From 7ae6c7e0eb5d66151c5681486857122830b4c3c8 Mon Sep 17 00:00:00 2001
From: mattf <mattf@3d104415-ff17-0410-8863-d5cf3c621b8a>
Date: Thu, 4 Mar 2021 21:25:46 +0000
Subject: [PATCH] Added User modify_leads = 5 option, for READONLY in admin
 screens

git-svn-id: svn://192.168.202.10@3363 3d104415-ff17-0410-8863-d5cf3c621b8a
---
 www/agc/vdc_form_display.php        | 16 +++++++++++++---
 www/vicidial/admin.php              |  7 ++++---
 www/vicidial/admin_modify_lead.php  | 19 ++++++++++++++++---
 www/vicidial/help_documentation.txt |  4 ++--
 4 files changed, 35 insertions(+), 11 deletions(-)

diff --git a/www/agc/vdc_form_display.php b/www/agc/vdc_form_display.php
index 4dc0a566..24da32df 100644
--- a/www/agc/vdc_form_display.php
+++ b/www/agc/vdc_form_display.php
@@ -46,10 +46,11 @@
 # 200406-1137 - Added hide_gender and gender default population
 # 201117-2056 - Changes for better compatibility with non-latin data input
 # 210211-0146 - Added SOURCESELECT field type
+# 210304-1612 - Added READONLY submit_button option
 #
 
-$version = '2.14-36';
-$build = '210211-0146';
+$version = '2.14-37';
+$build = '210304-1612';
 $php_script = 'vdc_form_display.php';
 
 require_once("dbconnect_mysqli.php");
@@ -308,7 +309,7 @@ if (strlen($SSagent_debug_logging) > 1)
 	}
 
 $auth_api_flag = 0;
-if ( ($submit_button=='YES') or ($admin_submit=='YES') )
+if ( ($submit_button=='YES') or ($submit_button=='READONLY') or ($admin_submit=='YES') )
 	{$auth_api_flag = 1;}
 
 $auth=0;
@@ -354,6 +355,11 @@ else
 ### BEGIN parse submission of the custom fields form ###
 if ($stage=='SUBMIT')
 	{
+	if ($submit_button=='READONLY')
+		{
+		echo  _QXZ("You do not have permission to modify leads").": $submit_button\n<BR>\n";
+		exit;
+		}
 	$SUBMIT_only=1;
 	if ($SSagent_debug_logging > 0) 
 		{
@@ -668,6 +674,10 @@ if ($SUBMIT_only < 1)
 	echo "<input type=hidden name=user_group id=user_group value=\"$user_group\">\n";
 	echo "<input type=hidden name=uniqueid id=uniqueid value=\"$uniqueid\">\n";
 	echo "\n";
+	if ($submit_button=='READONLY')
+		{
+		echo "<input type=hidden name=submit_button id=submit_button value=\"READONLY\">\n";
+		}
 
 
 	require_once("functions.php");
diff --git a/www/vicidial/admin.php b/www/vicidial/admin.php
index 5938850d..e45803f9 100644
--- a/www/vicidial/admin.php
+++ b/www/vicidial/admin.php
@@ -5479,12 +5479,13 @@ if ($SSscript_remove_js > 0)
 # 210226-1545 - Added Copy Phone functionality
 # 210227-1126 - Variable filter changes
 # 210302-1032 - Changed Logout to auto-logout through AJAX, with redirect to Admin Home URL
+# 210304-1615 - Added User modify_leads = 5 option, for READONLY
 #
 
 # make sure you have added a user to the vicidial_users MySQL table with at least user_level 9 to access this page the first time
 
-$admin_version = '2.14-790a';
-$build = '210302-1032';
+$admin_version = '2.14-791a';
+$build = '210304-1615';
 
