diff --git a/.bzrignore b/.bzrignore index 7b1ec8ca..168db902 100644 --- a/.bzrignore +++ b/.bzrignore @@ -1 +1,5 @@ no vars +./config.inc.local.php +./.htaccess +./admin/.htaccess +./include/limesurvey/admin/.htaccess diff --git a/.htaccess.example b/.htaccess.example deleted file mode 100644 index 6351c87a..00000000 --- a/.htaccess.example +++ /dev/null @@ -1,5 +0,0 @@ -AuthType Basic -AuthName "queXS CATI: Authentication Required" -AuthUserFile /var/opt/quexs/htpasswd -AuthGroupFile /var/opt/quexs/htgroup -require group interviewers diff --git a/CHANGELOG b/CHANGELOG index 7528fb92..9e138199 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,12 +1,82 @@ -required DB updates: - -ALTER TABLE `outcome` ADD `deflt` TINYINT(1) UNSIGNED NOT NULL DEFAULT '1' COMMENT 'Used as default for questionnaire outcomes' AFTER `calc`, ADD `const` TINYINT(1) UNSIGNED NOT NULL COMMENT 'Permanent outcome, used for all questionnaires, not possible to de-select' AFTER `deflt`; - -UPDATE `outcome` SET `const` = '1' WHERE `outcome`.`outcome_id` IN (1,2,3,7,9,10,14,17,18,19,30,31) ; - -ALTER TABLE `questionnaire` ADD `outcomes` VARCHAR(256) NULL DEFAULT '1,2,3,7,10' COMMENT 'coma-separated string of outcomes defined for the questionnaire' AFTER `enabled`; +queXS 1.14.0 - Changes since 1.13.1 +Changes for session authentication: + +queXS now uses the Limesurvey session based authentication system to authenticate all users. +Sessions are stored in the lime_sessions table and are managed by adodb. + +If this is a fresh install - you can ignore the notes below. Otherwise - please read through +the following for converting from directory based authentication to session based authentication. + +File changes for session authentication: + +If you have used the example .htaccess files or created your own, and you want to move to purely +session based authentication, you can remove these files. They are typcially at these locations: + +.htaccess +client/.htaccess +admin/.htaccess +include/limesurvey/.htaccess +include/limesurvey/admin/.htaccess + +This will remove restrictions for access via directory based authentication and rely solely on session authentication. + +Database changes for session authentication: + +These queries will: +1. Make the first queXS user an admin user, and assign them the password "password" +2. Make all other users regular users, and assign them the password "password" +3. Make all clients regular clients, and assign them the password "password" + +Once you have run these - please go to the operator management page and update passwords for all users. + +/* Make the first user the admin user - with default password of: password */ +INSERT INTO `lime_users` (`users_name`, `password`, `full_name`, `parent_id`, `lang`, `superadmin`) +SELECT username, '0x35653838343839386461323830343731353164306535366638646336323932373733363033643064366161626264643632613131656637323164313534326438', firstName, 0, 'auto', 1 +FROM operator +WHERE operator_id = 1; + +/* Make all other users operators - with default password of: password */ +INSERT INTO `lime_users` (`users_name`, `password`, `full_name`, `parent_id`, `lang`, `superadmin`) +SELECT username, '0x35653838343839386461323830343731353164306535366638646336323932373733363033643064366161626264643632613131656637323164313534326438', firstName, 1, 'auto', 0 +FROM operator +WHERE operator_id != 1; + +/* Make all clients - with default password of: password */ +INSERT INTO `lime_users` (`users_name`, `password`, `full_name`, `parent_id`, `lang`, `superadmin`) +SELECT username, '0x35653838343839386461323830343731353164306535366638646336323932373733363033643064366161626264643632613131656637323164313534326438', firstName, 