Merge branch 'master' into feature-63370/AnwesenheitenMicrotuning

application/config/routes.php

@@ -116,20 +116,23 @@ $subdirs = ['application/config/extensions', 'application/config/' . ENVIRONMENT
 
 foreach($subdirs as $subdir)
 {
-	$dirlist = scandir($subdir);
-	if ($dirlist)
+	if(is_dir($subdir))
 	{
-		$files = array_diff($dirlist, array('.','..'));
-
-		foreach ($files as &$item)
+		$dirlist = scandir($subdir);
+		if ($dirlist)
 		{
-			if (is_dir($subdir . DIRECTORY_SEPARATOR . $item))
-			{
-				$routes_file = $subdir . DIRECTORY_SEPARATOR . $item . DIRECTORY_SEPARATOR . 'routes.php';
+			$files = array_diff($dirlist, array('.','..'));
 
-				if (file_exists($routes_file))
+			foreach ($files as &$item)
+			{
+				if (is_dir($subdir . DIRECTORY_SEPARATOR . $item))
 				{
-					require($routes_file);
+					$routes_file = $subdir . DIRECTORY_SEPARATOR . $item . DIRECTORY_SEPARATOR . 'routes.php';
+
+					if (file_exists($routes_file))
+					{
+						require($routes_file);
+					}
 				}
 			}
 		}

application/controllers/Cis/Auth.php

@@ -72,6 +72,7 @@ class Auth extends FHC_Controller
 	{
 		$this->load->library('AuthLib');
 		$this->authlib->logout();
-		redirect('/Cis/Auth/login', 'refresh');
+		setcookie('fhclogout', 'fhclogout', 0, '/');
+		redirect(base_url('/cis/private/logout.php'), 'refresh');
 	}
 }

application/controllers/api/frontend/v1/RouteInfo.php

@@ -0,0 +1,60 @@
+<?php
+
+/**
+ * Copyright (C) 2024 fhcomplete.org
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+if (!defined('BASEPATH'))
+	exit('No direct script access allowed');
+
+class RouteInfo extends FHCAPI_Controller
+{
+
+	public function __construct()
+	{
+		parent::__construct([
+			'info' => self::PERM_LOGGED,
+		]);
+
+		$this->load->model('system/Webservicelog_model', 'WebservicelogModel');
+	}
+
+	public function info()
+	{
+		$payload = json_decode($this->input->raw_input_stream);
+
+		if (isset($payload->app) && isset($payload->path) && $this->isValidApp($payload->app) && $this->isValidPath($payload->path))
+		{
+			$this->WebservicelogModel->insert(array(
+				'webservicetyp_kurzbz' => 'content',
+				'beschreibung' => $payload->app,
+				'request_data' => $payload->path,
+				'execute_user' => getAuthUID(),
+				'execute_time' => 'NOW()'
+			));
+		}
+		$this->terminateWithSuccess(true);
+	}
+
+	protected function isValidApp($app)
+	{
+		return preg_match("/^[A-Za-z0-9\-_]+$/", $app);
+	}
+
+	protected function isValidPath($path)
+	{
+		return preg_match("/^[\/A-Za-z0-9_.\-~?%=&;]+$/", $path);
+	}
+}

application/controllers/api/frontend/v1/Searchbar.php

@@ -39,6 +39,8 @@ class Searchbar extends FHCAPI_Controller
 			'searchCis' => self::PERM_LOGGED,
 			'searchStv' => self::PERM_LOGGED
 		]);
+
+		$this->load->model('system/Webservicelog_model', 'WebservicelogModel');
 	}
 
 	//------------------------------------------------------------------------------------------------------------------
@@ -103,6 +105,17 @@ class Searchbar extends FHCAPI_Controller
 		// Convert to json the result from searchlib->search
 		$result = $this->searchlib->search($this->input->post(self::SEARCHSTR_PARAM), $this->input->post(self::TYPES_PARAM));
 
+		$this->WebservicelogModel->insert(array(
+			'webservicetyp_kurzbz' => 'content',
+			'beschreibung' => $config['config'],
+			'request_data' => json_encode(array(
+				self::SEARCHSTR_PARAM => $this->input->post(self::SEARCHSTR_PARAM),
+				self::TYPES_PARAM => $this->input->post(self::TYPES_PARAM)
+			)),
+			'execute_user' => getAuthUID(),
+			'execute_time' => 'NOW()'
+		));
+
 		$data = $this->getDataOrTerminateWithError($result);
 
