Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
31 commits
Select commit Hold shift + click to select a range
095ed2d
server+database: reimplement access control for database page
phannguyenlong Apr 25, 2021
58c091f
server+database: reimplement access control for database page
phannguyenlong Apr 25, 2021
f6f3709
Merge branch 'main' into dev
phannguyenlong Apr 25, 2021
ef19d65
database: add 2 trigger unique_deans and unique_proco
jonnidip18 Apr 25, 2021
7fd1287
database: add admin
jonnidip18 Apr 25, 2021
29211cf
database: remove 2 dean and program coor trigger
phannguyenlong Apr 26, 2021
964b7a6
database: refactor authentication procedure
jonnidip18 Apr 26, 2021
3c7433a
database: update small thing
jonnidip18 Apr 26, 2021
d2bc5b8
database: add constraint to academic_year
jonnidip18 Apr 26, 2021
0f06ae1
database: small stupid change
jonnidip18 Apr 26, 2021
d5a7deb
database: update 2 triggers
jonnidip18 Apr 26, 2021
00993dc
database: refactor 2 triggers
jonnidip18 Apr 26, 2021
ab2486d
database: refactor controllAccess procedure
jonnidip18 Apr 26, 2021
fbf4eb0
server: update access control for interactTable
phannguyenlong Apr 26, 2021
9825054
server: add access control for modify and add
phannguyenlong May 9, 2021
bb43247
database: add 3 procedure of access control
jonnidip18 May 9, 2021
3e65306
Merge branch 'dev' of https://github.com/phannguyenlong/survey_app in…
phannguyenlong May 9, 2021
8f2b538
database: fix validateAccessControl
phannguyenlong May 9, 2021
c558676
server: debug interactTable for new validateAccessControl
phannguyenlong May 9, 2021
cf07180
database+server: accessControl for dropdown list
phannguyenlong May 9, 2021
39783ed
server: add accessControl for admin
phannguyenlong May 9, 2021
6aa24aa
database: increase paramter size
phannguyenlong May 9, 2021
3534a14
server: add accessControl for chart filter
phannguyenlong May 9, 2021
d1d4d3b
database: refactor 3 access control procedures
jonnidip18 May 9, 2021
436d367
database: refactor 3 access control procedures
jonnidip18 May 9, 2021
6b92f61
database: add procedure add teaching for lec
jonnidip18 May 9, 2021
804ab74
server: optimize access control for checkChartValidate
phannguyenlong May 10, 2021
48964fb
server+client: debbug for acccess control for chart validate
phannguyenlong May 10, 2021
0ae5e79
database: refactor 2 access control procedures
jonnidip18 May 10, 2021
7e17808
Merge branch 'dev' of https://github.com/phannguyenlong/survey_app in…
phannguyenlong May 10, 2021
d0dc890
server: finish access control for interact table
phannguyenlong May 10, 2021
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 46 additions & 2 deletions init_database2.sql
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
-- Clean up old tablequestionquestion
DROP TABLE IF EXISTS deans;
DROP TABLE IF EXISTS program_coordinator;
DROP TABLE IF EXISTS s_admin;
DROP TABLE IF EXISTS questionaire;
DROP TABLE IF EXISTS teaching;
DROP TABLE IF EXISTS class;
Expand Down Expand Up @@ -43,7 +44,8 @@ CREATE TABLE module (

CREATE TABLE academic_year (
aca_code INT AUTO_INCREMENT PRIMARY KEY,
aca_name VARCHAR(10) NOT NULL
aca_name VARCHAR(10) UNIQUE NOT NULL,
CHECK (aca_name LIKE "____-____" AND LEFT(aca_name,4)<RIGHT(aca_name,4))
);


Expand Down Expand Up @@ -182,6 +184,10 @@ CREATE TABLE program_coordinator(
CHECK (start_date < end_date)
);

CREATE TABLE s_admin(
username VARCHAR(20) NOT NULL,
FOREIGN KEY (username) REFERENCES login(username)
);
-- ======================Insert Trigger===================

-- unique program
Expand Down Expand Up @@ -304,6 +310,40 @@ FOR EACH ROW BEGIN
END//
DELIMITER ;

