Upgrades from IceHrm Pro v24

core/src/Classes/AbstractModuleManager.php

@@ -166,7 +166,6 @@ abstract class AbstractModuleManager
 
         $data = $this->getDashboardItemData();
         $data['moduleLink'] = $this->getModuleLink();
-        LogManager::getInstance()->info("Module Link:".$data['moduleLink']);
         foreach ($data as $k => $v) {
             $dashboardItem = str_replace("#_".$k."_#", $v, $dashboardItem);
         }

core/src/Classes/BaseService.php

@@ -121,7 +121,7 @@ class BaseService
         $nsTable = $this->getFullQualifiedModelClassName($table);
         $obj = new $nsTable();
 
-        $this->checkSecureAccess("get", $obj);
+        $this->checkSecureAccess("get", $obj, $table, $_REQUEST);
 
         $query = "";
         $queryData = array();
@@ -294,7 +294,7 @@ class BaseService
         }
         $nsTable = $this->getFullQualifiedModelClassName($table);
         $obj = new $nsTable();
-        $this->checkSecureAccess("get", $obj);
+        $this->checkSecureAccess("get", $obj, $table, $_REQUEST);
         $query = "";
         $queryData = array();
         if (!empty($filterStr)) {
@@ -620,42 +620,17 @@ class BaseService
         }
 
         if (!$skipSecurityCheck) {
-            $this->checkSecureAccess("element", $obj);
+            $this->checkSecureAccess("element", $obj, $table, $_POST);
         }
 
-        if (!empty($mappingStr)) {
-            $map = json_decode($mappingStr);
-        }
         if ($obj->id == $id) {
             if (!empty($mappingStr)) {
-                foreach ($map as $k => $v) {
-                    $fTable = $this->getFullQualifiedModelClassName($v[0]);
-                    $tObj = new $fTable();
-                    $tObj->Load($v[1]."= ?", array($obj->$k));
-                    if ($tObj->{$v[1]} == $obj->$k) {
-                        $name = $k."_Name";
-                        $values = explode("+", $v[2]);
-                        if (count($values) == 1) {
-                            $obj->$name = $tObj->{$v[2]};
-                        } else {
-                            $objVal = "";
-                            foreach ($values as $v) {
-                                if ($objVal != "") {
-                                    $objVal .= " ";
-                                }
-                                $objVal .= $tObj->$v;
-                            }
-                            $obj->$name = $objVal;
-                        }
-                    }
-                }
+                $map = json_decode($mappingStr);
+                $obj = $this->enrichObjectMappings($map, $obj);
             }
 
             //Add custom fields
-            $customFields = $this->customFieldManager->getCustomFields($table, $obj->id);
-            foreach ($customFields as $cf) {
-                $obj->{$cf->name} = $cf->value;
-            }
+            $obj = $this->enrichObjectCustomFields($table, $obj);
 
             $obj = $obj->postProcessGetElement($obj);
             return  $this->cleanUpAdoDB($obj->postProcessGetData($obj));
@@ -663,6 +638,28 @@ class BaseService
         return null;
     }
 
+    /**
+     * @param $nameField
+     * @param $targetObject
+     * @return string
+     */
+    private function getCombinedValue($nameField, $targetObject)
+    {
+        $values = explode("+", $nameField);
+        if (count($values) == 1) {
+            return $targetObject->{$nameField};
+        }
+        $objVal = "";
+        foreach ($values as $value) {
+            if ($objVal != "") {
+                $objVal .= " ";
+            }
+            $objVal .= $targetObject->$value;
+        }
+
+        return $objVal;
+    }
+
     /**
      * Add an element to a given table
      * @method addElement
@@ -674,11 +671,20 @@ class BaseService
 
     public function addElement($table, $obj)
     {
+
         $customFields = array();
         $isAdd = true;
         $nsTable = $this->getFullQualifiedModelClassName($table);
         $ele = new $nsTable();
-        //LogManager::getInstance()->error("Obj:".json_encode($obj));
+
+
+        if ($ele->validateCSRF()
+            && (empty($obj->csrf) || $obj->csrf !== SessionUtils::getSessionObject('csrf-'.$table))) {
+            return new IceResponse(
+                IceResponse::ERROR,
+                "CSRF Error"
+            );
+        }
 
         if (class_exists("\\Classes\\ProVersion")) {
             $pro = new ProVersion();
@@ -722,7 +728,7 @@ class BaseService
             }
         }
 
-        $this->checkSecureAccess("save", $ele);
+        $this->checkSecureAccess("save", $ele, $table, $_POST);
 
         $resp = $ele->validateSave($ele);
         if ($resp->getStatus() != IceResponse::SUCCESS) {
@@ -812,7 +818,7 @@ class BaseService
             return $preDeleteResponse;
         }
 