 $STARTtime = date("U");
 $SQLdate = date("Y-m-d H:i:s");
@@ -23916,7 +23917,7 @@ if ($ADD==3)
 				echo "<tr bgcolor=#$SSstd_row2_background><td align=right>"._QXZ("Modify Lists").": </td><td align=left><select size=1 name=modify_lists><option>0</option><option>1</option><option SELECTED>$modify_lists</option></select>$NWB#users-modify_sections$NWE</td></tr>\n";
 				echo "<tr bgcolor=#$SSstd_row2_background><td align=right>"._QXZ("Delete Lists").": </td><td align=left><select size=1 name=delete_lists><option>0</option><option>1</option><option SELECTED>$delete_lists</option></select>$NWB#users-delete_lists$NWE</td></tr>\n";
 				echo "<tr bgcolor=#$SSstd_row2_background><td align=right>"._QXZ("Load Leads").": </td><td align=left><select size=1 name=load_leads><option>0</option><option>1</option><option SELECTED>$load_leads</option></select>$NWB#users-load_leads$NWE</td></tr>\n";
-				echo "<tr bgcolor=#$SSstd_row2_background><td align=right>"._QXZ("Modify Leads").": </td><td align=left><select size=1 name=modify_leads><option>0</option><option>1</option><option>2</option><option>3</option><option>4</option><option SELECTED>$modify_leads</option></select>$NWB#users-modify_leads$NWE</td></tr>\n";
+				echo "<tr bgcolor=#$SSstd_row2_background><td align=right>"._QXZ("Modify Leads").": </td><td align=left><select size=1 name=modify_leads><option>0</option><option>1</option><option>2</option><option>3</option><option>4</option><option>5</option><option SELECTED>$modify_leads</option></select>$NWB#users-modify_leads$NWE</td></tr>\n";
 				echo "<tr bgcolor=#$SSstd_row2_background><td align=right>"._QXZ("GDPR-Compliant Export Delete Leads").": </td><td align=left><select size=1 name=export_gdpr_leads>";
 				for ($i=0; $i<=$SSenable_gdpr_download_deletion; $i++) 
 					{
diff --git a/www/vicidial/admin_modify_lead.php b/www/vicidial/admin_modify_lead.php
index 0cb76673..aa8cb31b 100644
--- a/www/vicidial/admin_modify_lead.php
+++ b/www/vicidial/admin_modify_lead.php
@@ -8,7 +8,7 @@
 # just needs to enter the leadID and then they can view and modify the 
 # information in the record for that lead
 #
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 #
@@ -103,6 +103,7 @@
 # 201117-0807 - Changes for better compatibility with non-latin data input
 # 201109-1725 - Fix for blank page after certain updates submitted
 # 201123-1704 - Added today called count display
+# 210304-1509 - Added option '5' for modify_lead for this page to work as read-only
 #
 
 require("dbconnect_mysqli.php");
@@ -1344,6 +1345,11 @@ $messagesHTML .= "<span style=\"position:absolute;left:3px;top:30px;z-index:19;\
 ### BEGIN - Add a new lead in the system ###
 if ($lead_id == 'NEW')
 	{
+	if ($LOGmodify_leads == '5')
+		{
+		echo "ERROR: "._QXZ("You do not have permission to add new leads").": $LOGmodify_leads \n";
+		exit;
+		}
 	$secX = date("U");
 	$hour = date("H");
 	$min = date("i");
@@ -1461,7 +1467,7 @@ if ($end_call > 0)
 		$list_valid = $rowx[0];
 		}
 
-	if ( ($list_valid > 0) or (preg_match('/\-ALL/i', $LOGallowed_campaigns)) )
+	if ( ( ($list_valid > 0) or (preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) and ($LOGmodify_leads != '5') )
 		{
 		$diff_orig=''; $diff_new='';
 		# gather existing lead data to store for admin log diff
@@ -1633,6 +1639,11 @@ if ($end_call > 0)
 	}
 else
 	{
+	if ( ($LOGmodify_leads == '5') and ( ($CBchangeUSERtoANY == 'YES') or ($CBchangeANYtoUSER == 'YES') or ($CBchangeDATE == 'YES') ) )
+		{
+		echo "ERROR: "._QXZ("You do not have permission to modify leads").": $LOGmodify_leads \n";
+		exit;
+		}
 	if ($CBchangeUSERtoANY == 'YES')
 		{
 		### set vicidial_callbacks record to an ANYONE callback for this lead 
@@ -2947,9 +2958,11 @@ else
 					{
 					$rowx=mysqli_fetch_row($rslt);
 					$custom_records_count =	$rowx[0];
+					$submit_buttonURL = '&submit_button=YES';
+					if ($LOGmodify_leads == '5') {$submit_buttonURL = '&submit_button=READONLY';}
 