-- unique deans
DROP TRIGGER IF EXISTS unique_deans;
DELIMITER //
CREATE TRIGGER unique_deans BEFORE INSERT ON deans
FOR EACH ROW BEGIN
IF
(SELECT count(*) FROM deans
WHERE NEW.faculty_code=faculty_code AND
((NEW.start_date >= start_date AND NEW.start_date < end_date) OR
(NEW.end_date > start_date AND NEW.end_date <= end_date) OR
(NEW.start_date <= start_date AND NEW.end_date >= end_date))) > 0
THEN
SET NEW.faculty_code = NULL;
END IF;
END//
DELIMITER ;

-- unique program coordinator
DROP TRIGGER IF EXISTS unique_proco;
DELIMITER //
CREATE TRIGGER unique_proco BEFORE INSERT ON program_coordinator
FOR EACH ROW BEGIN
IF
(SELECT count(*) FROM program_coordinator
WHERE NEW.program_code=program_code AND
((NEW.start_date >= start_date AND NEW.start_date < end_date) OR
(NEW.end_date > start_date AND NEW.end_date <= end_date) OR
(NEW.start_date <= start_date AND NEW.end_date >= end_date))) > 0
THEN
SET NEW.program_code = NULL;
END IF;
END//
DELIMITER ;

-- ======================Insert Data======================

-- Falcuty
Expand Down Expand Up @@ -619,6 +659,7 @@ insert into login (username, pass) values ('mmatussevichp', '0jwt0RHGcZbd');
insert into login (username, pass) values ('kgrenshieldsq', 'V1N7EL');
insert into login (username, pass) values ('yhinksenr', '4jPejEhQo');
insert into login (username, pass) values ('ojedrzejewskys', 'WJWmXbac2sk');
insert into login (username, pass) values ('super', 'admin');

-- Lecturer
INSERT INTO lecturer (lec_code, name, username) VALUES ('1', 'Jo Urvoy', 'nlacelett0');
Expand Down Expand Up @@ -1229,4 +1270,7 @@ insert into deans (username, start_date, end_date, faculty_code) values ('pgaito
insert into deans (username, start_date, end_date, faculty_code) values ('gfairburnh', '2020-08-19','2021-08-19', 'FLAW');

-- FMUS
insert into deans (username, start_date, end_date, faculty_code) values ('mcurmank', '2020-08-19','2021-08-19', 'FMUS');
insert into deans (username, start_date, end_date, faculty_code) values ('mcurmank', '2020-08-19','2021-08-19', 'FMUS');