-        $this->checkSecureAccess("delete", $ele);
+        $this->checkSecureAccess("delete", $ele, $table, $_POST);
 
         if (isset($this->nonDeletables[$table])) {
             $nonDeletableTable = $this->nonDeletables[$table];
@@ -898,10 +904,9 @@ class BaseService
         $ret = array();
         $nsTable = $this->getFullQualifiedModelClassName($table);
         $ele = new $nsTable();
+        $this->checkSecureAccess("get", $ele, $table, $_POST);
         if (!empty($method)) {
-            LogManager::getInstance()->debug("Call method for getFieldValues:".$method);
-            LogManager::getInstance()->debug("Call method params for getFieldValues:".json_decode($methodParams));
-            if (method_exists($ele, $method)) {
+            if (method_exists($ele, $method) && in_array($method, $ele->fieldValueMethods())) {
                 if (!empty($methodParams)) {
                     $list = $ele->$method(json_decode($methodParams));
                 } else {
@@ -1026,6 +1031,17 @@ class BaseService
         return $user->$signInMappingField;
     }
 
+    /**
+     * Check if the current user has switched into another user
+     * @method isEmployeeSwitched
+     * @return {Boolean}
+     */
+    public function isEmployeeSwitched()
+    {
+        $adminEmpId = SessionUtils::getSessionObject('admin_current_profile');
+        return !empty($adminEmpId);
+    }
+
     /**
      * Get User by profile id
      * @method getUserFromProfileId
@@ -1087,83 +1103,25 @@ class BaseService
         return $this->db;
     }
 
-    public function checkSecureAccessOld($type, $object)
-    {
-
-        $accessMatrix = array();
-        if ($this->currentUser->user_level == 'Admin') {
-            $accessMatrix = $object->getAdminAccess();
-            if (in_array($type, $accessMatrix)) {
-                return true;
-            }
-        } elseif ($this->currentUser->user_level == 'Manager') {
-            $accessMatrix = $object->getManagerAccess();
-            if (in_array($type, $accessMatrix)) {
-                return true;
-            } else {
-                $accessMatrix = $object->getUserOnlyMeAccess();
-                $signInMappingField = SIGN_IN_ELEMENT_MAPPING_FIELD_NAME;
-                if (in_array($type, $accessMatrix) && $_REQUEST[$object->getUserOnlyMeAccessField()]
-                    == $this->currentUser->$signInMappingField) {
-                    return true;
-                }
-
-                if (in_array($type, $accessMatrix)) {
-                    $field = $object->getUserOnlyMeAccessField();
-                    $signInMappingField = SIGN_IN_ELEMENT_MAPPING_FIELD_NAME;
-                    if ($this->currentUser->$signInMappingField."" == $object->$field) {
-                        return true;
-                    }
-                }
-            }
-        } else {
-            $accessMatrix = $object->getUserAccess();
-            if (in_array($type, $accessMatrix)) {
-                return true;
-            } else {
-                $accessMatrix = $object->getUserOnlyMeAccess();
-                $signInMappingField = SIGN_IN_ELEMENT_MAPPING_FIELD_NAME;
-                if (in_array($type, $accessMatrix) && $_REQUEST[$object->getUserOnlyMeAccessField()]
-                    == $this->currentUser->$signInMappingField) {
-                    return true;
-                }
-
-                if (in_array($type, $accessMatrix)) {
-                    $field = $object->getUserOnlyMeAccessField();
-                    $signInMappingField = SIGN_IN_ELEMENT_MAPPING_FIELD_NAME;
-                    if ($this->currentUser->$signInMappingField."" == $object->$field) {
-                        return true;
-                    }
-                }
-            }
-        }
-
-        $ret['status'] = "ERROR";
-        $ret['message'] = "Access violation";
-        echo json_encode($ret);
-        exit();
-    }
-
     /**
      * Use user level security functions defined in model classes to check whether a given action
      * type is allowed to be executed by the current user on a given object
      * @method checkSecureAccess
      * @param $type {String} Action type
      * @param $object {Object} object to test access
-     * @return {Boolen} true or exit
+     * @param $table
+     * @param $request
+     * @return bool {Boolen} true or exit true or exit
      */
 
-    public function checkSecureAccess($type, $object)
+    public function checkSecureAccess($type, $object, $table, $request)
     {
-
-        if (!empty($this->currentUser->user_roles)) {
-            return true;
-        }
-
         $accessMatrix = array();
 