 		$this->addMeta('time', $result->meta['time']);

application/controllers/api/frontend/v1/stv/Student.php

@@ -254,7 +254,6 @@ class Student extends FHCAPI_Controller
 			'gebdatum',
 			'gebort',
 			'geburtsnation',
-			'svnr',
 			'ersatzkennzeichen',
 			'staatsbuergerschaft',
 			'matr_nr',

application/controllers/api/frontend/v1/stv/Students.php

@@ -761,7 +761,6 @@ class Students extends FHCAPI_Controller
 		$this->PrestudentModel->addSelect('wahlname');
 		$this->PrestudentModel->addSelect('vornamen');
 		$this->PrestudentModel->addSelect('titelpost');
-		$this->PrestudentModel->addSelect('svnr');
 		$this->PrestudentModel->addSelect('ersatzkennzeichen');
 		$this->PrestudentModel->addSelect('gebdatum');
 		$this->PrestudentModel->addSelect('geschlecht');

application/controllers/codex/UHSTAT1.php

@@ -11,6 +11,7 @@ class UHSTAT1 extends FHC_Controller
 	const CODEX_UNKNOWN_YEAR = 9999;
 	const CODEX_UNKNOWN_NATION = 'XXX';
 	const CODEX_UNKNOWN_BILDUNGMAX = 999;
+	const CODEX_EXCLUDED_NATIONS = ['ZZZ'];
 	const LOWER_BOUNDARY_YEARS = 160;
 	const UPPER_BOUNDARY_YEARS = 20;
 
@@ -32,8 +33,7 @@ class UHSTAT1 extends FHC_Controller
 		$this->load->library('PermissionLib');
 
 		// load models
-		$this->load->model('codex/Oehbeitrag_model', 'OehbeitragModel');
-		$this->load->model('organisation/Studiensemester_model', 'StudiensemesterModel');
+		$this->load->model('person/Benutzer_model', 'BenutzerModel');
 		$this->load->model('system/Sprache_model', 'SpracheModel');
 		$this->load->model('codex/Abschluss_model', 'AbschlussModel');
 		$this->load->model('codex/Uhstat1daten_model', 'Uhstat1datenModel');
@@ -104,7 +104,7 @@ class UHSTAT1 extends FHC_Controller
 	{
 		$saved = false;
 
-		$person_id = $this->_getValidPersonId('sui');
+		$person_id = $this->_getUHSTATPersonId('sui');
 
 		$this->form_validation->set_error_delimiters('<span class="text-danger">', '</span>');
 
@@ -245,7 +245,7 @@ class UHSTAT1 extends FHC_Controller
 		// uhstat data can only be deleted with permission
 		if (!$this->_checkPermission('suid')) show_error('no permission');
 
-		$person_id = $this->_getValidPersonId('suid');
+		$person_id = $this->_getUHSTATPersonId('suid');
 
 		$uhstat1datenRes = $this->Uhstat1datenModel->delete(
 			array('person_id' => $person_id)
@@ -287,13 +287,17 @@ class UHSTAT1 extends FHC_Controller
 	 */
 	private function _getFormMetaData()
 	{
-		$person_id = $this->_getValidPersonId('s');
+		$person_id = $this->_getUHSTATPersonId('s');
 
 		// read only display param
 		$readOnly = $this->input->get('readOnly');
 
-		// depending on permissions, editing or deleting is possible
-		$editPermission = $this->_checkPermission('sui');
+		// checking permissions for form
+
+		// saving is possible if there permission or student log in (but not from application tool)
+		$savePermission = $this->_checkPermission('sui') || ($this->_getUserPersonId() && !$this->_getApplicationToolPersonId());
+
+		// deleting only possible with permission
 		$deletePermission = $this->_checkPermission('suid');
 
 		$languageIdx = $this->_getLanguageIndex();
@@ -304,7 +308,7 @@ class UHSTAT1 extends FHC_Controller
 			'abschluss_nicht_oesterreich' => array(),
 			'jahre' => array(),
 			'person_id' => $person_id,
-			'editPermission' => $editPermission,
+			'savePermission' => $savePermission,
 			'deletePermission' => $deletePermission,
 			'readOnly' => $readOnly
 		);
@@ -336,15 +340,19 @@ class UHSTAT1 extends FHC_Controller
 
 		if (hasData($nationRes))
 		{
+			$dropdownNations = [];
 			$nations = getData($nationRes);
 
-			// put austria in beginning of selection
 			foreach ($nations as $nation)
 			{
-				if ($nation->nation_code == self::CODEX_OESTERREICH) array_unshift($nations, $nation);
+				// put austria in beginning of selection
+				if ($nation->nation_code == self::CODEX_OESTERREICH)
+					array_unshift($dropdownNations, $nation);
+				elseif (!in_array($nation->nation_code, self::CODEX_EXCLUDED_NATIONS)) // add nation if not excluded
+					$dropdownNations[] = $nation;
 			}
 
-			$formMetaData['nation'] = $nations;
+			$formMetaData['nation'] = $dropdownNations;
 		}
 
 		// get abschluss list
@@ -386,7 +394,7 @@ class UHSTAT1 extends FHC_Controller
 	 */
 	private function _getUHSTAT1Data()
 	{
-		$person_id = $this->_getValidPersonId('s');
+		$person_id = $this->_getUHSTATPersonId('s');
 
 		$this->Uhstat1datenModel->addSelect(
 			implode(', ', array_keys($this->_uhstat1Fields))
@@ -417,29 +425,70 @@ class UHSTAT1 extends FHC_Controller
 	}
 