-- SUPER ADMIN
insert into s_admin(username) VALUE ("super");
140 changes: 112 additions & 28 deletions init_procedure.sql
Original file line number Diff line number Diff line change
Expand Up @@ -145,7 +145,7 @@ BEGIN
WHEN action="dump" THEN
BEGIN
SET @arr_key = key_array;
SET @a = CONCAT('SELECT * FROM year_faculty ORDER BY id_1;');
SET @a = CONCAT('SELECT * FROM year_faculty WHERE (id_1 IN (',@arr_key,')) ORDER BY id_1;');
PREPARE stmt1 FROM @a;
EXECUTE stmt1;
DEALLOCATE PREPARE stmt1;
Expand Down Expand Up @@ -176,6 +176,7 @@ BEGIN
JOIN year_faculty yf ON (yf.id_1 = yfp.id_1)
JOIN faculty f ON (f.fa_code = yf.faculty_code)
JOIN academic_year a ON (a.aca_code = yf.academic_code)
WHERE (id_2 IN (',@arr_key,'))
ORDER BY id_2;');
PREPARE stmt1 FROM @a;
EXECUTE stmt1;
Expand Down Expand Up @@ -210,6 +211,7 @@ BEGIN
JOIN year_faculty yf ON (yf.id_1 = yfp.id_1)
JOIN faculty f ON (f.fa_code = yf.faculty_code)
JOIN academic_year a ON (a.aca_code = yf.academic_code)
WHERE (id_3 IN (',@arr_key,'))
ORDER BY id_3;');
PREPARE stmt1 FROM @a;
EXECUTE stmt1;
Expand Down Expand Up @@ -237,7 +239,7 @@ BEGIN
BEGIN
SET @arr_key = key_array;
SET @a = CONCAT('SELECT t.id, t.class_code, CONCAT(t.lecturer_code, " - ", l.name) AS lecturer_code FROM teaching t
JOIN lecturer l ON l.lec_code = t.lecturer_code ORDER BY t.id;');
JOIN lecturer l ON l.lec_code = t.lecturer_code WHERE (id IN (',@arr_key,')) ORDER BY t.id;');
PREPARE stmt1 FROM @a;
EXECUTE stmt1;
DEALLOCATE PREPARE stmt1;
Expand All @@ -263,7 +265,7 @@ BEGIN
WHEN action = "dump" THEN
BEGIN
SET @arr_key = key_array;
SET @a = CONCAT('SELECT * FROM faculty ORDER BY fa_code;');
SET @a = CONCAT('SELECT * FROM faculty WHERE (fa_code IN (',@arr_key,')) ORDER BY fa_code;');
PREPARE stmt1 FROM @a;
EXECUTE stmt1;
DEALLOCATE PREPARE stmt1;
Expand All @@ -289,7 +291,7 @@ BEGIN
WHEN action = "dump" THEN
BEGIN
SET @arr_key = key_array;
SET @a = CONCAT('SELECT * FROM program ORDER BY pro_code;');
SET @a = CONCAT('SELECT * FROM program WHERE (pro_code IN (',@arr_key,')) ORDER BY pro_code;');
PREPARE stmt1 FROM @a;
EXECUTE stmt1;
DEALLOCATE PREPARE stmt1;
Expand All @@ -315,7 +317,7 @@ BEGIN
WHEN action = "dump" THEN
BEGIN
SET @arr_key = key_array;
SET @a = CONCAT('SELECT * FROM module ORDER BY mo_code;');
SET @a = CONCAT('SELECT * FROM module WHERE (mo_code IN (',@arr_key,')) ORDER BY mo_code;');
PREPARE stmt1 FROM @a;
EXECUTE stmt1;
DEALLOCATE PREPARE stmt1;
Expand Down Expand Up @@ -381,7 +383,7 @@ BEGIN
WHEN action = "dump" THEN
BEGIN
SET @arr_key = key_array;
SET @a = CONCAT('SELECT * FROM lecturer ORDER BY lec_code;');
SET @a = CONCAT('SELECT * FROM lecturer WHERE (lec_code IN (',@arr_key,')) ORDER BY lec_code;');
PREPARE stmt1 FROM @a;
EXECUTE stmt1;
DEALLOCATE PREPARE stmt1;
Expand All @@ -401,7 +403,7 @@ DELIMITER ;
-- Interact with class
DROP PROCEDURE IF EXISTS java_app.classInteract;
DELIMITER //
CREATE PROCEDURE classInteract(action VARCHAR(10),old_key INT,csize INT,code VARCHAR(10),id INT, key_array VARCHAR(500))
CREATE PROCEDURE classInteract(action VARCHAR(10),old_key INT,csize INT,code VARCHAR(10),id INT, key_array VARCHAR(1000))
BEGIN
CASE
WHEN action = "dump" THEN
Expand All @@ -418,6 +420,7 @@ BEGIN
JOIN year_faculty yf ON (yf.id_1 = yfp.id_1)
JOIN faculty f ON (f.fa_code = yf.faculty_code)
JOIN academic_year a ON (a.aca_code = yf.academic_code)
WHERE (class_code IN (',@arr_key,'))
ORDER BY class_code;');
PREPARE stmt1 FROM @a;
EXECUTE stmt1;
Expand Down Expand Up @@ -486,27 +489,49 @@ BEGIN
SET @faculty_arr = arr_faculty;
SET @program_arr = arr_program;