         //Construct permission method
         $permMethod = "get".$this->currentUser->user_level."Access";
+        $userOnlyMeAccessRequestField = $object->getUserOnlyMeAccessRequestField();
+        $userOnlyMeAccessField = $object->getUserOnlyMeAccessField();
         if (method_exists($object, $permMethod)) {
             $accessMatrix = $object->$permMethod();
         } else {
@@ -1173,32 +1131,36 @@ class BaseService
         if (in_array($type, $accessMatrix)) {
             //The user has required permission, so return true
             return true;
-        } else {
+        } else if (!empty($this->currentUser->$userOnlyMeAccessField)){
             //Now we need to check whther the user has access to his own records
-            $accessMatrix = $object->getUserOnlyMeAccess();
+            if ($this->isEmployeeSwitched()) {
+                $accessMatrix = $object->getUserOnlyMeSwitchedAccess();
+            } else {
+                $accessMatrix = $object->getUserOnlyMeAccess();
+            }
 
-            $userOnlyMeAccessRequestField = $object->getUserOnlyMeAccessRequestField();
 
             //This will check whether user can access his own records using a value in request
-            if (isset($_REQUEST[$object->getUserOnlyMeAccessField()])
-                && isset($this->currentUser->$userOnlyMeAccessRequestField)) {
-                if (in_array($type, $accessMatrix) && $_REQUEST[$object->getUserOnlyMeAccessField()]
-                    == $this->currentUser->$userOnlyMeAccessRequestField) {
+            if (isset($request[$userOnlyMeAccessField])
+                && isset($this->currentUser->$userOnlyMeAccessField)) {
+                if (in_array($type, $accessMatrix) && $request[$userOnlyMeAccessField]
+                    === $this->currentUser->$userOnlyMeAccessRequestField) {
                     return true;
                 }
             }
 
-            //This will check whether user can access his own records using a value in requested object
-            if (in_array($type, $accessMatrix)) {
-                $field = $object->getUserOnlyMeAccessField();
-                if ($this->currentUser->$userOnlyMeAccessRequestField == $object->$field) {
+            // This will check if can query his own records
+            // Employees should be able to update their own records
+            if (!empty($table) && in_array($type, $accessMatrix)) {
+                if (!empty($this->currentUser->$userOnlyMeAccessRequestField)
+                    && in_array($table, $this->userTables) ) {
                     return true;
                 }
             }
         }
 
         $ret['status'] = "ERROR";
-        $ret['message'] = "Access violation";
+        $ret['message'] = $type." ".get_class($object)." Access violation";
         echo json_encode($ret);
         exit();
     }
@@ -1442,7 +1404,7 @@ class BaseService
 
     public function getModuleManager($type, $name)
     {
-        return $this->moduleManagers[$type."_".$name];
+        return isset($this->moduleManagers[$type."_".$name]) ? $this->moduleManagers[$type."_".$name] : null;
     }
 
     public function setEmailSender($emailSender)
@@ -1546,13 +1508,18 @@ class BaseService
         return $this->calculationHooks[$code];
     }
 
-    public function executeCalculationHook($parameters, $code = null)
+    public function executeCalculationHook($parameters, $code, $additionalData = null)
     {
         $ch = BaseService::getInstance()->getCalculationHook($code);
 
         if (empty($ch->code)) {
             return null;
         }
+
+        if (!empty($additionalData)) {
+            $parameters[] = $additionalData;
+        }
+
         $class = $ch->class;
         return call_user_func_array(array(new $class(), $ch->method), $parameters);
     }
@@ -1593,7 +1560,7 @@ END;
 
     public function getFullQualifiedModelClassName($class)
     {
-        if ($this->modelClassMap[$class]) {
+        if (isset($this->modelClassMap[$class])) {
             return $this->modelClassMap[$class];
         }
         return '\\Model\\'.$class;
@@ -1657,4 +1624,103 @@ END;
 