 					echo "<B>"._QXZ("CUSTOM FIELDS FOR THIS LEAD").":</B><BR>\n";
-					echo "<iframe src=\"../agc/$vdc_form_display?lead_id=$lead_id&list_id=$CLlist_id&stage=DISPLAY&submit_button=YES&user=$PHP_AUTH_USER&pass=$PHP_AUTH_PW&bcrypt=OFF&bgcolor=E6E6E6\" style=\"background-color:transparent;\" scrolling=\"auto\" frameborder=\"2\" allowtransparency=\"true\" id=\"vcFormIFrame\" name=\"vcFormIFrame\" width=\"740\" height=\"300\" STYLE=\"z-index:18\"> </iframe>\n";
+					echo "<iframe src=\"../agc/$vdc_form_display?lead_id=$lead_id&list_id=$CLlist_id&stage=DISPLAY$submit_buttonURL&user=$PHP_AUTH_USER&pass=$PHP_AUTH_PW&bcrypt=OFF&bgcolor=E6E6E6\" style=\"background-color:transparent;\" scrolling=\"auto\" frameborder=\"2\" allowtransparency=\"true\" id=\"vcFormIFrame\" name=\"vcFormIFrame\" width=\"740\" height=\"300\" STYLE=\"z-index:18\"> </iframe>\n";
 					echo "<BR><BR>";
 					}
 				}
diff --git a/www/vicidial/help_documentation.txt b/www/vicidial/help_documentation.txt
index 35dca158..77055bf8 100644
--- a/www/vicidial/help_documentation.txt
+++ b/www/vicidial/help_documentation.txt
@@ -1,4 +1,4 @@
-# version: 20210303100701
+# version: 20210304161701
 users-user	User ID	<QXZ>This field is where you put the users ID number, can be up to 8 digits in length, Must be at least 2 characters in length.</QXZ>
 users-pass	Password	<QXZ>This field is where you put the users password. Must be at least 2 characters in length. A medium strength user password will be at least 10 characters in length, and a strong user password will be at least 20 characters in length and have letters as well as at least one number. It is recommended that you use a longer password if possible, stringing together several unrelated words with no spaces, and a number somewhere in the string. The maximum size of a password is 100 characters.</QXZ>
 users-force_change_password	Force Change Password	<QXZ>If this option is set to Y then the user will be prompted to change their password the next time they log in to the administration webpage or the agent screen. Default is N.</QXZ>
@@ -71,7 +71,7 @@ users-modify_servers	Modify Servers	<QXZ>This setting will allow access for the
 users-modify_statuses	Modify Statuses	<QXZ>This setting will allow access for the user to modify the following sections - system statuses, status groups, status categories, CID groups and VM message groups.</QXZ>
 users-ast_delete_phones	AGC Delete Phones	<QXZ>This option if set to 1 allows the user to delete phone entries in the astGUIclient admin pages.</QXZ>
 users-delete_scripts	Delete Scripts	<QXZ>This option if set to 1 allows the user to delete Campaign scripts in the script modification screen.</QXZ>
-users-modify_leads	Modify Leads	<QXZ>This option if set to 1 or 3 allows the user to modify leads in the admin section lead search results page. If this option is set to 2 or 4, the admin user can modify all lead fields except for the phone number and alt number fields. This option if set to 3 or 4 allows the user to modify the log statuses of the logs shown in the modify lead admin screen.</QXZ>
+users-modify_leads	Modify Leads	<QXZ>This option if set to 1 or 3 allows the user to modify leads in the admin section lead search results page. If this option is set to 2 or 4, the admin user can modify all lead fields except for the phone number and alt number fields. This option if set to 3 or 4 allows the user to modify the log statuses of the logs shown in the modify lead admin screen. This option set to 5 is Read-Only mode and will not allow lead modifications or the adding of new leads by the user.</QXZ>
 users-export_gdpr_leads	GDPR-Compliant Export Delete Leads	<QXZ>This setting if enabled will allow for the complete download and/or deletion of all customer data for a particular lead, in compliance with the General Data Protection Regulation (GDPR). Default is 0 for disabled.  A setting of 1 will enable downloading data, and a setting of 2 will enable not just downloading, but also deletion of data, including any recordings.</QXZ><BR><B><QXZ>You are not allowed to set this user setting higher than the current system setting. </QXZ></B>
 users-modify_email_accounts	Modify Email Accounts	<QXZ>This option if set to 1 allows the user to modify email accounts in the email account management page.</QXZ>
 users-change_agent_campaign	Change Agent Campaign	<QXZ>This option if set to 1 allows the user to alter the campaign that an agent is logged into while they are logged into it.</QXZ>