SET @lecturer_arr = arr_lecturer;
SET @a=CONCAT('SELECT
SET @a=CONCAT('
SELECT
a.aca_code AS aca_year, a.aca_name, s.sem_code AS semester, f.fa_code AS faculty, f.name AS fa_name,
p.pro_code AS program, p.name AS pro_name, m.mo_code AS module, m.name AS mo_name,
c.class_code AS class, l.lec_code AS lecturer, l.name AS lec_name, t.id AS teaching,
yf.id_1 AS year_faculty, yfp.id_2 AS year_fac_pro, yfpm.id_3 AS year_fac_pro_mo
FROM class c
JOIN teaching t ON c.class_code = t.class_code
JOIN lecturer l ON t.lecturer_code = l.lec_code
JOIN semester s ON (s.sem_code = c.semester_code)
JOIN academic_year a ON (a.aca_code = s.academic_code)
JOIN year_fac_pro_mo yfpm ON (yfpm.id_3 = c.id_3)
JOIN module m ON (yfpm.module_code = m.mo_code)
JOIN year_fac_pro yfp ON (yfp.id_2 = yfpm.id_2 )
JOIN program p ON (p.pro_code = yfp.program_code)
JOIN year_faculty yf ON (yf.id_1 = yfp.id_1)
JOIN faculty f ON (f.fa_code = yf.faculty_code)
LEFT OUTER JOIN teaching t ON c.class_code = t.class_code
LEFT OUTER JOIN lecturer l ON t.lecturer_code = l.lec_code
LEFT OUTER JOIN semester s ON (s.sem_code = c.semester_code)
LEFT OUTER JOIN academic_year a ON (a.aca_code = s.academic_code)
LEFT OUTER JOIN year_fac_pro_mo yfpm ON (yfpm.id_3 = c.id_3)
LEFT OUTER JOIN module m ON (yfpm.module_code = m.mo_code)
LEFT OUTER JOIN year_fac_pro yfp ON (yfp.id_2 = yfpm.id_2 )
LEFT OUTER JOIN program p ON (p.pro_code = yfp.program_code)
LEFT OUTER JOIN year_faculty yf ON (yf.id_1 = yfp.id_1)
LEFT OUTER JOIN faculty f ON (f.fa_code = yf.faculty_code)
WHERE
(f.fa_code IN (',@faculty_arr,')) OR
(p.pro_code IN (',@program_arr,')) OR
(l.lec_code IN ( ',@lecturer_arr,'))
UNION
SELECT
a.aca_code AS aca_year, a.aca_name, s.sem_code AS semester, f.fa_code AS faculty, f.name AS fa_name,
p.pro_code AS program, p.name AS pro_name, m.mo_code AS module, m.name AS mo_name,
c.class_code AS class, l.lec_code AS lecturer, l.name AS lec_name, t.id AS teaching,
yf.id_1 AS year_faculty, yfp.id_2 AS year_fac_pro, yfpm.id_3 AS year_fac_pro_mo
FROM class c
RIGHT OUTER JOIN teaching t ON c.class_code = t.class_code
RIGHT OUTER JOIN lecturer l ON t.lecturer_code = l.lec_code
RIGHT OUTER JOIN semester s ON (s.sem_code = c.semester_code)
RIGHT OUTER JOIN academic_year a ON (a.aca_code = s.academic_code)
RIGHT OUTER JOIN year_fac_pro_mo yfpm ON (yfpm.id_3 = c.id_3)
RIGHT OUTER JOIN module m ON (yfpm.module_code = m.mo_code)
RIGHT OUTER JOIN year_fac_pro yfp ON (yfp.id_2 = yfpm.id_2 )
RIGHT OUTER JOIN program p ON (p.pro_code = yfp.program_code)
RIGHT OUTER JOIN year_faculty yf ON (yf.id_1 = yfp.id_1)
RIGHT OUTER JOIN faculty f ON (f.fa_code = yf.faculty_code)
WHERE
(f.fa_code IN (',@faculty_arr,')) OR
(p.pro_code IN (',@program_arr,')) OR
(l.lec_code IN ( ',@lecturer_arr,'))
ORDER BY a.aca_code, s.sem_code, f.fa_code, p.pro_code, m.mo_code, c.class_code, l.lec_code, t.id;');
');
PREPARE stmt2 FROM @a;
EXECUTE stmt2;
DEALLOCATE PREPARE stmt2;
Expand All @@ -518,22 +543,26 @@ DROP PROCEDURE IF EXISTS java_app.controllAccess;
DELIMITER //
CREATE PROCEDURE controllAccess(user VARCHAR(20))
BEGIN
SET @faculty_arr = IFNULL(CONCAT("'",(SELECT group_concat(concat_ws(",", d.faculty_code) separator "', '") AS faculty
SET @faculty_arr1 = IFNULL(CONCAT("'",(SELECT group_concat(concat_ws(",", d.faculty_code) separator "', '") AS faculty
FROM deans d
JOIN login lo ON lo.username=d.username
WHERE (lo.username = user and now() < d.end_date and now() > d.start_date)),"'"),"'null'");
WHERE (lo.username = user and now() <= d.end_date and now() >= d.start_date)),"'"),"'null'");