         return $subFound || $departmentHeadFound;
     }
+
+    /**
+     * @param $value
+     * @param int $options
+     * @param int $depth
+     * @return string
+     * @throws \Exception
+     */
+    public function safeJsonEncode($value, $options = 0, $depth = 512){
+        $encoded = json_encode($value, $options, $depth);
+        switch (json_last_error()) {
+            case JSON_ERROR_NONE:
+                return $encoded;
+            case JSON_ERROR_DEPTH:
+                throw new \Exception('Maximum stack depth exceeded');
+            case JSON_ERROR_STATE_MISMATCH:
+                throw new \Exception('Underflow or the modes mismatch');
+            case JSON_ERROR_CTRL_CHAR:
+                throw new \Exception('Unexpected control character found');
+            case JSON_ERROR_SYNTAX:
+                throw new \Exception('Syntax error, malformed JSON');
+            case JSON_ERROR_UTF8:
+                $clean = $this->utf8ize($value);
+                return $this->safeJsonEncode($clean, $options, $depth);
+            default:
+                throw new \Exception('Unknown Json parsing error');
+        }
+    }
+
+    protected function utf8ize($mixed) {
+        if (is_array($mixed)) {
+            foreach ($mixed as $key => $value) {
+                $mixed[$key] = $this->utf8ize($value);
+            }
+        } else if (is_object($mixed)) {
+            foreach ($mixed as $key => $value) {
+                $mixed->$key = $this->utf8ize($value);
+            }
+        } else if (is_string ($mixed)) {
+            return utf8_encode($mixed);
+        }
+        return $mixed;
+    }
+
+    public function generateCsrf($formId) {
+        $csrfToken = sha1(rand(4500, 100000) . time(). CLIENT_BASE_URL. $this->currentUser->id);
+        SessionUtils::saveSessionObject('csrf-'.$formId, $csrfToken);
+        return $csrfToken;
+    }
+
+    /**
+     * @param $map
+     * @param $obj
+     * @return mixed
+     */
+    public function enrichObjectMappings($map, $obj)
+    {
+        if (!empty($map)) {
+            foreach ($map as $k => $v) {
+                if (in_array($v[0], array('User', 'Setting'))) {
+                    continue;
+                }
+                $fTable = $this->getFullQualifiedModelClassName($v[0]);
+                $tObj = new $fTable();
+                $name = $k . "_Name";
+                $obj->$name = '';
+                if (isset($v[3]) && $v[3] === true) {
+                    if (!empty($obj->{$k}) && !empty(json_decode($obj->{$k}, true))) {
+                        foreach (json_decode($obj->{$k}, true) as $partialId) {
+                            if ($obj->$name != '') {
+                                $obj->$name .= ', ';
+                            }
+                            $tObj->Load($v[1] . "= ?", array($partialId));
+                            $obj->$name .= $this->getCombinedValue($v[2], $tObj);
+                        }
+                    }
+                } else {
+                    $tObj->Load($v[1] . "= ?", array($obj->$k));
+                    $obj->$name = $this->getCombinedValue($v[2], $tObj);
+                }
+            }
+        }
+        return $obj;
+    }
+
+    /**
+     * @param $table
+     * @param $obj
+     * @return mixed
+     */
+    public function enrichObjectCustomFields($table, $obj)
+    {
+        /** @var CustomFieldManager $customFields */
+        $customFields = $this->customFieldManager->getCustomFields($table, $obj->id);
+        foreach ($customFields as $cf) {
+            $obj->{$cf->name} = $cf->value;
+        }
+        return $obj;
+    }
 }

core/src/Classes/FileService.php

@@ -224,7 +224,7 @@ class FileService
         return $profile;
     }
 
-    public function getFileUrl($fileName)
+    public function getFileUrl($fileName,  $isExpiring = true)
     {
         $file = new File();
         $file->Load('name = ?', array($fileName));
@@ -244,10 +244,16 @@ class FileService
 
             $expireUrl = $this->getFromCache($fileUrl);
             if (empty($expireUrl)) {
-                $expireUrl = $s3FileSys->generateExpiringURL($fileUrl, 600);
-                $this->saveInCache($fileUrl, $expireUrl, 500);
+                if ($isExpiring) {
+                    $expireUrl = $s3FileSys->generateExpiringURL($fileUrl, 8640000);
+                    $this->saveInCache($fileUrl, $expireUrl, 8640000);
+                } else {
+                    $expireUrl = $s3FileSys->generateExpiringURL($fileUrl, 600);
+                    $this->saveInCache($fileUrl, $expireUrl, 500);
+                }
             }
 
+
             return $expireUrl;
         } else {
             return  CLIENT_BASE_URL.'data/'.$file->filename;

core/src/Classes/Migration/MigrationManager.php

@@ -87,7 +87,7 @@ class MigrationManager
 
     public function createMigration($file)
     {
-        if (file_exists($this->migrationPath . $file)) {
+        if (file_exists($this->migrationPath . $file) && !is_dir($this->migrationPath . $file)) {
             $migration = new Migration();
             $migration->file = $file;
             $parts = explode("_", $file);

core/src/Classes/UIManager.php

@@ -289,7 +289,7 @@ class UIManager
         $logoFileName = CLIENT_BASE_PATH."data/logo.png";
         $logoSettings = SettingsManager::getInstance()->getSetting("Company: Logo");
         if (!empty($logoSettings)) {
-            $logoFileName = FileService::getInstance()->getFileUrl($logoSettings);
+            $logoFileName = FileService::getInstance()->getFileUrl($logoSettings, false);
             $logoFileSet = true;
         }
 

core/src/Employees/Admin/Api/EmployeesActionManager.php

@@ -33,6 +33,9 @@ class EmployeesActionManager extends SubActionManager
     public function terminateEmployee($req)
     {
         $employee = new Employee();
+
+        $this->baseService->checkSecureAccess('delete', $employee, 'Employee', $_POST);
+
         $employee->Load("id = ?", array($req->id));
 
         if (empty($employee->id)) {
@@ -48,8 +51,6 @@ class EmployeesActionManager extends SubActionManager
         }
 
         return new IceResponse(IceResponse::SUCCESS, $employee);
-
-        //$user = BaseService::getInstance()->getUserFromProfileId($employee->id);
     }
 
     public function activateEmployee($req)
@@ -70,8 +71,6 @@ class EmployeesActionManager extends SubActionManager
         }
 
         return new IceResponse(IceResponse::SUCCESS, $employee);
-
-        //$user = BaseService::getInstance()->getUserFromProfileId($employee->id);
     }
 
     public function deleteEmployee($req)

core/src/Employees/Common/Model/Employee.php

@@ -213,5 +213,9 @@ class Employee extends BaseModel
         return $obj;
     }
 
