[Dashboard/Study Progression -- View recruitment per site] Restricting users to see statistics only from sites they have access to.

[racostas]

Brief summary of changes

In dashboard-> Study Progression-> View recruitment per site users were able to see statistics from sites they do not belong/have access

Testing instructions

Now each user should be able to see the view recruitment per site only for the sites it belong/have access

Notes

This is a fix for 22.0.0, major design changes as creating a permission dedicated to statistics still pending.

Notes relative to the code-set:

The structure:

$recruitmentStartDate = $DB->pselectOne(
    "SELECT MIN(Date_registered)
     FROM candidate
     WHERE RegistrationCenterID IN (:Sites)",
    array(*'Sites' => implode(",", array_keys($list_of_sites))*)
);

Doesn't seem to be working for me. Only the first element of the array $list_of_sites is been passed to the IN SQL clause. Not sure if I'm using correctly this way. For the moment I write it as:

$recruitmentStartDate = $DB->pselectOne(
    "SELECT MIN(Date_registered)
     FROM candidate
     WHERE RegistrationCenterID IN (" . $sitesString . ")",
    array()
);

(Please see additional related code notes on #5847)

Links to related tickets (GitHub, Redmine, ...)

#5847

[johnsaigle]

array(*'Sites' => implode(",", array_keys($list_of_sites))*)

I'm a bit confused about the *s in the example. Are these meant for Markdown emphasis or are they actually in the code?

[racostas]

Hi @johnsaigle. Thanks. No, sorry, the *s was trying to put that part of the text in bold here in github. My bad.

In the actual code is without it, just: array('Sites' => implode(",", array_keys($list_of_sites))).

As mentioned before, it is able to retrieve the first element in the array but only the the first. So the behaviour I'm seeing is that the query does IN ('FIRST_ELEMENT', 'ignore', 'the', 'rest'). It does not break but just ignore the rest of the elements acting more like an "=".

Cheers,
Rolando.

[johnsaigle]

Thanks for the feedback.

I'm not sure why the code is behaving that way. I think it would be good to dig into why that's happening because it's not usually a good idea to take strings and put them directly into SQL statements. It's likely safe in this case but it would be better to use prepared statements if possible.

I don't have time to look into it right now but I can look at it soon and try to find a solution if no one else weighs in first.

[PapillonMcGill]

Need to remove DCC center (ID=1) to follow current implementation

[racostas]

I'm aborting this PR in favour of the great major redesign proposed on #5896. Nice!

[racostas]

Deprecated by #5917