1, 'auto', 0 +FROM client +WHERE 1; + +/* Remove redundant table */ +DROP TABLE `sessions2`; + + +queXS 1.13.1 - Changes since 1.13.0 + +Fixed Bug: Remove references to old DEFAULT_TIME_ZONE config constant (use get_settings instead) +Fixed Bug: lp:1480880 - disable create new questionnaire if no active Limesurvey available +Fixed Bug: Update FreePBX compatability to 2.11 / Make IAX extensions start from 1000 +Fixed Bug: Checkbox group selection and HTML errors in operator / skills / assignment pages +Fixed Bug: Max call attempts should be temporary outcome as value can change +Fixed Bug: Fix sample import given new database structure (sample_var table) +Fixed Bug: lp:1408870 Add "Maximum attempts reached" as an outcome +Fixed Bug: PHP notices when using call history + +New Feature: Pre-generation of cases and copying of sample variables to Limesurvey attributes for "Web First" then CATI methodology + +Updated translations from Launchpad - Thank you! + +Database updates required: + +/* Fix max attempt outcomes */ + +DELETE FROM `outcome` WHERE outcome_id IN (42,43,44,45); +INSERT INTO `outcome` (`outcome_id`, `aapor_id`, `description`, `default_delay_minutes`, `outcome_type_id`, `tryanother`, `contacted`, `tryagain`, `eligible`, `require_note`, `calc`) VALUES(42, '3.90', 'Max call attempts reached (Unknown eligibility)', 0, 1, 0, 1, 1, 0, 0, 'UH'); +INSERT INTO `outcome` (`outcome_id`, `aapor_id`, `description`, `default_delay_minutes`, `outcome_type_id`, `tryanother`, `contacted`, `tryagain`, `eligible`, `require_note`, `calc`) VALUES(43, '3.90', 'Max calls reached (Unknown eligibility)', 0, 1, 0, 1, 1, 0, 0, 'UH'); +INSERT INTO `outcome` (`outcome_id`, `aapor_id`, `description`, `default_delay_minutes`, `outcome_type_id`, `tryanother`, `contacted`, `tryagain`, `eligible`, `require_note`, `calc`) VALUES(44, '2.30', 'Max call attempts reached (Eligible)', 0, 1, 0, 1, 1, 1, 0, 'O'); +INSERT INTO `outcome` (`outcome_id`, `aapor_id`, `description`, `default_delay_minutes`, `outcome_type_id`, `tryanother`, `contacted`, `tryagain`, `eligible`, `require_note`, `calc`) VALUES(45, '2.30', 'Max calls reached (Eligible)', 0, 1, 0, 1, 1, 1, 0, 'O'); queXS 1.13.0 - Changes since 1.12.1 diff --git a/DB update CHANGELOG b/DB update CHANGELOG new file mode 100644 index 00000000..7092e214 --- /dev/null +++ b/DB update CHANGELOG @@ -0,0 +1,15 @@ +required DB updates: + +ALTER TABLE `outcome` ADD `deflt` TINYINT(1) UNSIGNED NOT NULL DEFAULT '1' COMMENT 'Used as default for questionnaire outcomes' AFTER `calc`, ADD `const` TINYINT(1) UNSIGNED NOT NULL COMMENT 'Permanent outcome, used for all questionnaires, not possible to de-select' AFTER `deflt`; + +UPDATE `outcome` SET `const` = '1' WHERE `outcome`.`outcome_id` IN (1,2,3,7,9,10,14,17,18,19,30,31) ; + +ALTER TABLE `questionnaire` ADD `outcomes` VARCHAR(256) NULL DEFAULT '1,2,3,7,10' COMMENT 'coma-separated string of outcomes defined for the questionnaire' AFTER `enabled`; + + + +queXS 1.13.0 - Changes since 1.12.1 +--- + + + diff --git a/admin/.htaccess.example b/admin/.htaccess.example deleted file mode 100644 index 416f0f13..00000000 --- a/admin/.htaccess.example +++ /dev/null @@ -1,5 +0,0 @@ -AuthType Basic -AuthName "queXS CATI: Authentication Required" -AuthUserFile /var/opt/quexs/htpasswd -AuthGroupFile /var/opt/quexs/htgroup -require group admin diff --git a/admin/addshift.php b/admin/addshift.php index ffed2451..271e90fc 100644 --- a/admin/addshift.php +++ b/admin/addshift.php @@ -39,6 +39,11 @@ include ("../config.inc.php"); */ include ("../db.inc.php"); +/** + * Authentication + */ +include ("auth-admin.php"); + /** * XHTML