+    public function fieldValueMethods() {
+        return ['getActiveSubordinateEmployees'];
+    }
+
     public $table = 'Employees';
 }

core/src/Employees/Common/Model/EmploymentStatus.php

@@ -24,9 +24,4 @@ class EmploymentStatus extends BaseModel
     {
         return array("get","element","save");
     }
-
-    public function getUserAccess()
-    {
-        return array();
-    }
 }

core/src/Expenses/Admin/Api/ExpensesActionManager.php

@@ -42,4 +42,14 @@ class ExpensesActionManager extends ApproveAdminActionManager
     {
         return "g=modules&n=expenses&m=module_Finance#tabEmployeeExpenseApproval";
     }
+
+    public function getLogs($req)
+    {
+        return parent::getLogs($req);
+    }
+
+    public function changeStatus($req)
+    {
+        return parent::changeStatus($req);
+    }
 }

core/src/Expenses/Common/Model/EmployeeExpense.php

@@ -33,7 +33,12 @@ class EmployeeExpense extends ApproveModel
 
     public function getManagerAccess()
     {
-        return array("get","element","save","delete");
+        if ($this->status == 'Pending') {
+
+            return array("element","save","delete");
+        }
+
+        return array("get","element","save");
     }
 
     public function getUserAccess()
@@ -43,7 +48,12 @@ class EmployeeExpense extends ApproveModel
 
     public function getUserOnlyMeAccess()
     {
-        return array("element","save","delete");
+        if ($this->status == 'Pending') {
+
+            return array("get","element","save","delete");
+        }
+
+        return array("get","element","save");
     }
 
     public function fieldsNeedToBeApproved()

core/src/Expenses/User/Api/ExpensesActionManager.php

@@ -32,4 +32,14 @@ class ExpensesActionManager extends ApproveModuleActionManager
     {
         return "g=modules&n=expenses&m=module_Finance#tabSubordinateEmployeeExpense";
     }
+
+    public function getLogs($req)
+    {
+        return parent::getLogs($req);
+    }
+
+    public function cancel($req)
+    {
+        return parent::cancel($req);
+    }
 }

core/src/FieldNames/Common/Model/CustomField.php

@@ -26,11 +26,6 @@ class CustomField extends BaseModel
         return array();
     }
 
-    public function getAnonymousAccess()
-    {
-        return array("get","element");
-    }
-
     public function validateSave($obj)
     {
         $type = BaseService::getInstance()->getFullQualifiedModelClassName($obj->type);

core/src/FieldNames/Common/Model/FieldNameMapping.php

@@ -23,9 +23,4 @@ class FieldNameMapping extends BaseModel
     {
         return array();
     }
-
-    public function getAnonymousAccess()
-    {
-        return array("get","element");
-    }
 }

core/src/Jobs/Common/Model/JobTitle.php

@@ -18,9 +18,4 @@ class JobTitle extends BaseModel
     {
         return array("get","element","save","delete");
     }
-
-    public function getUserAccess()
-    {
-        return array();
-    }
 }

core/src/Jobs/Common/Model/PayGrade.php

@@ -18,9 +18,4 @@ class PayGrade extends BaseModel
     {
         return array("get","element","save","delete");
     }
-
-    public function getUserAccess()
-    {
-        return array();
-    }
 }

core/src/Loans/Common/Model/CompanyLoan.php

@@ -18,9 +18,4 @@ class CompanyLoan extends BaseModel
     {
         return array("get","element","save","delete");
     }
-
-    public function getUserAccess()
-    {
-        return array();
-    }
 }

core/src/Metadata/Common/Model/CalculationHook.php

@@ -25,10 +25,6 @@ class CalculationHook extends BaseModel
         return array();
     }
 
-    public function getAnonymousAccess()
-    {
-        return array("get","element");
-    }
     // @codingStandardsIgnoreStart
     function Find($whereOrderBy, $bindarr = false, $pkeysArr = false, $extra = array())
     {

core/src/Metadata/Common/Model/Country.php

@@ -20,11 +20,6 @@ class Country extends BaseModel
         return array("get","element","save","delete");
     }
 