 	/**
-	 * Gets Id of person having permissions to manage UHSTAT1 data.
-	 * Can be passed as parameter or be in session.
+	 * Gets Id of person, for which UHSTAT1 data is edited.
+	 * Can be passed as parameter, id of logged in person, or be in session.
+	 * @param berechtigungsArt type of permission (suid)
 	 * @return int person_id
 	 */
-	private function _getValidPersonId($berechtigungsArt)
+	private function _getUHSTATPersonId($berechtigungsArt)
 	{
 		// if coming from bewerbungstool - person id is in session (person must be logged in bewerbungstool)
+		$applicationToolPersonId = $this->_getApplicationToolPersonId();
+		if (isset($applicationToolPersonId) && is_numeric($applicationToolPersonId)) return $applicationToolPersonId;
+
+		// if successfully logged in
+		$loggedInPersonId = $this->_getUserPersonId();
+		if (isset($loggedInPersonId) && is_numeric($loggedInPersonId))
+		{
+			// if person id passed directly...
+			$person_id = $this->input->post('person_id');
+			if (!isset($person_id)) $person_id = $this->input->get('person_id');
+
+			if (isset($person_id))
+			{
+				if (!is_numeric($person_id)) show_error("invalid person id");
+				// ...check if there is a permission for editing UHSTAT1 data
+				if ($this->_checkPermission($berechtigungsArt)) return $person_id;
+			}
+
+			// if no id passed, use logged in person id
+			return $loggedInPersonId;
+		}
+
+		show_error("No permission");
+	}
+
+	/**
+	 * Gets person Id if there is a application tool login.
+	 * @return person Id or null
+	 */
+	private function _getApplicationToolPersonId()
+	{
+		// if coming from aplication tool - person id is in session (person must be logged in bewerbungstool)
 		if (isset($_SESSION[self::PERSON_ID_SESSION_INDEX])
 			&& is_numeric($_SESSION[self::PERSON_ID_SESSION_INDEX])
 			&& isset($_SESSION[self::LOGIN_SESSION_INDEX])
 		)
 			return $_SESSION[self::PERSON_ID_SESSION_INDEX];
 
-		// if person id passed directly...
-		$person_id = $this->input->post('person_id');
-		if (!isset($person_id)) $person_id = $this->input->get('person_id');
+		return null;
+	}
 
-		if (!isset($person_id) || !is_numeric($person_id)) show_error("invalid person id");
-
-		// ...check if there is a permission for editing UHSTAT1 data
-		if ($this->_checkPermission($berechtigungsArt)) return $person_id;
-
-		show_error("No permission");
+	/**
+	 * Gets person Id if there is a user login.
+	 * @return person Id or null
+	 */
+	private function _getUserPersonId()
+	{
+		$loggedInPersonId = getAuthPersonId();
+		if (isset($loggedInPersonId) && is_numeric($loggedInPersonId))
+		{
+			// check if the the user is a student and if the benutzer is active
+			$this->BenutzerModel->addSelect('1');
+			$res = $this->BenutzerModel->loadWhere(["public.tbl_benutzer.person_id" => $loggedInPersonId, "public.tbl_benutzer.aktiv" => TRUE]);
+			if (hasData($res)) return $loggedInPersonId;
+		}
+		return null;
 	}
 
 	/**

application/views/codex/uhstat1.php

@@ -26,7 +26,7 @@ $vater_bildungsstaat = isset($uhstatData->vater_bildungsstaat) ? $uhstatData->va
 $vater_bildungmax = isset($uhstatData->vater_bildungmax) ? $uhstatData->vater_bildungmax : set_value('vater_bildungmax');
 $readOnly = isset($formMetaData['readOnly']);
 $disabled = $readOnly ? ' disabled' : '';
-$editPermission = isset($formMetaData['editPermission']) && $formMetaData['editPermission'] === true;
+$savePermission = isset($formMetaData['savePermission']) && $formMetaData['savePermission'] === true;
 $deletePermission = isset($formMetaData['deletePermission']) && $formMetaData['deletePermission'] === true;
 $saved = isset($saved) && $saved === true;
 ?>
@@ -51,7 +51,7 @@ $saved = isset($saved) && $saved === true;
 			<?php echo $this->p->t('uhstat', 'uhstat1EinleitungSvnrtext') ?>
 		</p>
 		<br>
-		<?php if ($editPermission): ?>
+		<?php if ($savePermission): ?>
 			<?php if (isset($successMessage) && !isEmptyString($successMessage)): ?>
 				<div class="alert alert-success" id="uhstat_success_alert">
 					<button type="button" class="close" data-dismiss="alert">x</button>
@@ -288,7 +288,7 @@ $saved = isset($saved) && $saved === true;
 					</div>
 				</div>
 			</fieldset>
-			<?php if ($editPermission && !$readOnly): ?>
+			<?php if ($savePermission && !$readOnly): ?>
 				<br>
 				<fieldset>
 					<div class="form-group">