functions */ diff --git a/admin/assignsample.php b/admin/assignsample.php index 61c563a0..d4522b5a 100644 --- a/admin/assignsample.php +++ b/admin/assignsample.php @@ -40,6 +40,11 @@ include("../config.inc.php"); */ include ("../db.inc.php"); +/** + * Authentication + */ +include ("auth-admin.php"); + /** * XHTML functions */ diff --git a/admin/assigntimeslots.php b/admin/assigntimeslots.php index 1e92ec99..ff191027 100644 --- a/admin/assigntimeslots.php +++ b/admin/assigntimeslots.php @@ -40,6 +40,11 @@ include("../config.inc.php"); */ include ("../db.inc.php"); +/** + * Authentication + */ +include ("auth-admin.php"); + /** * XHTML functions */ diff --git a/admin/auth-admin.php b/admin/auth-admin.php new file mode 100644 index 00000000..b650c000 --- /dev/null +++ b/admin/auth-admin.php @@ -0,0 +1,70 @@ + + * @copyright Australian Consortium for Social and Political Research Incorporated (ACSPRI) 2013 + * @package queXS + * @subpackage user + * @link http://www.acspri.org.au/ queXS was writen for ACSPRI + * @license http://opensource.org/licenses/gpl-2.0.php The GNU General Public License (GPL) Version 2 + * + */ + +/** + * Configuration file + */ +include_once(dirname(__FILE__) . "/../config.inc.php"); + +/** + * Database file + */ +include_once(dirname(__FILE__) . "/../db.inc.php"); + + +//get session name from DB +// +$sql = "SELECT stg_value + FROM " . LIME_PREFIX . "settings_global + WHERE stg_name = 'SessionName'"; + +session_name($db->GetOne($sql)); + +session_start(); + +//check if the session exists or loginID not set +if (session_id() == "" || !isset($_SESSION['loginID'])) +{ + //need to log in + header('Location: ../include/limesurvey/admin/admin.php'); + die(); +} + +if ($_SESSION['USER_RIGHT_SUPERADMIN'] != 1) +{ + include_once(dirname(__FILE__) . "/../lang.inc.php"); + include_once(dirname(__FILE__) . "/../functions/functions.xhtml.php"); + xhtml_head(); + print "
" . T_("You do not have permission to access this area") . "
"; + print ""; + xhtml_foot(); + die(); +} diff --git a/admin/availability.php b/admin/availability.php index 892d438a..0808e9bf 100644 --- a/admin/availability.php +++ b/admin/availability.php @@ -39,6 +39,12 @@ include ("../config.inc.php"); */ include ("../db.inc.php"); +/** + * Authentication file + */ +include ("auth-admin.php"); + + /** * XHTML functions */ diff --git a/admin/availabilitygroup.php b/admin/availabilitygroup.php index 4b7db070..2029f348 100644 --- a/admin/availabilitygroup.php +++ b/admin/availabilitygroup.php @@ -40,6 +40,11 @@ include("../config.inc.php"); */ include ("../db.inc.php"); +/** + * Authentication file + */ +include ("auth-admin.php"); + /** * XHTML functions */ diff --git a/admin/bulkappointment.php b/admin/bulkappointment.php index 567bc8f6..e3afc406 100644 --- a/admin/bulkappointment.php +++ b/admin/bulkappointment.php @@ -44,6 +44,11 @@ include ("../functions/functions.xhtml.php"); */ include ("../db.inc.php"); +/** + * Authentication file + */ +include ("auth-admin.php"); + /** * Operator functions */ diff --git a/admin/callhistory.php b/admin/callhistory.php index 49fce497..102e3cca 100644 --- a/admin/callhistory.php +++ b/admin/callhistory.php @@ -39,6 +39,11 @@ include ("../config.inc.php"); */ include ("../db.inc.php"); +/** + * Authentication file + */ +include ("auth-admin.php"); + /** * XHTML functions */ @@ -100,18 +105,21 @@ if ($operator_id) if (!isset($_GET['csv'])) $sql .= " LIMIT 500"; - else $sql .= " LIMIT 5000"; +// else $sql .= " LIMIT 5000"; no limit when using CSV $rs = $db->Execute($sql); if (empty($rs)) { + xhtml_head(T_("Call History List"),true,$css,$js_head); print "" . T_("No calls ever made") . "