-    public function getUserAccess()
-    {
-        return array();
-    }
-
     public function getAnonymousAccess()
     {
         return array("get","element");

core/src/Metadata/Common/Model/CurrencyType.php

@@ -20,11 +20,6 @@ class CurrencyType extends BaseModel
         return array("get","element","save","delete");
     }
 
-    public function getUserAccess()
-    {
-        return array();
-    }
-
     public function getAnonymousAccess()
     {
         return array("get","element");

core/src/Metadata/Common/Model/CustomFieldValue.php

@@ -23,9 +23,4 @@ class CustomFieldValue extends BaseModel
     {
         return array("get","element","save","delete");
     }
-
-    public function getAnonymousAccess()
-    {
-        return array();
-    }
 }

core/src/Metadata/Common/Model/Nationality.php

@@ -20,11 +20,6 @@ class Nationality extends BaseModel
         return array("get","element","save","delete");
     }
 
-    public function getUserAccess()
-    {
-        return array();
-    }
-
     public function getAnonymousAccess()
     {
         return array("get","element");

core/src/Metadata/Common/Model/Province.php

@@ -19,11 +19,6 @@ class Province extends BaseModel
         return array("get", "element", "save", "delete");
     }
 
-    public function getUserAccess()
-    {
-        return array();
-    }
-
     public function getAnonymousAccess()
     {
         return array("get", "element");

core/src/Model/ApproveModel.php

@@ -38,7 +38,7 @@ abstract class ApproveModel extends BaseModel
         //Auto approve if the current user is an admin
 
         if (!empty($currentEmpId)) {
-            $employee = BaseService::getInstance()->getElement('Employee', $currentEmpId);
+            $employee = BaseService::getInstance()->getElement('Employee', $currentEmpId, null, true);
 
             if (!empty($employee->supervisor)) {
                 $notificationMsg = "A new "
@@ -131,7 +131,7 @@ abstract class ApproveModel extends BaseModel
             //Auto approve if the current user is an admin
 
             if (!empty($currentEmpId)) {
-                $employee = BaseService::getInstance()->getElement('Employee', $currentEmpId);
+                $employee = BaseService::getInstance()->getElement('Employee', $currentEmpId, null, true);
 
                 if (!empty($employee->supervisor)) {
                     $notificationMsg = $this->notificationUnitPrefix." "

core/src/Model/Audit.php

@@ -11,4 +11,14 @@ namespace Model;
 class Audit extends BaseModel
 {
     public $table = 'AuditLog';
+
+    public function getManagerAccess()
+    {
+        return array();
+    }
+
+    public function getUserAccess()
+    {
+        return array();
+    }
 }

core/src/Model/BaseModel.php

@@ -26,7 +26,7 @@ class BaseModel extends \ADOdb_Active_Record
 
     public function getOtherAccess()
     {
-        return array("get","element","save","delete");
+        return array();
     }
 
     public function getManagerAccess()
@@ -54,6 +54,11 @@ class BaseModel extends \ADOdb_Active_Record
         return array("get","element");
     }
 
+    public function getUserOnlyMeSwitchedAccess()
+    {
+        return $this->getUserOnlyMeAccess();
+    }
+
     public function getUserOnlyMeAccessField()
     {
         return "employee";
@@ -123,6 +128,14 @@ class BaseModel extends \ADOdb_Active_Record
         return get_called_class();
     }
 
+    public function fieldValueMethods() {
+        return [];
+    }
+
+    public function validateCSRF() {
+        return false;
+    }
+
     public function getObjectKeys()
     {
         $keys = array();

core/src/Model/Cron.php

@@ -11,4 +11,19 @@ namespace Model;
 class Cron extends BaseModel
 {
     public $table = 'Crons';
+
+    public function getAdminAccess()
+    {
+        return array();
+    }
+
+    public function getManagerAccess()
+    {
+        return array();
+    }
+
+    public function getUserAccess()
+    {
+        return array();
+    }
 }

core/src/Model/File.php

@@ -15,14 +15,4 @@ class File extends BaseModel
     {
         return array("get","element","save","delete");
     }
-
-    public function getUserAccess()
-    {
-        return array();
-    }
-
-    public function getAnonymousAccess()
-    {
-        return array("save");
-    }
 }

core/src/Model/Notification.php

@@ -11,4 +11,14 @@ namespace Model;
 class Notification extends BaseModel
 {
     public $table = 'Notifications';
+
+    public function getManagerAccess()
+    {
+        return array();
+    }
+
+    public function getUserAccess()
+    {
+        return array();
+    }
 }

core/src/Model/Setting.php

@@ -19,6 +19,11 @@ class Setting extends BaseModel
         return array("get","element","save","delete");
     }
 
