userSupportView.prg

<?php
/**
 * @package UserSupport (Subpackage BAM)
 * @author SPB
 *
 * This script will create a banking cookie with Ca= the admin user.  Then redirects to the banking side.
 */
$string = array("filter" => HCUFILTER_INPUT_STRING);
HCU_ImportVars($parameters, "a", array("payload" => $string));
extract($parameters["a"]);

$operation = is_null($operation) ? "" : trim($operation);

$userRecord = array();
try {
    $userRecord = HCU_PayloadDecode($Cu, $payload);
} catch(exception $e) {
    print "No User Found";
    exit;
}

// Now apply the employee permissions.
// Prevent access if employee flag is true --AND--
// user is not the master user.
$isMasterUser = $Cn === strtolower(trim($Cu));
$preventAccess = !$isMasterUser && HCU_array_key_value("employee", $userRecord) === "Y";
if ($preventAccess) {
    print "You do not have access to view employee's account.";
    exit;
}

$results = createTheCookie($dbh, $Cu, $Cn, intval($userRecord["user_id"]), intval($MEM_FORCE_RESET), $SYSENV);

if ($results["code"] != 0) {
    print $results["error"][0];
} else {
    header("location: $http_scheme://" . $_SERVER["HTTP_HOST"] . "/banking/hcuAccounts.prg?cu=$Cu");
}

/**
 * createTheCookie ($dbh, $Cu, $Cn, $userId, $forceReset, $SYSENV)
 * This function creates the banking cookie for use in the banking side.  This cookie is non-renewable and dies on admin logout.
 *
 * @param $dbh -- the database connection
 * @param $Cu -- the credit union
 * @param $Cn -- the logged in admin user
 * @param $userId -- the banking user
 * @param $forceReset -- the value of the constant for the credit union
 * @param $SYSENV -- the environment that the cookie thrives in
 */
function createTheCookie ($dbh, $Cu, $Cn, $userId, $forceReset, $SYSENV) {
    try {
        $sql = "select failedremain, livewait, lastupdate, lastlogin, showavailable, forcechange, forceremain, trim(a.user_name),
            userflags & $forceReset, failedlogin, pwchange, msg_tx, flagset, flagset2, flagset3, email,histdays,livebatch from ${Cu}user a, cuadmin b
            where a.user_id = $userId and b.cu = '$Cu'";
        $sth = db_query($sql, $dbh);
        if (!$sth) {
            throw new exception("select query failed!", 1);
        }
        if (!list($failedremain, $livewait, $lastupdate, $llog, $showavail, $fchange, $fremain, $username, $freset, $flog, $pchange, $msgTx, $flagset, $flagset2,
            $flagset3, $email, $histdays, $livebatch)= db_fetch_array($sth,0)) {
            throw new exception("select query failed!", 2);
        }

        $failedremain = (is_null($failedremain) ? 5 : $failedremain);
        $fremain = (is_null($fremain) ? 5 : $fremain);
        $fchange = (is_null($fchange) ? 'N' : $fchange);

        $livewait = (is_null($livewait) ? "300" : $livewait);
        $lastupdate = (trim("$lastupdate") == "" ? "Unknown" : urlencode(trim($lastupdate)));
        $llog = (trim("$llog") == "" ? "None" : urlencode(trim($llog)));
        $flog = (trim("$flog") == "" ? "None" : urlencode(trim($flog)));
        $msgTx = (is_null($msgTx) ? 0 : $msgTx);
        $flagset = (is_null($flagset) ? 0 : $flagset);
        $flagset2 = (is_null($flagset2) ? 0 : $flagset2);
        $flagset3 = (is_null($flagset3) ? 0 : $flagset3);
        $showavail = (is_null($showavail) ? "_" : strtoupper(rtrim($showavail)));
        $pchange = (is_null($pchange) ? '01/01/2001 01:01:01' : $pchange);
        $email = (is_null($email) ? "_" : urlencode(rtrim($email)));
        $fhdays = (is_null($histdays) ? 0 : $histdays);
        $now = time();
        $expires = $now + $SYSENV['ticket']['expires'];
        $testmenu = (isset($testmenu) ? intval($testmenu) : 0);
        $sid = strval(time());

        HCU_setcookie_env($SYSENV, "${Cu}_lang", "en_US"); // Set the language cookie

        $mycookie = "Ctime=$now&Cu=$Cu&Cn=$username&Uid=$userId&Ce=$expires&Clw=$livewait&Clu=$lastupdate&Fplog=$llog&Fflog=$flog&Ffchg=$fchange&Ffreset=$freset"
            . "&Ffremain=$fremain&Fmsg_tx=$msgTx&Fset=$flagset&Fset2=$flagset2&Fhdays=$fhdays&Ml=$email&Fset3=$flagset3&Ca=$Cn&platform=DSK&sid=$sid";

        SetTicket(array("secret" => GetSecretKeyString(), "SYSENV" => $SYSENV), "", $mycookie);
    } catch(exception $e) {
        return array("error" => array($e->getMessage()), "code" => $e->getCode());
    }
    return array("error" => array(), "code" => 0);
}