zip gd
 
 RUN if [ "$ENV" = "dev" ]; then pecl install xdebug-3.3.0 && docker-php-ext-enable xdebug; fi
 

relis_app/controllers/Element.php

@@ -43,6 +43,15 @@ public function display_element($operation_name, $ref_id, $allow_redirect = "yes
         $op = check_operation($operation_name, 'Detail');
         $ref_table = $op['tab_ref'];
         $ref_table_operation = $op['operation_id'];
+
+        // === Contrôle d'accès : empêcher la lecture/édition d'une fiche utilisateur d'autrui ===
+        if ($ref_table === 'users' && !can_access_user_page($ref_id)) {
+            set_top_msg(lng_min("Permission denied"), 'error');
+            set_log('Security', "Unauthorized user page access by user "
+            . $this->session->userdata('user_id') . " on $operation_name/$ref_id");
+            redirect('home');
+            return;
+        }
         // todo correction gestion des utilisateurs
         //if(admin_config($ref_table))
         //$data['left_menu_admin']=True;

relis_app/controllers/Op.php

@@ -122,21 +122,76 @@ private function zget_reference_select_values($config, $start_with_empty = True,
 		return $result;
 	}
 
-	//remove a picture associated with a specific element in a table
-	public function remove_picture($ref_table, $table_name, $table_id, $field, $element_id)
-	{
-		$table_name = mysql_real_escape_string($table_name);
-		$table_id = mysql_real_escape_string($table_id);
-		$field = mysql_real_escape_string($field);
-		$element_id = mysql_real_escape_string($element_id);
-		$sql = "UPDATE $table_name SET $field = NULL WHERE $table_id ='" . $element_id . "'";
-		$res = $this->manage_mdl->run_query($sql, False, 'default');
-		if ($res) {
-			set_top_msg(lng_min("Success - picture removed"));
-		} else {
-			set_top_msg(lng_min(" Operation failed "), 'error');
-		}
+//remove a picture associated with a specific element in a table
+public function remove_picture($ref_table, $table_name, $table_id, $field, $element_id)
+{
+    $current_user_id = $this->session->userdata('user_id');
+    if (empty($current_user_id)) {
+        set_top_msg(lng_min("You must be logged in"), 'error');
+        redirect('user/login');
+        return;
+    }
+
+    if (!ctype_digit((string)$element_id) || (int)$element_id <= 0) {
+        set_top_msg(lng_min("Invalid element id"), 'error');
+        redirect('home');
+        return;
+    }
+    $element_id = (int)$element_id;
+
+    $is_admin = has_usergroup(1, $current_user_id);
+    $authorized = false;
+
+    if ($table_name === 'users') {
+        if ($is_admin || $current_user_id == $element_id) {
+            $authorized = true;
+        }
+    } elseif ($table_name === 'projects') {
+        if ($is_admin || has_user_role('Project admin', $current_user_id, $element_id)) {
+            $authorized = true;
+        }
+    } else {
+        if ($is_admin) {
+            $authorized = true;
+        }
+    }
+
+    if (!$authorized) {
+        set_top_msg(lng_min("Permission denied"), 'error');
+        set_log('Security', "Unauthorized picture removal attempt by user $current_user_id on $table_name #$element_id");
+        redirect('home');
+        return;
+    }
+
+    $table_name = $this->db->escape_str($table_name);
+    $table_id = $this->db->escape_str($table_id);
+    $field = $this->db->escape_str($field);
+
+    $sql = "UPDATE $table_name SET $field = NULL WHERE $table_id = '" . $element_id . "'";
+    $res = $this->manage_mdl->run_query($sql, False, 'default');
+
+    if ($res) {
+        set_top_msg(lng_min("Success - picture removed"));
+    } else {
+        set_top_msg(lng_min("Operation failed"), 'error');
+    }
+
+    redirect('element/display_element/' . $ref_table . '/' . $element_id);
+}
+	//public function remove_picture($ref_table, $table_name, $table_id, $field, $element_id)
+	//{
+	//	$table_name = $this->db->escape_str($table_name);
+	//	$table_id = $this->db->escape_str($table_id);
+	//	$field = $this->db->escape_str($field);
+	//	$element_id = $this->db->escape_str($element_id);
+	//	$sql = "UPDATE $table_name SET $field = NULL WHERE $table_id ='" . $element_id . "'";
+	//	$res = $this->manage_mdl->run_query($sql, False, 'default');
+	//	if ($res) {
+	//		set_top_msg(lng_min("Success - picture removed"));
+	//	} else {
+	//		set_top_msg(lng_min(" Operation failed "), 'error');
+	//	}
 		//redirect ( 'element/display_element/' .$ref_table.'/'.$element_id  );
-		redirect('element/display_element/' . $ref_table . '/' . $element_id);
-	}
+	//	redirect('element/display_element/' . $ref_table . '/' . $element_id);
+	//}
 }

relis_app/helpers/bm_helper.php

@@ -2164,4 +2164,52 @@ function path_separator()
 	} else {
 		return '/';
 	}
-}	
+}	
+
+
+//check if the current user can access a user's page 
+function can_access_user_page($target_user_id, $user = 0)
+{
+    $ci = get_instance();
+
+    if ($user == 0) {
+        $user = $ci->session->userdata('user_id');
+    }
+
+    if (empty($user)) {
+        return FALSE;
+    }
+
+    $user = (int) $user;
+    $target_user_id = (int) $target_user_id;
+
+    if ($user == $target_user_id) {
+        return TRUE;
+    }
+
+    if (has_usergroup(1, $user)) {
+        return TRUE;
+    }
+
+    if (has_usergroup(1, $target_user_id)) {
+        return FALSE;
+    }
+
+    $sql = "SELECT 1
+            FROM userproject up_current
+            INNER JOIN userproject up_target
+                ON up_current.project_id = up_target.project_id
+            WHERE up_current.user_id = $user
+              AND up_current.user_role = 'Project admin'
+              AND up_current.userproject_active = 1
+              AND up_target.user_id = $target_user_id
+              AND up_target.userproject_active = 1
+            LIMIT 1";
+    $res = $ci->db->query($sql)->row_array();
+
+    if (!empty($res)) {
+        return TRUE;
+    }
+
+    return FALSE;
+}