+    public function getManagerAccess()
+    {
+        return array();
+    }
+
     public function getUserAccess()
     {
         return array();

core/src/Overtime/Admin/Api/OvertimeActionManager.php

@@ -42,4 +42,14 @@ class OvertimeActionManager extends ApproveAdminActionManager
     {
         return "g=modules&n=overtime&m=module_Time_Management#tabEmployeeOvertimeApproval";
     }
+
+    public function getLogs($req)
+    {
+        return parent::getLogs($req);
+    }
+
+    public function changeStatus($req)
+    {
+        return parent::changeStatus($req);
+    }
 }

core/src/Overtime/Common/Model/EmployeeOvertime.php

@@ -8,6 +8,7 @@
 
 namespace Overtime\Common\Model;
 
+use Classes\IceResponse;
 use Classes\SettingsManager;
 use Model\ApproveModel;
 
@@ -66,4 +67,12 @@ class EmployeeOvertime extends ApproveModel
         }
         return false;
     }
+
+    public function validateSave($obj)
+    {
+        if (strtotime($obj->start_time) >= strtotime($obj->end_time)) {
+            return new IceResponse(IceResponse::ERROR, 'Incorrect start and end time');
+        }
+        return new IceResponse(IceResponse::SUCCESS, "");
+    }
 }

core/src/Overtime/Common/Model/OvertimeCategory.php

@@ -24,11 +24,6 @@ class OvertimeCategory extends BaseModel
         return array("get","element","save","delete");
     }
 
-    public function getUserAccess()
-    {
-        return array("get");
-    }
-
     public function getUserOnlyMeAccess()
     {
         return array("get","element");

core/src/Overtime/User/Api/OvertimeActionManager.php

@@ -32,4 +32,14 @@ class OvertimeActionManager extends ApproveModuleActionManager
     {
         return "g=modules&n=overtime&m=module_Time_Management#SubordinateEmployeeOvertime";
     }
+
+    public function getLogs($req)
+    {
+        return parent::getLogs($req);
+    }
+
+    public function cancel($req)
+    {
+        return parent::cancel($req);
+    }
 }

core/src/Payroll/Admin/Api/PayrollActionManager.php

@@ -57,14 +57,12 @@ class PayrollActionManager extends SubActionManager
         if (!empty($val)) {
             return $val;
         }
-        //LogManager::getInstance()->info("calculatePayrollEmployee:".$employeeId);
-        //LogManager::getInstance()->info("calculatePayrollColumn:".json_encode($col));
 
         if (!empty($col->calculation_hook)) {
             $sum = BaseService::getInstance()->executeCalculationHook(
                 array($employeeId, $payroll->date_start, $payroll->date_end),
                 $col->calculation_hook,
-                null
+                $col->calculation_function
             );
             $val = number_format(round($sum, 2), 2, '.', '');
             $this->addToCalculationCache($col->id."-".$payroll->id."-".$employeeId, $val);
@@ -120,6 +118,8 @@ class PayrollActionManager extends SubActionManager
 
         if (!$noColumnCalculations) {
             $evalMath = new EvalMath();
+            $evalMath->evaluate('max(x,y) = (y - x) * ceil(tanh(exp(tanh(y - x)) - exp(0))) + x');
+            $evalMath->evaluate('min(x,y) = y - (y - x) * ceil(tanh(exp(tanh(y - x)) - exp(0)))');
 
             if (!empty($col->add_columns) &&
                 !empty(json_decode($col->add_columns, true))) {

core/src/Payroll/Common/Model/Payroll.php

@@ -47,4 +47,8 @@ class Payroll extends BaseModel
         $payrolls = $payroll->Find("id in (".implode(",", $payrollIds).") and status = 'Completed'");
         return $payrolls;
     }
+
+    public function fieldValueMethods() {
+        return ['getEmployeePayrolls'];
+    }
 }

core/src/Projects/Common/Model/Client.php

@@ -22,9 +22,4 @@ class Client extends BaseModel
     {
         return array("get","element","save","delete");
     }
-
-    public function getUserAccess()
-    {
-        return array();
-    }
 }

core/src/Qualifications/Common/Model/Certification.php

@@ -23,9 +23,4 @@ class Certification extends BaseModel
     {
         return array("get","element","save","delete");
     }
-
-    public function getUserAccess()
-    {
-        return array();
-    }
 }

core/src/Qualifications/Common/Model/Education.php

@@ -23,9 +23,4 @@ class Education extends BaseModel
     {
         return array("get","element","save","delete");
     }
-
-    public function getUserAccess()
-    {
-        return array();
-    }
 }

core/src/Qualifications/Common/Model/Language.php

@@ -23,9 +23,4 @@ class Language extends BaseModel
     {
         return array("get","element","save","delete");
     }
-
-    public function getUserAccess()
-    {
-        return array();
-    }
 }

core/src/Qualifications/Common/Model/Skill.php

@@ -23,9 +23,4 @@ class Skill extends BaseModel
     {
         return array("get","element","save","delete");
     }
-
-    public function getUserAccess()
-    {
-        return array();
-    }
 }