SET @program_arr = IFNULL(CONCAT("'",(SELECT group_concat(concat_ws(",", pc.program_code) separator "', '") AS program
FROM program_coordinator pc
JOIN login lo ON lo.username=pc.username
WHERE (lo.username = user and now() < pc.end_date and now() > pc.start_date)),"'"),"'null'");
WHERE (lo.username = user and now() <= pc.end_date and now() >= pc.start_date)),"'"),"'null'");

SET @lecturer_arr = IFNULL((SELECT group_concat(concat_ws("',", l.lec_code) separator ", ") AS lecturer
FROM lecturer l
JOIN login lo ON lo.username=l.username
WHERE lo.username = user),"null");

CALL validateAccessControl(@faculty_arr,@program_arr,@lecturer_arr);
SET @faculty_arr2 = IFNULL(CONCAT("'",(SELECT group_concat(concat_ws(",", f.fa_code) separator "', '") AS faculty
FROM faculty f
WHERE ((SELECT username FROM s_admin) = user )),"'"),"'null'");

CALL validateAccessControl(IF(@faculty_arr2 = "'NULL'",@faculty_arr1,@faculty_arr2),@program_arr,@lecturer_arr);
END //
DELIMITER ;

Expand All @@ -546,44 +575,55 @@ BEGIN
from login
where username = user and username in (select l.username from login l
join deans d on (d.username = l.username)
where now() < d.end_date and now() > d.start_date));
where now() <= d.end_date and now() >= d.start_date));
set @a2 = (select username
from login
where username = user and username in (select l.username from login l
join program_coordinator pc on (pc.username = l.username)
where now() < pc.end_date and now() > pc.start_date));
where now() <= pc.end_date and now() >= pc.start_date));
set @a3 = (select le.username
from login lo
join lecturer le on (lo.username = le.username)
where le.username = user);
SELECT username
set @a4 = (select username
from s_admin
where username = user);
SELECT username , IF(user = @a4,"Admin",IF(user = @a1,"Deans",IF(user = @a2,"Proco",IF(user = @a3,"Lecturer","None")))) as isAdmin
FROM login l
WHERE (username = user AND pass = password) AND (username = @a1 OR username = @a2 OR username = @a3);
WHERE (username = user AND pass = password) AND (username = @a1 OR username = @a2 OR username = @a3 OR username = @a4);
END //
DELIMITER ;

-- procedure idDropdown
DROP PROCEDURE IF EXISTS java_app.idDropdown;
DELIMITER //
CREATE PROCEDURE idDropdown(id_type VARCHAR(10))
CREATE PROCEDURE idDropdown(id_type VARCHAR(10), key_array VARCHAR(500))
BEGIN
SET @arr_key = key_array;
CASE
WHEN id_type = "id_1" THEN
SET @a = CONCAT('
SELECT yf.id_1, CONCAT(a.aca_code , " - " , a.aca_name, " - " , f.fa_code , " - " , f.name) AS id_name
FROM year_faculty yf
JOIN faculty f ON yf.faculty_code = f.fa_code
JOIN academic_year a ON yf.academic_code = a.aca_code
', 'WHERE yf.id_1 IN (', @arr_key, ')','
ORDER BY a.aca_code;
');
WHEN id_type = "id_2" THEN
SET @a = CONCAT('
SELECT yfp.id_2, yf.id_1, CONCAT(a.aca_code , " - " , a.aca_name, " - " , f.fa_code , " - " , f.name , " - " ,
p.pro_code , " - " , p.name) AS id_name
FROM year_fac_pro yfp
JOIN year_faculty yf ON yfp.id_1 = yf.id_1
JOIN faculty f ON yf.faculty_code = f.fa_code
JOIN academic_year a ON yf.academic_code = a.aca_code
JOIN program p ON yfp.program_code = p.pro_code
', 'WHERE yfp.id_2 IN (', @arr_key, ')','
ORDER BY a.aca_code;
');
WHEN id_type = "id_3" THEN
SET @a = CONCAT('
SELECT yfpm.id_3, yfp.id_2, yf.id_1,
CONCAT(a.aca_code , " - " , a.aca_name, " - " , s.sem_code, " - ", f.fa_code , " - " , f.name , " - " ,
p.pro_code , " - " , p.name, " - ", m.mo_code, " - ", m.name) AS id_name, s.sem_code, m.mo_code
Expand All @@ -595,8 +635,13 @@ BEGIN
JOIN semester s ON s.academic_code = a.aca_code
JOIN program p ON yfp.program_code = p.pro_code
JOIN module m ON yfpm.module_code = m.mo_code
', 'WHERE yfpm.id_3 IN (', @arr_key, ')','
ORDER BY a.aca_code;
');
END CASE;
PREPARE stmt1 FROM @a;
EXECUTE stmt1;
DEALLOCATE PREPARE stmt1;
END //
DELIMITER ;