core/src/Reports/User/Reports/PayslipReport.php

@@ -64,6 +64,14 @@ class PayslipReport extends PDFReportBuilder implements PDFReportBuilderInterfac
                 $data['fields'][] = $field;
             }
         }
+        $employee = BaseService::getInstance()->getElement(
+            'Employee',
+            BaseService::getInstance()->getCurrentProfileId(),
+            null,
+            true
+        );
+        $data['employeeName'] = $employee->first_name.' '.$employee->last_name;
+        $data['payroll'] = $payroll;
         return $data;
     }
 

core/src/Salary/Common/Model/EmployeeSalary.php

@@ -21,16 +21,21 @@ class EmployeeSalary extends BaseModel
 
     public function getManagerAccess()
     {
-        return array("get","element","save","delete");
+        return array();
     }
 
     public function getUserAccess()
     {
-        return array("get");
+        return array();
     }
 
     public function getUserOnlyMeAccess()
     {
-        return array("element","save","delete");
+        return array("get", "element");
+    }
+
+    public function getUserOnlyMeSwitchedAccess()
+    {
+        return array();
     }
 }

core/src/Travel/Admin/Api/TravelActionManager.php

@@ -42,4 +42,14 @@ class TravelActionManager extends ApproveAdminActionManager
     {
         return "g=modules&n=travel&m=module_Travel_Management#tabEmployeeTravelRecordApproval";
     }
+
+    public function getLogs($req)
+    {
+        return parent::getLogs($req);
+    }
+
+    public function changeStatus($req)
+    {
+        return parent::changeStatus($req);
+    }
 }

core/src/Travel/User/Api/TravelActionManager.php

@@ -32,4 +32,14 @@ class TravelActionManager extends ApproveModuleActionManager
     {
         return "g=modules&n=travel&m=module_Travel_Management#tabSubordinateEmployeeTravelRecord";
     }
+
+    public function getLogs($req)
+    {
+        return parent::getLogs($req);
+    }
+
+    public function cancel($req)
+    {
+        return parent::cancel($req);
+    }
 }

core/src/Users/Admin/Api/UsersActionManager.php

@@ -26,6 +26,7 @@ use Users\Common\Model\User;
 use Classes\IceResponse;
 use Classes\SubActionManager;
 use Utils\LogManager;
+use Utils\SessionUtils;
 
 class UsersActionManager extends SubActionManager
 {
@@ -59,6 +60,12 @@ class UsersActionManager extends SubActionManager
 
     public function saveUser($req)
     {
+        if (empty($req->csrf) || $req->csrf !== SessionUtils::getSessionObject('csrf-User')) {
+            return new IceResponse(
+                IceResponse::ERROR,
+                "Error saving user"
+            );
+        }
         if ($this->user->user_level == 'Admin') {
             $user = new User();
             $user->Load("email = ?", array($req->email));

core/src/Users/Common/Model/User.php

@@ -34,6 +34,11 @@ class User extends BaseModel
         return array("get","element","save","delete");
     }
 
+    public function getManagerAccess()
+    {
+        return array();
+    }
+
     public function getUserAccess()
     {
         return array();

core/src/Utils/Math/EvalMath.php

@@ -98,7 +98,7 @@ class EvalMath
         'sin','sinh','arcsin','asin','arcsinh','asinh',
         'cos','cosh','arccos','acos','arccosh','acosh',
         'tan','tanh','arctan','atan','arctanh','atanh',
-        'sqrt','abs','ln','log');
+        'sqrt','abs','ln','log', 'exp', 'ceil', 'floor', );
 
     public function __construct()
     {

core/src/Utils/SessionUtils.php

@@ -5,11 +5,12 @@ class SessionUtils
 {
     public static function getSessionObject($name)
     {
-        session_start();
+        if (session_status() === PHP_SESSION_NONE) {
+            session_start();
+        }
         if (isset($_SESSION[$name.CLIENT_NAME])) {
             $obj = $_SESSION[$name.CLIENT_NAME];
         }
-        session_write_close();
         if (empty($obj)) {
             return null;
         }
@@ -18,9 +19,10 @@ class SessionUtils
 
     public static function saveSessionObject($name, $obj)
     {
-        session_start();
+        if (session_status() === PHP_SESSION_NONE) {
+            session_start();
+        }
         $_SESSION[$name.CLIENT_NAME] = json_encode($obj);
-        session_write_close();
     }
 
     public static function unsetClientSession()
@@ -31,7 +33,9 @@ class SessionUtils
             "admin_current_profile",
             "csrf-login"
         ];
-        session_start();
+        if (session_status() === PHP_SESSION_NONE) {
+            session_start();
+        }
         setcookie('icehrmLF', '');
         foreach ($names as $name) {
             unset($_SESSION[$name.CLIENT_NAME]);