Expand All @@ -610,4 +655,43 @@ BEGIN
END //
DELIMITER ;

DROP PROCEDURE IF EXISTS java_app.accessControlAddProgram;
DELIMITER //
CREATE PROCEDURE accessControlAddProgram(user VARCHAR(20),program_code VARCHAR(10),program_name VARCHAR(50))
BEGIN
INSERT INTO program(pro_code,name) VALUES(program_code,program_name);
SET @f = (SELECT MAX(faculty_code) FROM deans WHERE username = user and now() <= end_date and now() >= start_date);
SET @a = (SELECT id_1 FROM year_faculty
WHERE academic_code = (SELECT MAX(academic_code) FROM year_faculty where faculty_code = @f)
AND faculty_code = @f);
INSERT INTO year_fac_pro(id_1, program_code) VALUES(@a,program_code);
END //
DELIMITER ;

DROP PROCEDURE IF EXISTS java_app.accessControlAddModule;
DELIMITER //
CREATE PROCEDURE accessControlAddModule(user VARCHAR(20),mo_code VARCHAR(10),mo_name VARCHAR(50))
BEGIN
INSERT INTO module(mo_code,name) VALUES(mo_code,mo_name);
SET @f = (SELECT MAX(faculty_code) FROM deans WHERE username = user and now() <= end_date and now() >= start_date);
SET @p = (SELECT MAX(program_code) FROM program_coordinator WHERE username = user and now() <= end_date and now() >= start_date);
SET @a = (SELECT MAX(id_2) FROM year_fac_pro yfp JOIN year_faculty yf ON yf.id_1=yfp.id_1
WHERE yf.academic_code = (SELECT MAX(academic_code) FROM year_faculty yf where @f = yf.faculty_code)
AND yf.faculty_code = @f);
SET @b = (SELECT id_2 FROM year_fac_pro yfp JOIN year_faculty yf ON yf.id_1=yfp.id_1
WHERE yf.academic_code = (SELECT MAX(academic_code) FROM year_faculty yf JOIN year_fac_pro yfp ON yf.id_1=yfp.id_1 where @p = yfp.program_code)
AND yfp.program_code = @p);
INSERT INTO year_fac_pro_mo(id_2, module_code) VALUES(IF(ISNULL(@f),@b,@a),mo_code);
END //
DELIMITER ;

DROP PROCEDURE IF EXISTS java_app.accessControlAddTeachingForLec;
DELIMITER //
CREATE PROCEDURE accessControlAddTeachingForLec(user VARCHAR(20),size INT, sem_code VARCHAR(10),id_3 INT)
BEGIN
INSERT INTO class(size, semester_code, id_3) VALUES(size, sem_code, id_3);
SET @l = (SELECT lec_code FROM lecturer WHERE username = user);
SET @c = (SELECT LAST_INSERT_ID());
INSERT INTO teaching(class_code, lecturer_code) VALUES(@c,@l);
END //
DELIMITER ;
Loading